Your main problem is that the certificate is for the wrong name. It needs to be for the domain name of the service (i.e. conversity.net), not the server (although it may be needed for other purposes). use the following command to get a cert for both names.
Thanks @cool110
I tried the command with both domains & got the following error message.
Failed authorization procedure. conversity.net (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for TLS-SNI-01 challenge. Requested da869940e1452f3e705a27677df616df.c2a5ba5db858c44e969a0eab4120deb5.acme.invalid from 188.166.223.107:443. Received certificate containing ‘conversity.net, www.conversity.net’
IMPORTANT NOTES:
The following errors were reported by the server:
Domain: conversity.net
Type: unauthorized
Detail: Incorrect validation certificate for TLS-SNI-01 challenge.
Requested
da869940e1452f3e705a27677df616df.c2a5ba5db858c44e969a0eab4120deb5.acme.invalid
from 188.166.223.107:443. Received certificate containing
’conversity.net, www.conversity.net’
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
conversity.net is a different server with its own SSL already installed.
That is ignoring the validation failure of conversity.net and generating a cert for xm4.conversity.net only. You’ll need to do one of the things in my previous post to get a useable cert.
The error there is because you aborted by pressing Ctrl-C.
It looks as if you are using the DNS check, so you have a script which should be updating the DNS at your domain name registrar (domaincontrol.com) which should add the txt record required for _acme-challenge.conversity.net to your auth nameservers ( ns29.domaincontrol.com and ns30.domaincontrol.com )
The script is checking for the txt record, and will pause for 10 seconds ( by default) before testing again. You aborted it before it had completed this from the above error.
If you want to check it manually you would need to check for the txt record
The text record isn't there, so either you didn't give it long enough, or the script to update your DNS records with the domaincontrol.com api isn't correct. I'd need more info ( your debug log) to determine exactly what it was.
If you want to use the HTTP-01 check, rather than the DNS-01 check, you need to change that option in your config.
In the 1st attempt, I aborted the process after 9 failed attempts.
I tried again and since the response was same, I aborted it in 2 attempts and posted here.
This DSN validation has been causing too much pain, I’ve installed a small standalone Python web server & I’ll use web validation. It seems simpler.
ON another note, after many failed attempts, I’m now getting a response:
There were too many requests of a given type :: Error creating new cert :: Too many certificates already issued for exact set of domains: xm4.conversity.net
Looks like I’ll have to wait for 1 week before resuming this exercise unless there is someway around it.
You could have used GetSSL for web validation instead of the DNS-01 challenge just by changing a single variable
You would be better testing using the staging server - as that doesn’t have the limits on it. Once you have that all set up and working correctly, then change to the live server for a valid certificate.
Setting up the config files of GetSSL was a bit overwhelming for me.
In the past 2 days, I have tried all possible tutorials, online services & scripts which help get LetsEncrypt but no luck.
The sub-domain issue coupled with the DNS validation has really burnt me out. I’m not a server guy so its been a bit of a challenge.
Unless you changed the config for GetSSL to go from the staging server to the live server, then all the attempts would have been with the staging server, and hence not hit any limits.
