Challenge failed

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: https://www.xplosivwholesale.com.au/

I ran this command: ./certbot-auto certonly --webroot -w /home/all/xplosivw/webapps/ROOT/ -d www.xplosivwholesale.com.au -d xplosivwholesale.com.au

It produced this output:
Challenge failed for domain www.xplosivwholesale.com.au
Challenge failed for domain xplosivwholesale.com.au
http-01 challenge for www.xplosivwholesale.com.au
http-01 challenge for xplosivwholesale.com.au
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

My web server is (include version):
NAME=openSUSE
VERSION=“13.1 (Bottle)”
VERSION_ID=“13.1”
PRETTY_NAME=“openSUSE 13.1 (Bottle) (x86_64)”
ID=opensuse
ANSI_COLOR=“0;32”
CPE_NAME=“cpe:/o:opensuse:opensuse:13.1”
BUG_REPORT_URL=“https://bugs.opensuse.org”
HOME_URL=“https://opensuse.org/”
ID_LIKE=“suse”

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is: NA

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): certbot-auto 0.40.1

We have multiple websites running off the same apache, all using certbot. Normally these renew fine but this time we’re getting the above error

1 Like
2

Hi @ljordan67

checking your domain you see the problem - https://check-your-website.server-daten.de/?q=xplosivwholesale.com.au

You have ipv4 and ipv6 - that's good.

Host T IP-Address is auth. ∑ Queries ∑ Timeout
xplosivwholesale.com.au A 119.9.12.144 Sydney/New South Wales/Australia (AU) - Rackspace.com Hong Kong Limited No Hostname found yes 2 0
AAAA 2404:8280:a222:bbbb:bba1:24:ffff:ffff Mascot/New South Wales/Australia (AU) - Dreamscape Networks Limited yes
www.xplosivwholesale.com.au C xplosivwholesale.com.au yes 1 0
A 119.9.12.144 Sydney/New South Wales/Australia (AU) - Rackspace.com Hong Kong Limited No Hostname found yes
AAAA 2404:8280:a222:bbbb:bba1:24:ffff:ffff Mascot/New South Wales/Australia (AU) - Dreamscape Networks Limited yes

But your ipv6 doesn't work, only ConnectFailures:

Domainname Http-Status redirect Sec. G
• http://xplosivwholesale.com.au/ 119.9.12.144 301 https://www.xplosivwholesale.com.au/ Html is minified: 100,00 % 0.650 E
• http://www.xplosivwholesale.com.au/ 119.9.12.144 301 https://www.xplosivwholesale.com.au/ Html is minified: 100,00 % 0.656 A
• http://xplosivwholesale.com.au/ 2404:8280:a222:bbbb:bba1:24:ffff:ffff -2 7.094 V
ConnectFailure - Unable to connect to the remote server
• http://www.xplosivwholesale.com.au/ 2404:8280:a222:bbbb:bba1:24:ffff:ffff -2 7.093 V
ConnectFailure - Unable to connect to the remote server

That's critical because Letsencrypt prefers ipv6 checking your domain.

So you have two options:

  • Remove the ipv6, create a certificate, fix your ipv6 (or, better)
  • fix your ipv6 directly.

These other domains may not have an ipv6 address.

You can check your ipv6 directly - without having an AAAA record.

1 Like
3

thanks for the info, that is very useful. I’ll investigate the ipv6 address and see what we can do.

1 Like
4

You can check the ipv6 directly - https://check-your-website.server-daten.de/?q=[2404%3A8280%3Aa222%3Abbbb%3Abba1%3A24%3Affff%3Affff]

Domainname Http-Status redirect Sec. G
• http://[2404:8280:a222:bbbb:bba1:0024:ffff:ffff]/ 2404:8280:a222:bbbb:bba1:24:ffff:ffff -2 7.100 V
ConnectFailure - Unable to connect to the remote server
• https://[2404:8280:a222:bbbb:bba1:0024:ffff:ffff]/ 2404:8280:a222:bbbb:bba1:24:ffff:ffff No GZip used - 3299 / 8159 - 40,43 % possible
Inline-JavaScript (∑/total): 2/494 Inline-CSS (∑/total): 1/153 200 Html is minified: 138,62 % 8.360 N
Certificate error: RemoteCertificateNameMismatch
• http://[2404:8280:a222:bbbb:bba1:0024:ffff:ffff]/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 2404:8280:a222:bbbb:bba1:24:ffff:ffff -2 7.080 V
ConnectFailure - Unable to connect to the remote server
Visible Content:

Then a lot of checks are skipped.

Your ipv6 + https works, but your ipv6 + http not. Ipv6 + http is required, so Letsencrypt can check your domain.

PS: So compare your http and https vHost definitions to see, why ipv6 + http doesn't answer.

1 Like
5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.