Connection refused


#1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:melochenator.com

I ran this command: sudo certbot-auto certonly -a webroot --webroot-path=/var/www/melochenator.com/www/html/ -d melochenator.com -d www.melochenator.com

It produced this output:

My web server is (include version):nginx

The operating system my web server runs on is (include version):Ubuntu 14.04.5 LTS \n \

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):certbot 0.28.0

============================================
certbot-auto certonly -a webroot --webroot-path=/var/www/melochenator.com/www/html/ -d melochenator.com -d www.melochenator.com
Requesting to rerun /usr/local/sbin/certbot-auto with root privileges…
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn’t close to expiry.
(ref: /etc/letsencrypt/renewal/melochenator.com.conf)

What would you like to do?


1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)


Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 2
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for melochenator.com
http-01 challenge for www.melochenator.com
Using the webroot path /var/www/melochenator.com/www/html for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. melochenator.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://melochenator.com/.well-known/acme-challenge/UGy2DC3yZRvkYHx6NZpahpYrvPVhzybQAM3fro0NJsg: Connection refused, www.melochenator.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://www.melochenator.com/.well-known/acme-challenge/H6ap8hQ5NUR-LogV-AyIxjOyTQ4h4nE0UBBS58yZh14: Connection refused

IMPORTANT NOTES:


#2

Is nginx even running? I’m getting a connection refused too. If it is running, does it also run HTTP on port 80?


#3

root@melochenator:~# netstat -nltp nginx
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1073/sshd
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 1678/master
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 24574/0
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 25540/nginx -g daem
tcp 0 0 127.0.0.1:6011 0.0.0.0:* LISTEN 24984/2
tcp 0 0 0.0.0.0:6556 0.0.0.0:* LISTEN 1064/xinetd
tcp 0 0 0.0.0.0:5666 0.0.0.0:* LISTEN 1472/nrpe
tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN 15201/php-fpm.conf)
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 24664/mysqld
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 634/rpcbind
tcp6 0 0 :::38899 :::* LISTEN 11408/java
tcp6 0 0 :::22 :::* LISTEN 1073/sshd
tcp6 0 0 :::25 :::* LISTEN 1678/master
tcp6 0 0 ::1:6010 :::* LISTEN 24574/0
tcp6 0 0 ::1:6011 :::* LISTEN 24984/2
tcp6 0 0 :::5666 :::* LISTEN 1472/nrpe
tcp6 0 0 :::37799 :::* LISTEN 11142/java
tcp6 0 0 :::111 :::* LISTEN 634/rpcbind
tcp6 0 0 :::80 :::* LISTEN 25540/nginx -g daem


#4

it is showing on port 80 and 443


#5

Hi @Aku

is there a firewall or something else? Port 80 is active blocked ( https://check-your-website.server-daten.de/?q=melochenator.com ):

Domainname Http-Status redirect Sec. G
http://melochenator.com/
52.3.37.37 -2 1.323 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:80
http://www.melochenator.com/
52.3.37.37 -2 1.307 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:80
https://melochenator.com/
52.3.37.37 302 https://melochenator.com/login 2.304 N
Certificate error: RemoteCertificateNameMismatch
https://www.melochenator.com/
52.3.37.37 302 https://www.melochenator.com/login 2.073 B
https://melochenator.com/login 200 1.980 N
Certificate error: RemoteCertificateNameMismatch
https://www.melochenator.com/login 200 1.973 B
http://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37 -2 1.307 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:80
http://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37 -2 1.307 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:80

You need an open port 80. There may be a redirect http -> https, Letsencrypt follows such redirects. But the first GET requires port 80 + http.


#6

any other way i can run certbot command on prot 443


#7

You can use tls-alpn-01, but Certbot doesn’t support it. Acme.sh support this validation.

Why isn’t it possible to open port 80 and add a 301 redirect http -> https?

A closed port 80 has nothing to do with a “more secure system”.


#8

i have fixed the issue now i am getting this messsage

ubuntu@melochenator:~$ sudo certbot-auto certonly -a webroot --webroot-path=/var/www/melochenator.com/www/html/ -d melochenator.com -d www.melochenator.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn’t close to expiry.
(ref: /etc/letsencrypt/renewal/melochenator.com.conf)

What would you like to do?


