Good morning, I have been using certbot for a long time, since the last renewal (without remembering having made any changes) I receive this error:
Fetching http://corosspp.ns0.it/.well-known/acme-challenge/9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI: Connection refused
my domains are:
wolverine.ns0.it
corosspp.ns0.it
ufficiosonoro.ns0.it
certbot version: 1.21.0
Operating system Ubuntu 22.04
web Server Apache 2.4.52-1ubuntu4.6
for debugging I used the command:
/usr/bin/certbot certanly --webroot --agree-tos --redirect --hsts --staple-ocsp -d corosspp.ns0.it -w /var/www/html -v --dry-run -- debug-challenges -v
when the script stopped for debugging I checked that the challenge was in the right directory and I also tried to reach it from the outside with a browser. I can't figure out what the problem is.
This is the execution log:
root@Wolverine:/var/www/html# sudo /usr/bin/certbot certonly --webroot --agree-tos --redirect --hsts --staple-ocsp -d corosspp.ns0.it -w /var/www/html -v --dry-run --debug-challenges -v
Root logging level set at 10
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requested authenticator webroot and installer None
Single candidate plugin: * webroot
Description: Place files in webroot directory
Interfaces: Authenticator, Plugin
Entry point: webroot = certbot._internal.plugins.webroot:Authenticator
Initialized: <certbot._internal.plugins.webroot.Authenticator object at 0x7f5f23732920>
Prep: True
Selected authenticator <certbot._internal.plugins.webroot.Authenticator object at 0x7f5f23732920> and installer None
Plugins selected: Authenticator webroot, Installer None
Picked account: <Account(RegistrationResource(body=Registration(key=None, contact=(), agreement=None, status=None, terms_of_service_agreed=None, only_return_existing=None, external_account_binding=None), uri='https://acme-staging-v02.api.letsencrypt.org/acme/acct/124630394', new_authzr_uri=None, terms_of_service=None), 3fd0afe9e1966c559db5607307f4e177, Meta(creation_dt=datetime.datetime(2023, 11, 7, 16, 53, 32, tzinfo=<UTC>), creation_host='net-2-34-41-241.cust.vodafonedsl.it', register_to_eff=None))>
Sending GET request to https://acme-staging-v02.api.letsencrypt.org/directory.
Starting new HTTPS connection (1): acme-staging-v02.api.letsencrypt.org:443
https://acme-staging-v02.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 826
Received response:
HTTP 200
Server: nginx
Date: Wed, 08 Nov 2023 17:05:02 GMT
Content-Type: application/json
Content-Length: 826
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
"VyHbqbTbuY4": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
"keyChange": "https://acme-staging-v02.api.letsencrypt.org/acme/key-change",
"meta": {
"caaIdentities": [
"letsencrypt.org"
],
"termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf",
"website": "https://letsencrypt.org/docs/staging-environment/"
},
"newAccount": "https://acme-staging-v02.api.letsencrypt.org/acme/new-acct",
"newNonce": "https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce",
"newOrder": "https://acme-staging-v02.api.letsencrypt.org/acme/new-order",
"renewalInfo": "https://acme-staging-v02.api.letsencrypt.org/draft-ietf-acme-ari-01/renewalInfo/",
"revokeCert": "https://acme-staging-v02.api.letsencrypt.org/acme/revoke-cert"
}
Notifying user: Simulating a certificate request for corosspp.ns0.it
Simulating a certificate request for corosspp.ns0.it
Requesting fresh nonce
Sending HEAD request to https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce.
