Dear community,
I’ve encountered issues with using certbot for a number of domains which share basically the same setup. It is a tad intricate, so some explanations first.
I have four domains:
a-a.org is the target domain, so to speak, as all other three redirect to the same subdirectory of it. a-a.org also has a subdomain x.a-a.org which redirects to the same subdirectory.
In nginx this looks like the following.
x.a-a.org (Subdomain)
server {
root /var/www/a-a.org/x;
index index.html index.htm index.nginx-debian.html;
server_name x.a-a.org;
location / {
return 301 https://a-a.org/x$request_uri;
}
}
a-a.org (“Main” domain)
server {
root /var/www/a-a.org;
index index.html index.htm index.nginx-debian.html;
server_name a-a.org www.a-a.org;
location / {
try_files $uri $uri/ =404;
}
b-b.org, c-c.org, d.org (The three secondary domains):
server {
root /var/www/a-a.org;
index index.html index.htm index.nginx-debian.html;
server_name d.org www.d.org;
location = / {
return 301 https://a-a.org/x;
}
}
server {
root /var/www/a-a.org;
index index.html index.htm index.nginx-debian.html;
server_name b-b.org www.b-b.org;
location = / {
return 301 https://a-a.org/x;
}
}
When I run
certbot --nginx
I get the following results:
$ sudo certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Which names would you like to activate HTTPS for?
-------------------------------------------------------------------------------
1: d.org
2: www.d.org
3: a-a.org
4: x.a-a.org
5: www.a-a.org
6: b-b.org
7: www.b-b.org
9: c-c.org
10: www.c-c.org
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
-------------------------------------------------------------------------------
You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/other-domain.conf)
It contains these names: d.org, x.a-a.org,
other-domain, a-a.org, www.d.org,
www.a-a.org
You requested these names for the new certificate: d.org,
www.d.org, a-a.org, x.a-a.org,
www.a-a.org, b-b.org, www.b-b.org,
other-domain, c-c.org,
www.c-c.org.
Do you want to expand and replace this existing certificate with the new
certificate?
-------------------------------------------------------------------------------
(E)xpand/(C)ancel: E
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for d.org
http-01 challenge for www.d.org
http-01 challenge for a-a.org
http-01 challenge for x.a-a.org
http-01 challenge for www.a-a.org
http-01 challenge for b-b.org
http-01 challenge for www.b-b.org
tls-sni-01 challenge for other-domain
http-01 challenge for c-c.org
http-01 challenge for www.c-c.org
nginx: [warn] conflicting server name "x.a-a.org" on 0.0.0.0:80, ignored
Waiting for verification...
Cleaning up challenges
nginx: [warn] conflicting server name "x.a-a.org" on 0.0.0.0:80, ignored
…
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: c-c.org
Type: unauthorized
Detail: Invalid response from
http://c-c.org/.well-known/acme-challenge/{key}:
"<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>"
Domain: www.c-c.org
Type: unauthorized
Detail: Invalid response from
http://www.c-c.org/.well-known/acme-challenge/{key}:
"<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>"
Domain: b-b.org
Type: unauthorized
Detail: Invalid response from
http://b-b.org/.well-known/acme-challenge/{key}:
"<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>"
Domain: www.b-b.org
Type: unauthorized
Detail: Invalid response from
http://www.b-b.org/.well-known/acme-challenge/{key}:
"<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
So basically, b-b.org and c-c.org didn’t go through, while d.org worked fine despite having the same setup.
I’d be thankful for any pointer as to why this could possibly be the case.
All domains share the same IPv4 and IPv6 IPs…