Certbot HTTP-01 challenge failing on new NameSilo domain

I am following this guide to install Seafile on my Raspberry Pi but am getting an error when trying to get my HTTPS certificate. I purchased a domain (leatherwood.cloud) on NameSilo and added an A record that pointed to my public ipv4 address (found using https://whatismyipaddress.com). There was no ipv6 address detected so I didn't add an AAAA record. I waited for this to update then tried to run the following command to get my certificate:

sudo certbot certonly --nginx --domain leatherwood.cloud

However, I got this error saying that the HTTP-01 challenge failed:

Plugins selected: Authenticator nginx, Installer nginx
Requesting a certificate for www.leatherwood.cloud
Performing the following challenges:
http-01 challenge for www.leatherwood.cloud
Waiting for verification...
Challenge failed for domain www.leatherwood.cloud
http-01 challenge for www.leatherwood.cloud
Cleaning up challenges
Some challenges have failed.

I tried multiple times and also tried using the above command with "www.leatherwood.cloud" instead as well as removing the following DNS entries (that came preloaded when I purchased the domain):


Each time returned the same error. I also tried adding another DNS entry with the same IP address and the hostname "www".

It mentions that port 80 needs to be open - does this port come open by default or do I need to use iptables to open it up? I am also using a WiFi network that comes with my apartment; I am not sure if not having access to the router could be causing the issue. Does the domain need to be hosted for this to work? From what I understand, the site would be hosted off of my Raspberry Pi and I don't need to pay for hosting.

My domain is: leatherwood.cloud

I ran this command: sudo certbot certonly --nginx --domain leatherwood.cloud

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Requesting a certificate for www.leatherwood.cloud
Performing the following challenges:
http-01 challenge for www.leatherwood.cloud
Waiting for verification...
Challenge failed for domain www.leatherwood.cloud
http-01 challenge for www.leatherwood.cloud
Cleaning up challenges
Some challenges have failed.
 
IMPORTANT NOTES:
 - The following errors were reported by the server:
 
   Domain: www.leatherwood.cloud
   Type:   connection
   Detail: 72.196.44.14: Fetching
   http://www.leatherwood.cloud/.well-known/acme-challenge/KNj5KZ3gaVKvHjdj4TUcrQzexsDUbZ9JKDQGQRNyLZg:
   Timeout during connect (likely firewall problem)
 
   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

My web server is (include version): Nginx 1.18.0

The operating system my web server runs on is (include version): Raspberry Pi OS 11 (bullseye)

I can login to a root shell on my machine: yes

I'm using a control panel to manage my site: NameSilo Domain Manager

The version of my client is: certbot 1.12.0

Hi @hmlea, and welcome to the LE community forum :slight_smile:

I see two domain names:

  • leatherwood.cloud
  • www.leatherwood.cloud

That error message doesn't look like it came from that command.

That said, I think port 80 is unable to reach your server:

You also need to port forward the external 80 to the internal 80 [RPi].

2 Likes

Thanks for the response @rg305. That is my mistake on the error message - while it didn't come from that exact command, it came from this one: sudo certbot certonly --nginx --domain www.leatherwood.cloud. I double checked however and the error message for sudo certbot certonly --nginx --domain www.leatherwood.cloud is the same.

For the port forwarding, how do I go about doing that? When looking into it, all the examples I see require router access. Is there a way I can do this on my Raspberry Pi without logging into the router?

1 Like

Unfortunately, no.
The router is the one that isn't passing the request to the RPi.

4 Likes

That is sorta what I figured. Thank you so much for the help!

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.