Certificates for one particular domain failing even though DNS seems fine

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: unibrokers.com.ec

I ran this command:
certbot --nginx -d unibrokers.com.ec -d www.unibrokers.com.ec --test-cert

It produced this output:

# certbot --nginx -d unibrokers.com.ec -d www.unibrokers.com.ec --test-cert
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for www.unibrokers.com.ec
Waiting for verification...
Challenge failed for domain www.unibrokers.com.ec
http-01 challenge for www.unibrokers.com.ec
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: www.unibrokers.com.ec
   Type:   dns
   Detail: DNS problem: SERVFAIL looking up A for
   www.unibrokers.com.ec - the domain's nameservers may be
   malfunctioning; DNS problem: SERVFAIL looking up AAAA for
   www.unibrokers.com.ec - the domain's nameservers may be
   malfunctioning

My web server is (include version): NGINX 1.18

The operating system my web server runs on is (include version): Ubuntu 20.04

My hosting provider, if applicable, is: IVH

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 2.11.0

For some reason renewals were failing, I'm at the rate limit now... but I want to get this fixed so tomorrow I can get new certificates.

I checked from my home, I can query the domain just fine. I don't have any AAAA records, IPv4 only. Not sure how to proceed.

You have a CNAME loop for the www subdomain:

www.unibrokers.com.ec.	3600	IN	CNAME	hosting.unibrokers.com.ec.
hosting.unibrokers.com.ec. 3600	IN	CNAME	hosting.unibrokers.com.ec.

The second CNAME refers to itself, which obviously won't work.

See also www.unibrokers.com.ec | DNSViz and also https://unboundtest.com/m/A/www.unibrokers.com.ec/RUZNBBMB at the bottom of the huge page.

4 Likes

Oh my you're right, thanks a lot, fixed

2 Likes

Now it's a two-hop cname resolution:
www > hosting
hosting > domain

Why not use?:
www > domain

4 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.