My domain is: dhis2poc.knowtechture.com
I ran this command: sudo certbot renew --dry-run
It produced this output:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/dhis2poc.knowtechture.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for dhis2poc.knowtechture.com and www.dhis2poc.knowtechture.com
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: dhis2poc.knowtechture.com
Type: unauthorized
Detail: 108.157.150.129: Invalid response from https://dhis2poc.knowtechture.com/dhis-web-commons/security/login.action: "<!DOCTYPE HTML>\n<html class=\"loginPage\" dir=\"ltr\">\n<head>\n <title>DHIS 2</title>\n <meta name=\"description\" content=\"DHIS 2"
Domain: www.dhis2poc.knowtechture.com
Type: unauthorized
Detail: 108.157.150.29: Invalid response from https://www.dhis2poc.knowtechture.com/dhis-web-commons/security/login.action: "<!DOCTYPE HTML>\n<html class=\"loginPage\" dir=\"ltr\">\n<head>\n <title>DHIS 2</title>\n <meta name=\"description\" content=\"DHIS 2"
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Failed to renew certificate dhis2poc.knowtechture.com with error: Some challenges have failed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All simulated renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/dhis2poc.knowtechture.com/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version): Nginx 1.18.0
The operating system my web server runs on is (include version): Ubuntu 22.04
My hosting provider, if applicable, is: It's an EC2 machine on AWS
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.11.0
Hi everyone, I'm currently trying to test the automatic renew of a certificate I generated for my site, but I'm having problems trying to understand what's wrong.
For more context, my site is behind a CDN (AWS CloudFront) but this was added after I generated the certificate using Certbot, now that I'm attempting to test the renewal it's giving me this error.
Any help or suggestions about where to start tackling this error will be greatly appreciated. Many thanks!
Nginx configuration:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
# multi_accept on;
}
http {
gzip on; # Enables compression, incl Web API content-types
gzip_types
"application/json;charset=utf-8" application/json
"application/javascript;charset=utf-8" application/javascript text/javascript
"application/xml;charset=utf-8" application/xml text/xml
"text/css;charset=utf-8" text/css
"text/plain;charset=utf-8" text/plain;
# HTTP server - rewrite to force use of SSL
server {
listen 80;
#server_name dhis2poc.knowtechture.com;
rewrite ^ https://dhis2poc.knowtechture.com$request_uri? permanent;
}
# HTTPS server
server {
listen 443 ssl;
#server_name dhis2poc.knowtechture.com;
client_max_body_size 10M;
ssl on;
ssl_certificate /etc/letsencrypt/live/dhis2poc.knowtechture.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/dhis2poc.knowtechture.com/privkey.pem;
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers RC4:HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
# Proxy pass to servlet container
location / {
proxy_pass http://localhost:8080/;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_buffer_size 128k;
proxy_buffers 8 128k;
proxy_busy_buffers_size 256k;
proxy_cookie_path ~*^/(.*) "/$1; SameSite=Lax";
}
location /glowroot {
proxy_pass http://localhost:4000/glowroot;
}
}
}
