Connection refused

Aku · January 27, 2019, 3:36pm

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:melochenator.com

I ran this command: sudo certbot-auto certonly -a webroot --webroot-path=/var/www/melochenator.com/www/html/ -d melochenator.com -d www.melochenator.com

It produced this output:

My web server is (include version):nginx

The operating system my web server runs on is (include version):Ubuntu 14.04.5 LTS \n \

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):certbot 0.28.0

============================================
certbot-auto certonly -a webroot --webroot-path=/var/www/melochenator.com/www/html/ -d melochenator.com -d www.melochenator.com
Requesting to rerun /usr/local/sbin/certbot-auto with root privileges…
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn’t close to expiry.
(ref: /etc/letsencrypt/renewal/melochenator.com.conf)

What would you like to do?

1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)

Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 2
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for melochenator.com
http-01 challenge for www.melochenator.com
Using the webroot path /var/www/melochenator.com/www/html for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. melochenator.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://melochenator.com/.well-known/acme-challenge/UGy2DC3yZRvkYHx6NZpahpYrvPVhzybQAM3fro0NJsg: Connection refused, www.melochenator.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://www.melochenator.com/.well-known/acme-challenge/H6ap8hQ5NUR-LogV-AyIxjOyTQ4h4nE0UBBS58yZh14: Connection refused

IMPORTANT NOTES:

The following errors were reported by the server:

Domain: melochenator.com
Type: connection
Detail: Fetching
http://melochenator.com/.well-known/acme-challenge/UGy2DC3yZRvkYHx6NZpahpYrvPVhzybQAM3fro0NJsg:
Connection refused

Domain: www.melochenator.com
Type: connection
Detail: Fetching
http://www.melochenator.com/.well-known/acme-challenge/H6ap8hQ5NUR-LogV-AyIxjOyTQ4h4nE0UBBS58yZh14:
Connection refused

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you’re using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.

Osiris · January 27, 2019, 3:37pm

Is nginx even running? I’m getting a connection refused too. If it is running, does it also run HTTP on port 80?

Aku · January 27, 2019, 3:58pm

root@melochenator:~# Active Internet connections Proto Recv-Q Send-Q Local Address tcp 0 0 0.0.0.0:22 tcp 0 0 0.0.0.0:25 tcp 0 0 127.0.0.1:6010 tcp 0 0 0.0.0.0:443 tcp 0 0 127.0.0.1:6011 tcp 0 0 0.0.0.0:6556 tcp 0 0 0.0.0.0:5666 tcp 0 0 127.0.0.1:9000 tcp 0 0 0.0.0.0:3306 tcp 0 0 0.0.0.0:111 tcp6 0 0 :::38899 tcp6 0 0 :::22 tcp6 0 0 :::25 tcp6 0 0 ::1:6010 tcp6 0 0 ::1:6011 tcp6 0 0 :::5666 tcp6 0 0 :::37799 tcp6 0 0 :::111 tcp6 0 0 :::80 netstat -nltp nginx
(only servers)
Foreign Address State PID/Program name
0.0.0.0:* LISTEN 1073/sshd
0.0.0.0:* LISTEN 1678/master
0.0.0.0:* LISTEN 24574/0
0.0.0.0:* LISTEN 25540/nginx -g daem
0.0.0.0:* LISTEN 24984/2
0.0.0.0:* LISTEN 1064/xinetd
0.0.0.0:* LISTEN 1472/nrpe
0.0.0.0:* LISTEN 15201/php-fpm.conf)
0.0.0.0:* LISTEN 24664/mysqld
0.0.0.0:* LISTEN 634/rpcbind
:::* LISTEN 11408/java
:::* LISTEN 1073/sshd
:::* LISTEN 1678/master
:::* LISTEN 24574/0
:::* LISTEN 24984/2
:::* LISTEN 1472/nrpe
:::* LISTEN 11142/java
:::* LISTEN 634/rpcbind
:::* LISTEN 25540/nginx -g daem

