Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com ), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: pedosupport.de
I ran this command: sudo certbot --nginx -d www.pedosupport.de -d www.pedosupport.de
It produced this output:www.pedosupport.de
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:www.pedosupport.de http://www.pedosupport.de/.well-known/acme-challenge/CaTmY_rZ75wplhOpqcQ5sBpzuYblrD4HtJg78bDveYE: 204
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Some challenges have failed.https://community.letsencrypt.org . See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version): nginx
The operating system my web server runs on is (include version): Ubunto 20.4
My hosting provider, if applicable, is: ionos
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Certbot 2.6.0
That should probably be -d pedosupport.de -d www.pedosupport.de
The 204 error means your nginx is not sending the correct response. Certbot --nginx plug-in should have your nginx returning a 200 OK with the correct value to prove your domain.
Often we see 404 Not Found when something is wrong so 204 is unusual. Do you have some sort of security setting that is doing the 204?
3 Likes
MikeMcQ:
Certbot --nginx
certbot --nginx
gets me:
i used
apt install python3-certbot-nginx
now it says its installed but still fails
rg305
July 16, 2023, 11:59pm
5
Then you may have multiple versions of certbot installed.nginx configuration:nginx -T
2 Likes
rg305:
nginx -T
root@ubuntu:/etc/nginx/sites-enabled# nginx -T
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
##
# Gzip Settings
##
gzip on;
# gzip_vary on;
# gzip_proxied any;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
##
# Virtual Host Configs
##
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
#mail {
# # See sample authentication script at:
# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
# # auth_http localhost/auth.php;
# # pop3_capabilities "TOP" "USER";
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
# server {
# listen localhost:110;
# protocol pop3;
# proxy on;
# }
#
# server {
# listen localhost:143;
# protocol imap;
# proxy on;
# }
#}
# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip2.conf:
load_module modules/ngx_http_geoip2_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:
load_module modules/ngx_http_image_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:
load_module modules/ngx_http_xslt_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:
load_module modules/ngx_mail_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:
load_module modules/ngx_stream_module.so;
# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip2.conf:
load_module modules/ngx_stream_geoip2_module.so;
# configuration file /etc/nginx/mime.types:
types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;
image/png png;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;
image/svg+xml svg svgz;
image/webp webp;
application/font-woff woff;
application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.wap.wmlc wmlc;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xspf+xml xspf;
application/zip zip;
application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;
video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;
}
# configuration file /etc/nginx/sites-enabled/default:
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##
# Default server configuration
#
server {
listen 80 default_server;
listen [::]:80 default_server;
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name www.pedosupport.de;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
# pass PHP scripts to FastCGI server
#
#location ~ \.php$ {
# include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
# listen 80;
# listen [::]:80;
#
# server_name pedosupport.de;
#
# root /var/www/
# index index.html;
#
# location / {
# try_files $uri $uri/ =404;
# }
#}
rg305
July 17, 2023, 12:14am
7
Are you on the correct system?curl -4 ifconfig.iocurl -6 ifconfig.io
There is only one vhost shown:
server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
server_name www.pedosupport.de;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
}
I don't see how that can handle the https requests:
view-source:https://pedosupport.de
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
<html>
<head>
<title>Pedosupport.de Hilfe f&amp;uuml;r P&amp;auml;dophile Menschen</title>
<meta name="keywords" content="-" />
<meta name="description" content="Pedosupport.de Hilfe f&amp;uuml;r P&amp;auml;dophile Menschen" />
<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
</head>
<frameset rows="100%">
<frame src="http://87.106.197.137/" title="Pedosupport.de Hilfe f&amp;uuml;r P&amp;auml;dophile Menschen" frameborder="0" noresize="noresize"/>
<noframes>
<body>
<h1>Pedosupport.de Hilfe f&amp;uuml;r P&amp;auml;dophile Menschen</h1>
<p><a href="http://87.106.197.137/">https://pedosupport.de</a> </p>
</body>
</noframes>
</frameset>
</html>
2 Likes
should be the correct server i had it preinstalled from an image and just installed nginx on top of that
root@ubuntu:/etc/nginx/sites-enabled# curl -4 ifconfig.io ifconfig.io
rg305
July 17, 2023, 12:35am
9
You are NOT on the correct system:
Name: pedosupport.de
Addresses: 2001:8d8:100f:f000::200
217.160.0.40
3 Likes
thats weird i dont know how to fix that, i only have this one server any suggestion?
rg305
July 17, 2023, 12:41am
11
Who controls the DNS for this domain?IP 217.160.0.40]?
3 Likes
rg305:
217.160.0.40
i dont even know where 217.160.0.40 is from, i do control the DNS, my domain is at all-inkl.com and redirects to my server at ionos.de
rg305
July 17, 2023, 12:47am
13
If by redirect, you mean:
That is NOT redirection.87.106.197.137.certbot to obtain a cert and use it to secure your site [via its' real name - not within an IP frame].
And do the same for the "www" addresses.
3 Likes
Thanks i get these 2 now
root@ubuntu:/etc/nginx/sites-enabled# sudo certbot --nginx -d www.pedosupport.de
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for www.pedosupport.de
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/www.pedosupport.de/fullchain.pem
Key is saved at: /etc/letsencrypt/live/www.pedosupport.de/privkey.pem
This certificate expires on 2023-10-14.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate
Successfully deployed certificate for www.pedosupport.de to /etc/nginx/sites-enabled/default
Congratulations! You have successfully enabled HTTPS on https://www.pedosupport.de
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
and the site seems to be working yay, fully working now with www (without www i just get a 404 but ill see about that tomorrow)!
1 Like
I see your certs are working so very nice.
But, you should review your redirects for pedosupport.de. You redirect HTTP requests for that to HTTPS but then issue a 404 Not Found.
HTTPS requests to your www domain respond with a 200 OK (and http redirects to https)
I think you should make sure HTTPS to your root domain redirects to your www domain
curl -I http://pedosupport.de
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Location: https://pedosupport.de/
curl -I https://pedosupport.de
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
4 Likes
system
August 16, 2023, 2:03pm
16
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.