Cloudflare blocking?

[mister75]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: instatech.network mail.instatech.network

I ran this command: certbot certonly --webroot -w /var/www/html/ -d instatech.network -d mail.instatech.network

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for instatech.network and mail.instatech.network

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: mail.instatech.network
Type: unauthorized
Detail: 2606:4700:3034::ac43:85ef: Invalid response from https://mail.instatech.network/.well-known/acme-challenge/NeeXoDQZiAJElrcjSY3P69-Zgi8N6eobP7xrTbI6ct0: 526

Domain: instatech.network
Type: unauthorized
Detail: 2606:4700:3032::6815:5e2: Invalid response from https://instatech.network/.well-known/acme-challenge/NsHrPUHZky3tnvOYgmMz88ysKyISAqeoJHFQ2iboM5Y: 526

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): nginx 1.18.0

The operating system my web server runs on is (include version): Ubuntu 22.04 LTS

My hosting provider, if applicable, is: IONOS

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

I'm using the built-in website management to manage my site

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.28.0

I have a feeling that the reason certbot cannot download the temp challenge file is because I'm going through Cloudflare DNS. I could be horribly wrong here as this is my first time using the app.

Thanks heaps.

[rg305]

Hi @mister75, and welcome to the LE community forum

Yes, your site is behind Cloudflare CDN, is it set to use full SSL strict?

Are the HTTP and HTTPS root/document root paths the same?
If not, you might want to try using --webroot authentication.

[Osiris]

You should first get your website working again in general before trying to get a certificate. You can do that by setting SSL to less than full/strict mode or use a Cloudflare Origin certificate. In that latter case you won't even require a Let's Encrypt certificate for Cloudflare using services. You might require one for other services though.

[linkp]

I have found Let's Debug very helpful when diagnosing this situation. In your case, unfortunately, all it does is indicate that your site is behind Cloudflare. If you didn't exempt the ACME challenge path from SSL redirection, you can run into issues.

I find it helpful to create a Page Rule for the following:

Allow ACME challenge
*example.com/.well-known/acme-challenge/*

Disable Security
SSL: Off
Cache Level: Bypass
Disable Performance

You also have your A record for your MX proxied. Cloudflare does not proxy any non HTTP protocols, which means POP/IMAP will definitely fail, and you may encounter SMTP difficulties as well. You can see from the synthetic MX record _dc-mx.3fa3f8e858f9.instatech.network that Cloudflare is trying provide you a workaround, but the consensus in the Cloudflare Community is to set any entries that require non-HTTP use to DNS Only.

When I am setting up the initial Let's Encrypt certificate for a host behind Cloudflare, I do that with the relevant hostsnames set to DNS Only, and only after after the Let's Encrypt certificate is working as expected on the origin site do I enable the Cloudflare proxy.