Certbot failed to authenticate some domains

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: hostpepper.com

I ran this command:

certbot certonly --webroot --dry-run -w /var/www/html -d mail.hostpepper.com

It produced this output:

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

root@hostpepper:~# root@hostpepper:~# certbot certonly --webroot --dry-run -w /var/www/html -d mail.hostpepper.com

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Simulating a certificate request for mail.hostpepper.com

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: mail.hostpepper.com
  Type:   unauthorized
  Detail: 174.75.38.76: Invalid response from https://mail.hostpepper.com/.well-known/acme-challenge/drTp9DTAYU4MLjZHk18mVe-QiU75ddvsYHzoi43vxo0: 404

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Some challenges have failed.
Ask for help or search for solutions at h~

My web server is (include version): mail server is iredmail

The operating system my web server runs on is (include version):ubuntu 20.04 LTS

My hosting provider, if applicable, is: na / self hosted

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot

2

The "404" error code in the detail message means "Not Found". Your nginx server replied with that instead of returning the challenge token. That token got placed in the -w folder /var/www/html

Is that folder the root in your nginx server block that handles this mail subdomain?

Because a common reason for this 404 is the -w folder in your command line does not match the root folder in your server block.

3 Likes
3

Hi Mike,

Thank you for the reply. I am not savvy enough in Ubuntu to answer or remedy. I am looking for additional support if you or anyone can point me in the right direction to resolve.

Thank you, Allen

1 Like
4

Running your own mail server has a large learning curve. Getting a cert is one of the easier steps. Maybe you should consider other alternatives to this DIY effort given your current skill level.

2 Likes
5

Hi Mike,

I understand the learning curve aspect of it. We are currently operating on this server and my previous support is not currently available, so just looking for guidance or willing to pay for services.

Thank you, Allen

1 Like
6

Can you show the nginx server block for port 80 with the mail subdomain?

Or, show the output of this command?

sudo nginx -T

A capital T is essential. The output will be very long.

2 Likes
7 
Using username "sUVnS56qrE9P".
include /etc/nginx/templates/autoconfig.tmpl;
include /etc/nginx/templates/misc.tmpl;
}

server {
listen 443 ssl;
listen [::]:443 ssl;

server_name autoconfig.* autodiscover.*;
root /opt/www/autoconfig;

# Deny access to config file.
location = /config.inc.php { deny all; }

include /etc/nginx/templates/autoconfig.tmpl;
include /etc/nginx/templates/ssl.tmpl;
include /etc/nginx/templates/misc.tmpl;
}

# configuration file /etc/nginx/templates/autoconfig.tmpl:
8

I don't know what you are trying to show. That isn't the server block for mail subdomain or the whole output of nginx -T.

Maybe someone else here will be willing to work you through this but I think you need to learn more about how nginx works first. See the docs at nginx.org and forums for new server admins.

I'm an unpaid volunteer offering my time and expertise for free. Your problem is more involved than I wish to work on. Best of luck to you.

2 Likes
9

Hi Mike,

I was able to figure this out after all. Many thanks!

Allen

3 Likes
10

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.