Challenge invalid

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: francium.informatik.uni-ulm.de

I ran this command:
certbot certonly --webroot -w /var/www/certbot --preferred-challenges http-01 --staging --email hans-georg.gloeckler@uni-ulm.de -d francium.informatik.uni-ulm.de --rsa-key-size 2048 --agree-tos --force-renewal

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for francium.informatik.uni-ulm.de
Using the webroot path /var/www/certbot for all unmatched domains.
Waiting for verification…
Challenge failed for domain francium.informatik.uni-ulm.de
http-01 challenge for francium.informatik.uni-ulm.de
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: francium.informatik.uni-ulm.de
    Type: connection
    Detail: Fetching
    http://francium.informatik.uni-ulm.de/.well-known/acme-challenge/8d18gpIWGfPdvOn9KQ1iUW8RmJNsyk-sl3pe_Ee8rhI:
    Too many redirects

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you’re using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.

  • echo

  • echo ‘### Reloading nginx …’

Reloading nginx …

  • docker-compose exec proxy nginx -s reload
    2019/04/25 06:46:52 [emerg] 7#7: BIO_new_file("/etc/letsencrypt/live/francium.informatik.uni-ulm.de/fullchain.pem") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen(’/etc/letsencrypt/live/francium.informatik.uni-ulm.de/fullchain.pem’,‘r’) error:2006D080:BIO routines:BIO_new_file:no such file)
    nginx: [emerg] BIO_new_file("/etc/letsencrypt/live/francium.informatik.uni-ulm.de/fullchain.pem") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen(’/etc/letsencrypt/live/francium.informatik.uni-ulm.de/fullchain.pem’,‘r’) error:2006D080:BIO routines:BIO_new_file:no such file)

My web server is (include version):
nginx in docker container

The operating system my web server runs on is (include version):
docker image

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

1 Like

Hi @haglo

there is a check of your domain - ~~ 0,5 hours old ( https://check-your-website.server-daten.de/?q=francium.informatik.uni-ulm.de ):

There you see the problem:

Domainname Http-Status redirect Sec. G
http://francium.informatik.uni-ulm.de/
134.60.73.129 301 http://francium.informatik.uni-ulm.de/ 0.060 L
https://francium.informatik.uni-ulm.de/
134.60.73.129 500 0.493 N
Internal Server Error
Certificate error: RemoteCertificateNameMismatch, RemoteCertificateChainErrors
http://francium.informatik.uni-ulm.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
134.60.73.129 301 http://francium.informatik.uni-ulm.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.056 L
Visible Content: 301 Moved Permanently openresty/1.15.8.1rc1

Your http redirects to the same url.

Check your

  • .htaccess
  • your port 80 vHost of your

Server: openresty/1.15.8.1rc1

  • Or there is an application that creates this redirect.
1 Like

Thanks for your answer.
Now it works

2 Likes

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
francium.informatik.uni-ulm.de

I ran this command:
certbot certonly --webroot -w /var/www/certbot --preferred-challenges http-01 --email Haglo@uni-ulm.de -d francium.informatik.uni-ulm.de --agree-tos --force-renewal

It produced this output:
Plugins selected: Authenticator webroot, Installer None


Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let’s Encrypt project and the non-profit
organization that develops Certbot? We’d like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.


(Y)es/(N)o: N
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for francium.informatik.uni-ulm.de
Using the webroot path /var/www/certbot for all unmatched domains.
Waiting for verification…
Challenge failed for domain francium.informatik.uni-ulm.de
http-01 challenge for francium.informatik.uni-ulm.de
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: francium.informatik.uni-ulm.de
    Type: connection
    Detail: Fetching
    http://francium.informatik.uni-ulm.de/.well-known/acme-challenge/ikSOXi5SthECw-1ZFFZB4AeGCKPYX0iXY3K3svUJj3E:
    Connection refused

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you’re using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.

  • Your account credentials have been saved in your Certbot
    configuration directory at /etc/letsencrypt. You should make a
    secure backup of this folder now. This configuration directory will
    also contain certificates and private keys obtained by Certbot so
    making regular backups of this folder is ideal.

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

1 Like

I’ve added your topic to your older topic (created yesterday).

Yesterday it had worked.

Now ( https://check-your-website.server-daten.de/?q=francium.informatik.uni-ulm.de ):

Domainname Http-Status redirect Sec. G
http://francium.informatik.uni-ulm.de/
134.60.73.129 -2 1.080 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 134.60.73.129:80
https://francium.informatik.uni-ulm.de/
134.60.73.129 -2 1.097 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 134.60.73.129:443
http://francium.informatik.uni-ulm.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
134.60.73.129 -2 1.077 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 134.60.73.129:80
Visible Content:

your server is blocked.

Looks like a firewall.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.