Certbot renew failure

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: bibidiart.com

I ran this command: ./certbot-auto renew --dry-run

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log


Processing /etc/letsencrypt/renewal/bibidiart.com.conf


Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for bibidiart.com
nginx: [warn] low address bits of 192.168.100.1/24 are meaningless in /etc/nginx/conf.d/default.conf:19
nginx: [warn] low address bits of 192.168.100.1/24 are meaningless in /etc/nginx/conf.d/default.conf:87
Waiting for verification…
Challenge failed for domain bibidiart.com
http-01 challenge for bibidiart.com
Cleaning up challenges
nginx: [warn] low address bits of 192.168.100.1/24 are meaningless in /etc/nginx/conf.d/default.conf:17
nginx: [warn] low address bits of 192.168.100.1/24 are meaningless in /etc/nginx/conf.d/default.conf:83
Attempting to renew cert (bibidiart.com) from /etc/letsencrypt/renewal/bibidiart.com.conf produced an unexpected error: Some challenges have failed… Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/bibidiart.com/fullchain.pem (failure)


** DRY RUN: simulating ‘certbot renew’ close to cert expiry
** (The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/bibidiart.com/fullchain.pem (failure)
** DRY RUN: simulating ‘certbot renew’ close to cert expiry
** (The test certificates above have not been saved.)


1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: bibidiart.com
    Type: unauthorized
    Detail: Invalid response from
    https://bibidiart.com/.well-known/acme-challenge/VCTIMzcQstxZVpE5VQKdBvvhlvg1qiJWSXIqlB5QW2A
    [211.117.207.159]: “\r\n<html
    lang=“ko”>\r\n\r\n <meta charset=“utf-8”>\r\n <meta
    http-equiv=“x-ua-compatible” content=“ie=edge”>”

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address.

My web server is (include version): nginx/1.17.0

The operating system my web server runs on is (include version): CentOS Linux release 7.6.1810 (Core)

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): certbot : certbot 0.31.0 / certbot-auto : certbot 0.34.2

Hi @fireggking

looks like nginx doesn't understand your configuration.

Checking the main things that's ok ( https://check-your-website.server-daten.de/?q=bibidiart.com ):

Domainname Http-Status redirect Sec. G
• http://bibidiart.com/
211.117.207.159 301 https://bibidiart.com/ 0.486 A
• http://www.bibidiart.com/
211.117.207.159 301 https://bibidiart.com/ 0.483 E
• https://bibidiart.com/
211.117.207.159 200 2.524 B
• https://www.bibidiart.com/
211.117.207.159 200 2.413 N
Certificate error: RemoteCertificateNameMismatch
• http://bibidiart.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
211.117.207.159 301 https://bibidiart.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.487 A
Visible Content: 301 Moved Permanently nginx
• http://www.bibidiart.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
211.117.207.159 301 https://bibidiart.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.493 E
Visible Content: 301 Moved Permanently nginx
• https://bibidiart.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 404 2.316 A
Not Found
Visible Content: 404 Page Not Found Sorry, but the page you were trying to view does not exist. Go Back

Port 80 is open, there is a redirect http -> https.

But there is a problem visible:

A Info: Different Server-Headers found

http - a "Server: nginx" answers, https - a "Server: nginx/1.17.0" answers.

Looks like you have two different servers and Certbot picks the wrong.

So try to find the "root" of your https - nginx vHost. Then use that.

certbot run -a webroot -i nginx -w yourRoot -d bibidiart.com -d www.bibidiart.com
1 Like

Hi JuergenAuer

Thank you.
Resolved.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.