https://acme-staging-v02.api.letsencrypt.org:443 "HEAD /acme/new-nonce HTTP/1.1" 200 0
Received response:
HTTP 200
Server: nginx
Date: Wed, 08 Nov 2023 17:05:02 GMT
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-staging-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: pj0iHUyqlPD83fuSXfkJuFTLHjl_B-6Ev73bwV19MCg8GF7Fs7w
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
Storing nonce: pj0iHUyqlPD83fuSXfkJuFTLHjl_B-6Ev73bwV19MCg8GF7Fs7w
JWS payload:
b'{\n "identifiers": [\n {\n "type": "dns",\n "value": "corosspp.ns0.it"\n }\n ]\n}'
Sending POST request to https://acme-staging-v02.api.letsencrypt.org/acme/new-order:
{
"protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS1zdGFnaW5nLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYWNjdC8xMjQ2MzAzOTQiLCAibm9uY2UiOiAicGowaUhVeXFsUEQ4M2Z1U1hma0p1RlRMSGpsX0ItNkV2NzNid1YxOU1DZzhHRjdGczd3IiwgInVybCI6ICJodHRwczovL2FjbWUtc3RhZ2luZy12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL25ldy1vcmRlciJ9",
"signature": "oN8xF62NvYtT-v1uCVvWfmPHbkJq1nBBuGCweVpxdYK-YoT7muqptt5yFWyZGxCRPDkM0jJriGoW-XuKbBWjHTNInHTrH45DEmZiLUfiajIcirTipgBHeJR-So-26XlPs9PUlLhHUqBssZuTPset8pPrjgxbx8KQtWlikjCwgOgAntzwbe9ZOOTfQO7ONtRViZ_eS27TDjfvw05LU0WpHVJhz0RL-Q02uSqBmJbEWORfTkvrzeVKQys4F1ZMl1s5v-SgpZXhh4sqWlhYAYhPzUw2cwCgBjwaDkioodmgMd39u4tf3o6LDs8fejTWst5BobpGf2yPZ9EUe8ecquF6Ig",
"payload": "ewogICJpZGVudGlmaWVycyI6IFsKICAgIHsKICAgICAgInR5cGUiOiAiZG5zIiwKICAgICAgInZhbHVlIjogImNvcm9zc3BwLm5zMC5pdCIKICAgIH0KICBdCn0"
}
https://acme-staging-v02.api.letsencrypt.org:443 "POST /acme/new-order HTTP/1.1" 201 353
Received response:
HTTP 201
Server: nginx
Date: Wed, 08 Nov 2023 17:05:02 GMT
Content-Type: application/json
Content-Length: 353
Connection: keep-alive
Boulder-Requester: 124630394
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-staging-v02.api.letsencrypt.org/directory>;rel="index"
Location: https://acme-staging-v02.api.letsencrypt.org/acme/order/124630394/12127299454
Replay-Nonce: lM2tIvPpUfNqc7BYM09AyC-dN66YbaTNKozYcRse-KXwdAdTad0
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
"status": "pending",
"expires": "2023-11-15T17:05:02Z",
"identifiers": [
{
"type": "dns",
"value": "corosspp.ns0.it"
}
],
"authorizations": [
"https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/9347179834"
],
"finalize": "https://acme-staging-v02.api.letsencrypt.org/acme/finalize/124630394/12127299454"
}
Storing nonce: lM2tIvPpUfNqc7BYM09AyC-dN66YbaTNKozYcRse-KXwdAdTad0
JWS payload:
b''
Sending POST request to https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/9347179834:
{
"protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS1zdGFnaW5nLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYWNjdC8xMjQ2MzAzOTQiLCAibm9uY2UiOiAibE0ydEl2UHBVZk5xYzdCWU0wOUF5Qy1kTjY2WWJhVE5Lb3pZY1JzZS1LWHdkQWRUYWQwIiwgInVybCI6ICJodHRwczovL2FjbWUtc3RhZ2luZy12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2F1dGh6LXYzLzkzNDcxNzk4MzQifQ",
"signature": "At-0cpqjXh9R-6jKYN0vxfgAkka_FFiDXHot8Py66UF5d4kkFEnrV6Wx8cvG8HFK8TQebxY38N2Zqux8vbpCBnKU4Ynce6QB8t9lKoLFUYQETnnUT9MYkTeHBSwhH7GBYB7iHd2QGgpjK7eesH-4PytCNeOzElZW7wkuDhBneY8ZdS5H8mkjaKfswbonw2Iw2QXzkaYuZWOX_nVCz8YPOIRZZAvaNPB8jMqRZt8fsie3uI-cYwovcdTq9-zjvc_gsQha2QigPdxP3PDj0tUaUGssopeEvKfUDFY4VtRIellVgvigMGMBuRTmoSU88ETf9mFcxrh9-6cnaTjuj2011g",
"payload": ""
}
https://acme-staging-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/9347179834 HTTP/1.1" 200 817
Received response:
HTTP 200
Server: nginx
Date: Wed, 08 Nov 2023 17:05:02 GMT
Content-Type: application/json
Content-Length: 817
Connection: keep-alive
Boulder-Requester: 124630394
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-staging-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: lM2tIvPpzSkz_ZHu-mKzyRnYO1S_ivuwZvpfB2C1g5eKdKfRYFo
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
"identifier": {
"type": "dns",
"value": "corosspp.ns0.it"
},
"status": "pending",
"expires": "2023-11-15T17:05:02Z",
"challenges": [
{
"type": "http-01",
"status": "pending",
"url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/9347179834/aVc4sQ",
"token": "9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI"
},
{
"type": "dns-01",
"status": "pending",
"url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/9347179834/kF2LDA",
"token": "9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI"
},
{
"type": "tls-alpn-01",
"status": "pending",
"url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/9347179834/hEbn9w",
"token": "9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI"
}
]
}
Storing nonce: lM2tIvPpzSkz_ZHu-mKzyRnYO1S_ivuwZvpfB2C1g5eKdKfRYFo
Performing the following challenges:
http-01 challenge for corosspp.ns0.it
Using the webroot path /var/www/html for all unmatched domains.
