Certbot failes to authentication

[mastrusr]

Sorry to revive an old thread but I don't now where to look for information on this...
I had everything working using nginx proxy manager and then all of a sudden I can not reach my domain from my phone. If I set a private dns (Adguard), it works... On Lan it works.

Please, any advice is much appreciated!

[rg305]

I still see this problem:

@rg305

I can reach it (but TLS is not working):
This is HTTP and good:

curl -Ii http://iotserver.st
HTTP/1.1 200 OK
Date: Fri, 13 May 2022 05:38:42 GMT
Server: Apache/2.2.15 (CentOS)
Connection: close
Content-Type: text/html; charset=iso-8859-1

This is HTTPS and fails:

curl -Ii https://iotserver.st
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

This is HTTP via the HTTPS port (not good, but possibly easy to fix):

curl -Ii http://iotserver.st:443
HTTP/1.1 200 OK
Date: Fri, 13 May 2022 05:38:45 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/4.4.9
Connection: close
Content-Type: text/html

Which seems to imply that the NAT device isn't forwarding the ports correctly.

[mastrusr]

Thanks.
Sorry, I forgot.

Domain in use:
iotsrv.xyz
Example: heimdall.iotsrv.xyz

[rg305]

You "forgot" that all this time we have been "working" with the wrong domain name? ("iotserver.st")

This new domain is behind CloudFlare:

Name:      iotsrv.xyz
Addresses: 2606:4700:3036::6815:199
           2606:4700:3031::ac43:8173
           104.21.1.153
           172.67.129.115

Name:      heimdall.iotsrv.xyz
Addresses: 2606:4700:3031::ac43:8173
           2606:4700:3036::6815:199
           104.21.1.153
           172.67.129.115

It should be simple to use their CA to secure all related connections.

[mastrusr]

Haha, no!! That was included from my isp but didn't work, so I bought a "real" domain.

I told you two weeks ago that u got it working. This new problem is with this domain.

Yes, it is. How do I use the CA (don't even know what that is?)? Will look at it today or tomorrow! Thanks.

[MikeMcQ]

You can use a Cloudflare Origin CA cert on your origin server. You don't need to use Let's Encrypt for that.
https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/

With a new domain name and a new config it would have been better for you to start a new topic. Something to keep in mind for future.

[mastrusr]

Thanks. I thought there was something like that going on since it says the certificate is from Cloudflare inc ecc CA-3.

Yes, I should have.

Any ideas why the site is unreachable from my phone when I use the mobile net?
Chrome gives: dns_probe_finished_nxdomain.
When I use dns.adguard.com as a "private DNS" the site opens..

[MikeMcQ]

@mastrusr

Any ideas why the site is unreachable from my phone when I use the mobile net?

I don't. That's a DNS lookup problem. Not related to your certs.

I can reach your site but it gives me a 520 error from Cloudflare. You can find more debug info for that here:
https://support.cloudflare.com/hc/en-us/articles/115003011431-Troubleshooting-Cloudflare-5XX-errors

curl -IL https://iotsrv.xyz
HTTP/2 520
date: Tue, 14 Jun 2022 15:42:08 GMT
content-length: 0
cache-control: no-store, no-cache
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D46dGsFsN%2F2L5xHTgfELmCRGlm6I%2F78gFAIoee86Z1bY6kZgJDFYdk45qYX4qfyEy1NYP8AiozLVOzLtGu3p%2BIVtErTb1YQi%2BsqCOBguxgmUiCnzGzWPSHBFBiZWpPBuAMPxoEOd9Lna"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 71b42c974d6e5d8c-IAD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400