Clean instalation and ...nazwa.pl prevents issuance status:403

Hi!
I spent som time trying to get certificate (difrent apache virtualhosts configurations ) but without success.
finnaly i made clean instalation ubuntu 18 , just install Apache2 (all defaults and standard start page /var/www/html/index.html) and then started certboot procedure to gain certificate, but still without success
. What is wrong ?
My domain is: got-wyn.nazwa.pl

I ran this command:
root@got-wyn:~# sudo certbot --apache

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices) (Enter ‘c’ to
cancel): gotwyniki@wp.pl


Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory


(A)gree/©ancel: a


Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let’s Encrypt project and the non-profit
organization that develops Certbot? We’d like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.


(Y)es/(N)o: y
No names were found in your configuration files. Please enter in your domain
name(s) (comma and/or space separated) (Enter ‘c’ to cancel): got-wyn.nazwa.pl
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for got-wyn.nazwa.pl
Enabled Apache rewrite module
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. got-wyn.nazwa.pl (http-01): urn:ietf:params:acme :error:caa :: CAA record for got-wyn.nazwa.pl prevents issuance

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: got-wyn.nazwa.pl
    Type: None
    Detail: CAA record for got-wyn.nazwa.pl prevents issuance

  • Your account credentials have been saved in your Certbot
    configuration directory at /etc/letsencrypt. You should make a
    secure backup of this folder now. This configuration directory will
    also contain certificates and private keys obtained by Certbot so
    making regular backups of this folder is ideal.

My web server is (Apache/2.4.29 (Ubuntu)):

The operating system my web server runs on is (ubuntu 18:

My hosting provider, if applicable, is:
it is VPS on nazwa.pl

I can login to a root shell on my machine (yes ):

I’m using a control panel to manage my site (no):

The version of my client is (certbot 0.28.0):

I paste part of Log (new users can’t upload attachements and are limited text length):

HTTP 200
Server: nginx
Content-Type: application/json
Content-Length: 1433
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
Expires: Fri, 22 Feb 2019 16:45:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 22 Feb 2019 16:45:55 GMT
Connection: keep-alive

{
“identifier”: {
“type”: “dns”,
“value”: “got-wyn.nazwa.pl”
},
“status”: “invalid”,
“expires”: “2019-03-01T16:45:48Z”,
“challenges”: [
{
“type”: “tls-alpn-01”,
“status”: “invalid”,
“url”: “https://acme-v02.api.letsencrypt.org/acme/challenge/CvOVdtLwAM3C7Lj9o87ajZ6S1DjtyrP8SyU9dDYPiEg/12873917732”,
“token”: “_7LE2-64H2Y8K0cMNyE-cYtYu28KO2NwPWzhjbZHEQk”
},
{
“type”: “http-01”,
“status”: “invalid”,
“error”: {
“type”: “urn:ietf:params:acme:error:caa”,
“detail”: “CAA record for got-wyn.nazwa.pl prevents issuance”,
“status”: 403
},
“url”: “https://acme-v02.api.letsencrypt.org/acme/challenge/CvOVdtLwAM3C7Lj9o87ajZ6S1DjtyrP8SyU9dDYPiEg/12873917734”,
“token”: “ze1agA-6d0CzN2rpWHf4vBZKXPww1aAwQhSs1euHF1o”,
“validationRecord”: [
{
“url”: “http://got-wyn.nazwa.pl/.well-known/acme-challenge/ze1agA-6d0CzN2rpWHf4vBZKXPww1aAwQhSs1euHF1o”,
“hostname”: “got-wyn.nazwa.pl”,
“port”: “80”,
“addressesResolved”: [
“77.55.212.127”
],
“addressUsed”: “77.55.212.127”
}
]
},
{
“type”: “dns-01”,
“status”: “invalid”,
“url”: “https://acme-v02.api.letsencrypt.org/acme/challenge/CvOVdtLwAM3C7Lj9o87ajZ6S1DjtyrP8SyU9dDYPiEg/12873917736”,
“token”: “2gTiOc81UCmYyYAiOdUbGCyO4xGUF01vhuOOTWzrT8U”
}
]
}
2019-02-22 17:45:55,584:DEBUG:certbot.reporter:Reporting to user: The following errors were reported by the server:

Domain: got-wyn.nazwa.pl
Type: None
Detail: CAA record for got-wyn.nazwa.pl prevents issuance
2019-02-22 17:45:55,585:DEBUG:certbot.error_handler:Encountered exception:
Traceback (most recent call last):
File “/usr/lib/python3/dist-packages/certbot/auth_handler.py”, line 82, in handle_authorizations
self._respond(aauthzrs, resp, best_effort)
File “/usr/lib/python3/dist-packages/certbot/auth_handler.py”, line 161, in _respond
self._poll_challenges(aauthzrs, chall_update, best_effort)
File “/usr/lib/python3/dist-packages/certbot/auth_handler.py”, line 232, in _poll_challenges
raise errors.FailedChallenges(all_failed_achalls)
certbot.errors.FailedChallenges: Failed authorization procedure. got-wyn.nazwa.pl (http-01): urn:ietf:params:acme:error:caa :: CAA record for got-wyn.nazwa.pl prevents issuance

Hi @remian,

There is a CAA DNS record for nazwa.pl served by ns1.nazwa.pl that only allows certum.pl to issue certificates for nazwa.pl. By default, this also applies to subdomains.

You can either get the administrator of the nazwa.pl DNS to add an additional CAA record that allows letsencrypt.org to issue certificates, or add a CAA record that allows this for your specific subdomain.

try:
dig CAA got-wyn.nazwa.pl @1.1.1.1
dig CAA nazwa.pl @1.1.1.1
[there is no nslookup command to return CAA records]

which returns:
nazwa.pl. 120 IN CAA 0 issue "certum.pl"

1 Like

Newer versions of nslookup do also understand this RR type.

1 Like

You are correct; I should have been more clear.
There is no nslookup command (in WINDOWS) to return CAA records (yet).
Of course, there is also no DIG command found in WINDOWS [right out-of-the-box].
So, I logically assigned them respectively to their default O/S.

But, yes (you are correct), new versions of Linux can do both.
DIG:
dig CAA nazwa.pl @1.1.1.1
NSLOOKUP:
nslookup -q=CAA nazwa.pl 1.1.1.1

Thank You for fast answers!

I wrote to kontakt@nazwa.pl and they quickly add new rows to DNS configuration. New configuration allready propagated and now certbot menage to get cert for me. So now its all ok. Once more thank’s for help!

2 Likes

Hi @remian

yep, now your subdomain - specific CAA is visible:

CAA - Entries

Domainname flag Name Value ∑ Queries ∑ Timeout
got-wyn.nazwa.pl 5 issue letsencrypt.org 1 0
9 issuewild letsencrypt.org 1 0
nazwa.pl 5 issue certum.pl 1 0
pl 0 no CAA entry found 1 0

issue includes issuewild, so the issuewild isn't required. But now you can create normal certificates and wildcard-certificates via Letsencrypt.

PS: But your configuration is incomplete. You have a dns-entry www.got-wyn.nazwa.pl, but your certificate has only one domain name:

CN=got-wyn.nazwa.pl
	23.02.2019
	24.05.2019
expires in 90 days	got-wyn.nazwa.pl - 1 entry

So your www - version isn't secure.

  • Remove the dns entry of www... or (better)
  • create one certificate with both domain names and use that instead.

Some users add every time www, some users never add www, so it's the best to have one vHost with both domain names, that uses one certificate with both domain names.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.