Creating root challenges validation dir at /var/www/html/.well-known/acme-challenge
Attempting to save validation to /var/www/html/.well-known/acme-challenge/9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI
Notifying user: Challenges loaded. Press continue to submit to CA. Pass "-v" for more info about
challenges.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Challenges loaded. Press continue to submit to CA. Pass "-v" for more info about
challenges.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
JWS payload:
b'{}'
Sending POST request to https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/9347179834/aVc4sQ:
{
"protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS1zdGFnaW5nLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYWNjdC8xMjQ2MzAzOTQiLCAibm9uY2UiOiAibE0ydEl2UHB6U2t6X1pIdS1tS3p5Um5ZTzFTX2l2dXdadnBmQjJDMWc1ZUtkS2ZSWUZvIiwgInVybCI6ICJodHRwczovL2FjbWUtc3RhZ2luZy12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2NoYWxsLXYzLzkzNDcxNzk4MzQvYVZjNHNRIn0",
"signature": "DVVCHgtQcFxX8m6tFEgZsg8eT7oeI4BCX-swLzydbwnGJ7dNLnb3SMWaJcX-sRI2PDeSh0gAunsscVOrE6cGiWl2EdQPdESMPUnGWIQYjyK853PLbFkm-_8eLaYZA5owBdKu0XHMVZYzKBfcOQIR6rQGH3BYHzDgBcnvGxneyy-G3tLmPPwe-I9oJ2n8re_A4qJ69UMYmtPQh2k76NJc0QLs1ghH-0fP_XliidzC1JAo8nA_wJbgYyuONnFAsSqiKR8ubdCqom0aX0OhOZ46uOK5iA0jaDRocC65lV81Y-aVXpjackZNwhkMH5C19Q0BwTFbKlm_BFo0H33mOwxTKw",
"payload": "e30"
}
https://acme-staging-v02.api.letsencrypt.org:443 "POST /acme/chall-v3/9347179834/aVc4sQ HTTP/1.1" 200 193
Received response:
HTTP 200
Server: nginx
Date: Wed, 08 Nov 2023 17:05:04 GMT
Content-Type: application/json
Content-Length: 193
Connection: keep-alive
Boulder-Requester: 124630394
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-staging-v02.api.letsencrypt.org/directory>;rel="index", <https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/9347179834>;rel="up"
Location: https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/9347179834/aVc4sQ
Replay-Nonce: lM2tIvPpTErbIkm7svxuO9c8DBS_AbnTdXXpFLIZ_HVb6wcL4ZI
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
"type": "http-01",
"status": "pending",
"url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/9347179834/aVc4sQ",
"token": "9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI"
}
Storing nonce: lM2tIvPpTErbIkm7svxuO9c8DBS_AbnTdXXpFLIZ_HVb6wcL4ZI
Waiting for verification...