Aku · January 27, 2019, 3:58pm

it is showing on port 80 and 443

JuergenAuer · January 27, 2019, 4:01pm

Hi @Aku

is there a firewall or something else? Port 80 is active blocked ( https://check-your-website.server-daten.de/?q=melochenator.com ):

Domainname	Http-Status	redirect	Sec.	G
• http://melochenator.com/
52.3.37.37	-2		1.323	V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:80

• http://www.melochenator.com/
52.3.37.37	-2		1.307	V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:80

• https://melochenator.com/
52.3.37.37	302	Melochenator	2.304	N
Certificate error: RemoteCertificateNameMismatch

• https://www.melochenator.com/
52.3.37.37	302	Melochenator	2.073	B

• Melochenator	200		1.980	N
Certificate error: RemoteCertificateNameMismatch

• Melochenator	200		1.973	B

• http://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37	-2		1.307	V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:80

• http://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37	-2		1.307	V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:80

You need an open port 80. There may be a redirect http -> https, Letsencrypt follows such redirects. But the first GET requires port 80 + http.

Aku · January 27, 2019, 4:21pm

any other way i can run certbot command on prot 443

JuergenAuer · January 27, 2019, 4:38pm

You can use tls-alpn-01, but Certbot doesn't support it. Acme.sh support this validation.

Why isn't it possible to open port 80 and add a 301 redirect http -> https?

A closed port 80 has nothing to do with a "more secure system".

Aku · January 27, 2019, 6:04pm

i have fixed the issue now i am getting this messsage

ubuntu@melochenator:~$ sudo certbot-auto certonly -a webroot --webroot-path=/var/www/melochenator.com/www/html/ -d melochenator.com -d www.melochenator.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn’t close to expiry.
(ref: /etc/letsencrypt/renewal/melochenator.com.conf)

What would you like to do?

1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)

Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 2
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for melochenator.com
http-01 challenge for www.melochenator.com
Using the webroot path /var/www/melochenator.com/www/html for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. www.melochenator.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.melochenator.com/.well-known/acme-challenge/l_rjx6Zy-DES4C48o57HWbkN73QN_1a-Of37lx-CtbM: “\r\n400 The plain HTTP request was sent to HTTPS port\r\n<body bgcolor=“white”>\r\n

400 B”

IMPORTANT NOTES:

The following errors were reported by the server:

Domain: www.melochenator.com
Type: unauthorized
Detail: Invalid response from
http://www.melochenator.com/.well-known/acme-challenge/l_rjx6Zy-DES4C48o57HWbkN73QN_1a-Of37lx-CtbM:
“\r\n400 The plain HTTP request was sent to
HTTPS port\r\n<body
bgcolor=“white”>\r\n

400 B”

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

JuergenAuer · January 27, 2019, 6:20pm

Now your http is broken, Bad Request ( melochenator.com - Make your website better - DNS, redirects, mixed content, certificates ):

Domainname	Http-Status	redirect	Sec.	G
• http://melochenator.com/
52.3.37.37	400		0.213	M
Bad Request

• http://www.melochenator.com/
52.3.37.37	400		0.213	M
Bad Request

• https://melochenator.com/
52.3.37.37	302	Melochenator	2.320	B

• https://www.melochenator.com/
52.3.37.37	302	Melochenator	2.123	N
Certificate error: RemoteCertificateNameMismatch

• Melochenator	200		2.110	B

• Melochenator	200		2.126	N
Certificate error: RemoteCertificateNameMismatch

• https://melochenator.com:80/
52.3.37.37	302	Melochenator	2.296	Q

• https://www.melochenator.com:80/
52.3.37.37	302	Melochenator	2.117	Q

• http://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37	400		0.217	M
Bad Request

• http://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37	400		0.217	M
Bad Request

Looks like you send port 80 to the https-port, so this wrong combination

https://www.melochenator.com:80/

has a http status 302.

Letsencrypt requires a working http port, not a Bad Request - status 400.

