Connection always fails CentOS 7

[hydra44]

I’m trying to obtain Certs for my email Server. I’ve opened the firewall on port 443/80 and also set the port-forwarding to my email-server in the router.
Still any attempt to get certificates fail:

certbot certonly --rsa-key-size 4096 -d mail.gabel.net -d imap.gabel.net -d smtp.gabel.net
…

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: mail.gabel.net
  Type: connection
  Detail: Fetching
  http://mail.gabel.net/.well-known/acme-challenge/BaDnBjedXQ1Epc4PUSSVawEGJDUgs29GOc8v7510hvY:
  Connection refused

  Domain: imap.gabel.net
  Type: connection
  Detail: Fetching
  http://imap.gabel.net/.well-known/acme-challenge/npQwH2hdSCQndoB9eYG0Peel94WlbHJU022RZxvMMOE:
  Connection refused

  Domain: smtp.gabel.net
  Type: connection
  Detail: Fetching
  http://smtp.gabel.net/.well-known/acme-challenge/0KIviE9pepOobl-v0CfsMxyW71gKNImdxcTMNQM1iC4:
  Connection refused

  To fix these errors, please make sure that your domain name was
  entered correctly and the DNS A/AAAA record(s) for that domain
  contain(s) the right IP address. Additionally, please check that
  your computer has a publicly routable IP address and that no
  firewalls are preventing the server from communicating with the
  client. If you’re using the webroot plugin, you should also verify
  that you are serving files from the webroot path you provided.

root@mail: /etc/letsencrypt/live/mail.gabel.net > nslookup mail.gabel.net
Server: 192.168.0.1
Address: 192.168.0.1#53

Non-authoritative answer:
Name: mail.gabel.net
Address: 89.1.173.61

I’m running NO webserver on this machine nor do I want to.

[jmorahan]

I’d suggest installing a webserver anyway, at least temporarily, just to make it easier to debug any firewall/routing issues. Once you’ve positively confirmed that you can reach the webserver from outside your network, you can uninstall it and run certbot certonly --standalone again.

[hydra44]

Hi, yes it seems that having installed a web-server with minimal configuration is absolutely mandatory
So do I need to keep port 443/80 open in my firewall for any cert-renewal ?

And another thing is: all the files were placed in: /etc/letsencrypt/live/mail.gabel.net-0001 instead of /etc/letsencrypt/live/mail.gabel.net … why ?

[jmorahan]

@hydra44

Hi, yes it seems that having installed a web-server with minimal configuration is absolutely mandatory

Not really, although it can be very useful for debugging firewall/routing issues. Once you're sure that the webserver is externally reachable, you can remove it, and certbot itself can listen on port 80 in standalone mode. If you want.

@hydra44

So do I need to keep port 443/80 open in my firewall for any cert-renewal ?

Port 80, yes. If you like you can use --pre-hook / --post-hook scripts to temporarily open the port before renewal and close it again afterwards. You don't need to open port 443 at all if you're not running a webserver.

@hydra44

And another thing is: all the files were placed in: /etc/letsencrypt/live/mail.gabel.net-0001 instead of /etc/letsencrypt/live/mail.gabel.net … why ?

Usually this happens because you requested two certs with different sets of domain names. The directory is named after the first domain, and if both certs share the same first domain then the second directory gets a suffix added. Type certbot certificates to see an overview of what's where.