JWS payload:
b''
Sending POST request to https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/9347179834:
{
"protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS1zdGFnaW5nLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYWNjdC8xMjQ2MzAzOTQiLCAibm9uY2UiOiAibE0ydEl2UHBURXJiSWttN3N2eHVPOWM4REJTX0FiblRkWFhwRkxJWl9IVmI2d2NMNFpJIiwgInVybCI6ICJodHRwczovL2FjbWUtc3RhZ2luZy12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2F1dGh6LXYzLzkzNDcxNzk4MzQifQ",
"signature": "iCvA3NOFbY_1PK7AuKUz_qsOCL-x4S76cB67n1F2SE0UdoFfNR_lLTYNdMD0HeG-bx0OEH89gLWhVhWCTxz0pNUc6QXlBlaEiFdJM8M_slIQ77de8WYC2SBIHdST7_NiY81zhRAGzWXiKRX0Hch6kJp4LQ9p6R_F-3m_gl8TcwIugolf6JIfBSRKAVPgVriucb5ueYLZfoY2F55h7JvggQupHoHj8dN3E-tvMYNlkAAeQir_9TgcpHOdckh59Kr6w7P6-M65W7MibZubGXinjSqOlHwztMHkv6h7Ndu6IXn_nrRhTR7MY-cXe3LEaNbnl1i7KG-shqXu2enhJoaHHA",
"payload": ""
}
https://acme-staging-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/9347179834 HTTP/1.1" 200 1028
Received response:
HTTP 200
Server: nginx
Date: Wed, 08 Nov 2023 17:05:05 GMT
Content-Type: application/json
Content-Length: 1028
Connection: keep-alive
Boulder-Requester: 124630394
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-staging-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: pj0iHUyqbedvZLRAmUAW74USmOJTXnTyyexzN7CEsdgZXT073Lc
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
"identifier": {
"type": "dns",
"value": "corosspp.ns0.it"
},
"status": "invalid",
"expires": "2023-11-15T17:05:02Z",
"challenges": [
{
"type": "http-01",
"status": "invalid",
"error": {
"type": "urn:ietf:params:acme:error:connection",
"detail": "2.34.41.241: Fetching http://corosspp.ns0.it/.well-known/acme-challenge/9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI: Connection refused",
"status": 400
},
"url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/9347179834/aVc4sQ",
"token": "9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI",
"validationRecord": [
{
"url": "http://corosspp.ns0.it/.well-known/acme-challenge/9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI",
"hostname": "corosspp.ns0.it",
"port": "80",
"addressesResolved": [
"2.34.41.241"
],
"addressUsed": "2.34.41.241"
}
],
"validated": "2023-11-08T17:05:04Z"
}
]
}
Storing nonce: pj0iHUyqbedvZLRAmUAW74USmOJTXnTyyexzN7CEsdgZXT073Lc
Challenge failed for domain corosspp.ns0.it
http-01 challenge for corosspp.ns0.it
Notifying user:
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: corosspp.ns0.it
Type: connection
Detail: 2.34.41.241: Fetching http://corosspp.ns0.it/.well-known/acme-challenge/9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI: Connection refused
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: corosspp.ns0.it
Type: connection
Detail: 2.34.41.241: Fetching http://corosspp.ns0.it/.well-known/acme-challenge/9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI: Connection refused
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
Encountered exception:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 90, in handle_authorizations
self._poll_authorizations(authzrs, max_retries, best_effort)
File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 178, in _poll_authorizations
raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.
Calling registered functions
Cleaning up challenges
Removing /var/www/html/.well-known/acme-challenge/9vuC-1uadahs_aBG0q5zJv0o9STU3HwrIi65G2wlkQI
All challenges cleaned up
Exiting abnormally:
Traceback (most recent call last):
File "/usr/bin/certbot", line 33, in <module>
sys.exit(load_entry_point('certbot==1.21.0', 'console_scripts', 'certbot')())
File "/usr/lib/python3/dist-packages/certbot/main.py", line 15, in main
return internal_main.main(cli_args)
File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1574, in main
return config.func(config, plugins)
File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1434, in certonly
lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 133, in _get_and_save_cert
lineage = le_client.obtain_and_enroll_certificate(domains, certname)
File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 459, in obtain_and_enroll_certificate
cert, chain, key, _ = self.obtain_certificate(domains)
File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 389, in obtain_certificate
orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 439, in _get_order_and_authorizations
authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 90, in handle_authorizations
self._poll_authorizations(authzrs, max_retries, best_effort)
File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 178, in _poll_authorizations
raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
Thanks in advance
Marco