Connection always fails CentOS 7

I’m trying to obtain Certs for my email Server. I’ve opened the firewall on port 443/80 and also set the port-forwarding to my email-server in the router.
Still any attempt to get certificates fail:

certbot certonly --rsa-key-size 4096 -d -d -d


root@mail: /etc/letsencrypt/live/ > nslookup

Non-authoritative answer:

I’m running NO webserver on this machine nor do I want to.

I’d suggest installing a webserver anyway, at least temporarily, just to make it easier to debug any firewall/routing issues. Once you’ve positively confirmed that you can reach the webserver from outside your network, you can uninstall it and run certbot certonly --standalone again.

Hi, yes it seems that having installed a web-server with minimal configuration is absolutely mandatory
So do I need to keep port 443/80 open in my firewall for any cert-renewal ?

And another thing is: all the files were placed in: /etc/letsencrypt/live/ instead of /etc/letsencrypt/live/ … why ?

Not really, although it can be very useful for debugging firewall/routing issues. Once you're sure that the webserver is externally reachable, you can remove it, and certbot itself can listen on port 80 in standalone mode. If you want.

Port 80, yes. If you like you can use --pre-hook / --post-hook scripts to temporarily open the port before renewal and close it again afterwards. You don't need to open port 443 at all if you're not running a webserver.

Usually this happens because you requested two certs with different sets of domain names. The directory is named after the first domain, and if both certs share the same first domain then the second directory gets a suffix added. Type certbot certificates to see an overview of what's where.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.