Certbot - Running Certbot on a Machine that is Not the Web Server Means Challenges Fail

I ran this command:
certbot certonly --standalone --email 584437830@qq.com -d gcenter.ol.ttigame.cn

It produced this output:

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: gcenter.ol.ttigame.cn
    Type: unauthorized
    Detail: Incorrect validation certificate for tls-sni-01 challenge.
    Requested
    bf23471475beb3cb85c1292df24a0d98.94b66852d73688b300e87fa0b0923198.acme.invalid
    from 121.201.7.19:443. Received 2 certificate(s), first certificate
    had names “doo.so, w.doo.so

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A record(s) for that domain
    contain(s) the right IP address.

My web server is (include version):
nginx version: openresty/1.11.2.2
The operating system my web server runs on is (include version):
ubuntu-14.04

I am a newbie here…really really thanks if you could help

Did you run Certbot on your web server? That’s required for standalone mode to work - you can’t just run it on your laptop.

Other things to check if that doesn’t help.

thank you very much. I ran the command on my computer and the webserver is another one. the document on the official website didn’t mention things like this we need to give particular attention…e…maybe I didn’t see it
anyway thank you very much
and now I am trying another command on the webserver:
certbot certonly --webroot -w /var/www/example -d example.com -d www.example.com

Hi @JhonHarrison,

Maybe @SwartzCr, who has been dealing with documentation updates, can look into how to make clearer that Certbot is meant to be run directly on the web server (which has been an occasional problem for a number of users).

When you ran your newly updated command on the server, did you succeed or get any error message?

Hi @JhonHarrison

The commands you mention talk to the apache server / filepath and modify them. If you are not running them on your web server then when the Let’s Encrypt servers try to validate you own the domain they will fail

Andrei

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.