Aku · January 27, 2019, 7:43pm

can you please check i am on new method. i mean please check running new certbot-auto not on old one tls-sni-01

website name melochenator.com

JuergenAuer · January 27, 2019, 7:52pm

Now you have another error:

Domainname	Http-Status	redirect	Sec.	G
• http://melochenator.com/
52.3.37.37	302	https://melochenator.com/	0.210	A

• http://www.melochenator.com/
52.3.37.37	302	https://www.melochenator.com/	0.216	A

• https://melochenator.com/
52.3.37.37	-2		1.310	V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:443

• https://www.melochenator.com/
52.3.37.37	-2		1.313	V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:443

• http://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37	302	https://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de	0.217	A

• http://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37	302	https://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de	0.214	A

• https://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de	-2		1.310	V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:443

• https://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de	-2		1.317	V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:443

Your http works and has correct redirects to https (which is good!).

But your https is blocked, looks like a firewall.

PS: My tool is public visible, so you can check your website and compare the result with other sites.

The last checks (https + /.well-known/acme-challenge - subdirectory) should produce a http status 404 and a Grade A.

Aku · January 27, 2019, 8:09pm

i fixed just please verify i am with new cert and not using TLS-SNI-01?

JuergenAuer · January 27, 2019, 8:17pm

I can't see that. Check your log, there you should find the authentication method:

/var/log/letsencrypt/letsencrypt.log

Aku · January 27, 2019, 8:28pm

2019-01-27 14:24:18,497:DEBUG:certbot.storage:Writing new private key to /etc/letsencrypt/archive/melochenator.com/privkey12.pem.
2019-01-27 14:24:18,497:DEBUG:certbot.storage:Writing certificate to /etc/letsencrypt/archive/melochenator.com/cert12.pem.
2019-01-27 14:24:18,498:DEBUG:certbot.storage:Writing chain to /etc/letsencrypt/archive/melochenator.com/chain12.pem.
2019-01-27 14:24:18,498:DEBUG:certbot.storage:Writing full chain to /etc/letsencrypt/archive/melochenator.com/fullchain12.pem.
2019-01-27 14:24:18,626:DEBUG:certbot.plugins.selection:Requested authenticator webroot and installer <certbot.cli._Default object at 0x7fdc9e7d7190>
2019-01-27 14:24:18,774:DEBUG:certbot.cli:Var webroot_path=/var/www/melochenator.com/www/html/ (set by user).
2019-01-27 14:24:18,774:DEBUG:certbot.cli:Var webroot_map=set([‘webroot_path’]) (set by user).
2019-01-27 14:24:19,924:DEBUG:certbot.cli:Var webroot_path=/var/www/melochenator.com/www/html/ (set by user).
2019-01-27 14:24:20,780:DEBUG:certbot.cli:Var authenticator=webroot (set by user).
2019-01-27 14:24:22,022:DEBUG:certbot.storage:Writing new config /etc/letsencrypt/renewal/melochenator.com.conf.new.
2019-01-27 14:24:22,024:DEBUG:certbot.reporter:Reporting to user: Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/melochenator.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/melochenator.com/privkey.pem
Your cert will expire on 2019-04-27. To obtain a new or tweaked version of this certificate in the future, simply run certbot-auto again. To non-interactively renew all of your certificates, run “certbot-auto renew”
2019-01-27 14:24:22,024:DEBUG:certbot.reporter:Reporting to user: If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

Aku · January 27, 2019, 8:28pm

what is the thing tell me i am using the right method? sent you the log

JuergenAuer · January 27, 2019, 8:31pm

This is good.

You are using webroot as authenticator, so you don't use tls-sni-01 - validation.

Aku · January 27, 2019, 8:33pm

Thank you so much. i know i am idiot

system · February 26, 2019, 8:33pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Error connection refused Help	9	2574	September 4, 2021
Isuess with create certbots Help	4	340	May 22, 2023
Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems: Help	7	13096	December 16, 2021
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet Help	7	2586	October 21, 2022
Attempt two, use certbot to install certificates Help	3	753	March 12, 2020

Connection refused

400 B”

400 B”

Related topics