1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)


Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 2
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for melochenator.com
http-01 challenge for www.melochenator.com
Using the webroot path /var/www/melochenator.com/www/html for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. www.melochenator.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.melochenator.com/.well-known/acme-challenge/l_rjx6Zy-DES4C48o57HWbkN73QN_1a-Of37lx-CtbM: “\r\n400 The plain HTTP request was sent to HTTPS port\r\n<body bgcolor=“white”>\r\n

400 B”

IMPORTANT NOTES:


#9

Now your http is broken, Bad Request ( https://check-your-website.server-daten.de/?q=melochenator.com ):

Domainname Http-Status redirect Sec. G
http://melochenator.com/
52.3.37.37 400 0.213 M
Bad Request
http://www.melochenator.com/
52.3.37.37 400 0.213 M
Bad Request
https://melochenator.com/
52.3.37.37 302 https://melochenator.com/login 2.320 B
https://www.melochenator.com/
52.3.37.37 302 https://www.melochenator.com/login 2.123 N
Certificate error: RemoteCertificateNameMismatch
https://melochenator.com/login 200 2.110 B
https://www.melochenator.com/login 200 2.126 N
Certificate error: RemoteCertificateNameMismatch
https://melochenator.com:80/
52.3.37.37 302 https://melochenator.com/login 2.296 Q
https://www.melochenator.com:80/
52.3.37.37 302 https://www.melochenator.com/login 2.117 Q
http://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37 400 0.217 M
Bad Request
http://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37 400 0.217 M
Bad Request

Looks like you send port 80 to the https-port, so this wrong combination

https://www.melochenator.com:80/

has a http status 302.

Letsencrypt requires a working http port, not a Bad Request - status 400.


#10

can you please check i am on new method. i mean please check running new certbot-auto not on old one tls-sni-01

website name melochenator.com


#11

Now you have another error:

Domainname Http-Status redirect Sec. G
http://melochenator.com/
52.3.37.37 302 https://melochenator.com/ 0.210 A
http://www.melochenator.com/
52.3.37.37 302 https://www.melochenator.com/ 0.216 A
https://melochenator.com/
52.3.37.37 -2 1.310 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:443
https://www.melochenator.com/
52.3.37.37 -2 1.313 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:443
http://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37 302 https://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.217 A
http://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
52.3.37.37 302 https://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.214 A
https://melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de -2 1.310 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:443
https://www.melochenator.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de -2 1.317 V
ConnectFailure - Unable to connect to the remote server No connection could be made because the target machine actively refused it 52.3.37.37:443

Your http works and has correct redirects to https (which is good!).

But your https is blocked, looks like a firewall.


PS: My tool is public visible, so you can check your website and compare the result with other sites.

The last checks (https + /.well-known/acme-challenge - subdirectory) should produce a http status 404 and a Grade A.


#12

i fixed just please verify i am with new cert and not using TLS-SNI-01?


#13

I can’t see that. Check your log, there you should find the authentication method:

/var/log/letsencrypt/letsencrypt.log

#14

2019-01-27 14:24:18,497:DEBUG:certbot.storage:Writing new private key to /etc/letsencrypt/archive/melochenator.com/privkey12.pem.
2019-01-27 14:24:18,497:DEBUG:certbot.storage:Writing certificate to /etc/letsencrypt/archive/melochenator.com/cert12.pem.
2019-01-27 14:24:18,498:DEBUG:certbot.storage:Writing chain to /etc/letsencrypt/archive/melochenator.com/chain12.pem.
2019-01-27 14:24:18,498:DEBUG:certbot.storage:Writing full chain to /etc/letsencrypt/archive/melochenator.com/fullchain12.pem.
2019-01-27 14:24:18,626:DEBUG:certbot.plugins.selection:Requested authenticator webroot and installer <certbot.cli._Default object at 0x7fdc9e7d7190>
2019-01-27 14:24:18,774:DEBUG:certbot.cli:Var webroot_path=/var/www/melochenator.com/www/html/ (set by user).
2019-01-27 14:24:18,774:DEBUG:certbot.cli:Var webroot_map=set([‘webroot_path’]) (set by user).
2019-01-27 14:24:19,924:DEBUG:certbot.cli:Var webroot_path=/var/www/melochenator.com/www/html/ (set by user).
2019-01-27 14:24:20,780:DEBUG:certbot.cli:Var authenticator=webroot (set by user).
2019-01-27 14:24:22,022:DEBUG:certbot.storage:Writing new config /etc/letsencrypt/renewal/melochenator.com.conf.new.
2019-01-27 14:24:22,024:DEBUG:certbot.reporter:Reporting to user: Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/melochenator.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/melochenator.com/privkey.pem
Your cert will expire on 2019-04-27. To obtain a new or tweaked version of this certificate in the future, simply run certbot-auto again. To non-interactively renew all of your certificates, run “certbot-auto renew”
2019-01-27 14:24:22,024:DEBUG:certbot.reporter:Reporting to user: If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le


#15

what is the thing tell me i am using the right method? sent you the log


#16

This is good.

You are using webroot as authenticator, so you don’t use tls-sni-01 - validation.


#17

Thank you so much. i know i am idiot :slight_smile: