Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: apex-test.dnv.com
I ran this command: sudo certbot --nginx
It produced this output:
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: apex-test.dnv.com
Type: unauthorized
Detail: Invalid response from http://apex-test.dnv.com/.well-known/acme-challenge/Dba3tk5zWH670COWWirTQo8dY9gcdi9KwWdbgkaE3Xk [51.124.73.17]: "<html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your administrator.<"
My web server is (include version): nginx 1.14
The operating system my web server runs on is (include version): Oracle Linux 8
My hosting provider, if applicable, is: NA
I can login to a root shell on my machine (yes or no, or I don't know): Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): NO
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):certbot 1.23.0
Certbox was installed following the instructions for Fedora (i.e it's a snap installation).
nginx.conf:
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _ apex-test.dnv.com;
root /usr/share/nginx/html/;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
}
}
My site returns the default index.html file from HTTP.
The log has things like:
2022-02-09 16:10:22,067:DEBUG:certbot.crypto_util:Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem
2022-02-09 16:10:22,072:DEBUG:acme.client:JWS payload:
b'{\n "identifiers": [\n {\n "type": "dns",\n "value": "apex-test.dnv.com"\n }\n ]\n}'
2022-02-09 16:10:22,074:DEBUG:acme.client:Sending POST request to https://acme-staging-v02.api.letsencrypt.org/acme/new-
order:
{
2022-02-09 16:10:22,397:DEBUG:certbot_nginx._internal.parser:Writing nginx conf tree to /etc/nginx/nginx.conf:
# For more information on configuration, see:
# * Official English Documentation: http://nginx.org/en/docs/
# * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
include /etc/letsencrypt/le_http_01_cert_challenge.conf;
server_names_hash_bucket_size 128;
server {rewrite ^(/.well-known/acme-challenge/.*) $1 break; # managed by Certbot
listen 80 default_server;
listen [::]:80 default_server;
server_name azurewe1548.azureexternal.dnvgl.com apex-test.dnv.com;
location = /.well-known/acme-challenge/Dba3tk5zWH670COWWirTQo8dY9gcdi9KwWdbgkaE3Xk{default_type text/plain;return 200 Dba3tk5zWH670COWWirTQo8dY9gcdi9KwWdbgkaE3Xk.mgkz5RfepOAFO-EBIRAn4sOvQVOfk28q9lsLA_cmpc0;} # managed by Certbot
}
and
2022-02-09 16:10:24,748:INFO:certbot._internal.auth_handler:Challenge failed for domain apex-test.dnv.com
2022-02-09 16:10:24,748:INFO:certbot._internal.auth_handler:http-01 challenge for apex-test.dnv.com
2022-02-09 16:10:24,748:DEBUG:certbot._internal.display.obj:Notifying user:
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: apex-test.dnv.com
Type: unauthorized
Detail: Invalid response from http://apex-test.dnv.com/.well-known/acme-challenge/Dba3tk5zWH670COWWirTQo8dY9gcdi9KwWdbgkaE3Xk [51.124.73.17]: "<html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your administrator.<"
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
2022-02-09 16:10:24,750:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
File "/var/lib/snapd/snap/certbot/1788/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 106, in handle_authorizations
self._poll_authorizations(authzrs, max_retries, best_effort)
LetsDebug doesn't see an issue.
My access and error logs don't seem to show any incoming traffic as a result of the certbot action.
