Certbot won't write nonce file & Can't find manual file

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: cadrewiki.rangerhq.net

I ran this command: certbot --manual certonly

It produced this output: Create a file with a code in .well-known/acme-challenge/ folder

My web server is (include version): Apache/2.4.41 (Ubuntu)

The operating system my web server runs on is (include version): Ubuntu 20.04

My hosting provider, if applicable, is: self

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.5.0

I've had certbot running on my server for a couple of years with no problem. I recently noticed that certificates were not getting renewed, with the last renewal round mid-February. I tried running the "certbot --apache" command to update all certificates and it failed. I then ran the "certbot --apache" command for one domain (cadrewiki.rangerhq.net) and it failed. I checked the .well-known/acme-challenge folder and there was no verification file.

I then ran the command "certbot --manual certonly" and created the requested file with the requested contents and manually added it to the acme-challenge folder. Here is what it told me to do:


Create a file containing just this data:

f1fSAAsHYFI8dWFUoFzE6bc-1tUtgmU10JgPqfZ4z9Y.E1Qw8Z-4iX0JpbxGGMMsKEFp1CbiAkPqDu_oNeB-8pI

And make it available on your web server at this URL:

http://cadrewiki.rangerhq.net/.well-known/acme-challenge/f1fSAAsHYFI8dWFUoFzE6bc-1tUtgmU10JgPqfZ4z9Y


...and I continuously get the same error, no matter how many times I try to redo this. The error is:

=====
Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: cadrewiki.rangerhq.net
Type: connection
Detail: 75.149.60.248: Fetching http://cadrewiki.rangerhq.net/.well-known/acme-challenge/f1fSAAsHYFI8dWFUoFzE6bc-1tUtgmU10JgPqfZ4z9Y : Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to verify the manually created challenge files. Ensure that you created these in the correct location.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

I've verified that the file "http://cadrewiki.rangerhq.net/.well-known/acme-challenge/f1fSAAsHYFI8dWFUoFzE6bc-1tUtgmU10JgPqfZ4z9Y" is accessible from the net. I've left it on the server so that hopefully someone can check it and give me a clue where to look to fix this issue.

Please comment and I'll post any further files to help with this.

Thank you in advance.
Hari Boukis

1 Like

Welcome to the community @hariboukis

I also see that sample challenge file from my own test server. And, the Let's Debug test site can connect to your domain but the test it does with the Let's Encrypt Staging System fails with the timeout.

This almost always is a firewall blocking certain IP addresses. Sometimes maybe even a geographic based firewall but I think this is less likely in this case given the places I've tested connectivity from.

Is an IP based firewall installed?

4 Likes

Firewall is pfSense

Then try disabling it and see if problem goes away.

I know others on this forum use pfSense but I don't. But, can you just disable blocks on port 80 for the ACME Challenge requests?

4 Likes

Does the firewall do some sort of GeoLocation blocking?
OR
IP list blocking?

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.