Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Failed to renew certificate mentoring.cehrd.gov.np with error: Some challenges have failed.
and the config are stored in /etc/nginx/conf.d
Can you guys please help me to resolve it ASAP. I need to provide demo tomorrow.
HTTP requests on port 80 to your domain are failing. Something on your system is blocking those requests. Or, something like NAT or port forwarding is no longer working
HTTPS requests using port 443 work fine (apart from your expired cert). So it is just port 80
The Let's Debug test site is helpful to test changes you make. Once that says OK you should be able to renew the cert.
And here is what I see nmap showing Port 80 is filtered, implying that the firewalls and routers need to allow Port 80 through.
$ nmap -Pn -p80,443 mentoring.cehrd.gov.np
Starting Nmap 7.80 ( https://nmap.org ) at 2024-10-22 16:26 UTC
Nmap scan report for mentoring.cehrd.gov.np (103.69.124.47)
Host is up (0.31s latency).
PORT STATE SERVICE
80/tcp filtered http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 7.51 seconds
$ nmap -Pn -p80,443 mentoring.cehrd.gov.np Starting Nmap 7.80 ( https://nmap.org ) at 2024-10-22 16:41 UTC
Nmap scan report for mentoring.cehrd.gov.np (103.69.124.47)
Host is up (0.43s latency).
PORT STATE SERVICE
80/tcp filtered http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 5.80 seconds
Thanks so much for all your responses! I finally resolved the issue by temporarily disabling the automatic redirect to HTTPS.
For those facing similar problems, here's how I managed to fix it.
Original Certbot-Managed Server Block:
Certbot was automatically redirecting all traffic to HTTPS using the following server block:
server {
if ($host = mentoring.cehrd.gov.np) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name mentoring.cehrd.gov.np;
return 404; # managed by Certbot
}
Since Certbot needs HTTP for the ACME challenge, I had to temporarily disable the HTTPS redirect. Here's the modified server block:
Temporary Server Block:
server {
# Temporarily disable HTTPS redirection
# if ($host = yourwebsite.com) {
# return 301 https://$host$request_uri;
# } # managed by Certbot
listen 80;
server_name yourwebsite.com;
# Allow HTTP for the ACME challenge
location /.well-known/acme-challenge/ {
root /your-web-root-path; # Adjust to your webroot path
}
# Comment out the 404 return for Certbot to work
# return 404; # managed by Certbot
}
Step-by-Step Process:
Save the changes to your NGINX configuration file.
Restart NGINX:
sudo systemctl restart nginx
Run the renewal command:
sudo certbot renew
If you see the error "Another instance of Certbot is already running," kill the running process and try again:
sudo pkill certbot
If the issue persists, remove any Certbot lock files:
If it returns "test," your configuration is correct.
Finally, renew the certificate:
sudo certbot renew
Once the renewal is successful, don't forget to revert your server block back to redirect traffic to HTTPS:
server {
if ($host = yourwebsite.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name yourwebsite.com;
return 404; # managed by Certbot
}
That’s it! After following these steps, your certificate should be renewed, and HTTPS redirection will be back in place. I hope this helps anyone facing similar issues!
