Connection timout on one virtual host

[adaviel]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: huzizit.com

I ran this command: /root/letsencrypt/certbot-auto

It produced this output:
Domain: huzizit.com
Type: connection
Detail: Fetching
http://huzizit.com/.well-known/acme-challenge/BU9GQWed56KLs2K2_QsvMae1zXBznmWC3Ikf3m_wtFA:
Timeout during connect (likely firewall problem)

My web server is (include version):
Apache httpd-2.2.15-60.el6.centos.6.x86_64

The operating system my web server runs on is (include version):
CetnOS 6

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
0.36.0

---

I have a bunch of virtual hosts, e.g. www.daviel.org, vancouver-webpages.com, qry.cc
huzizit.com is no different.
When I run certbot-auto it lists 18 different hosts. If I check some, it works. If I include huzizit.com, it fails.

Renewing an existing certificate
Performing the following challenges:
http-01 challenge for ads.vancouver-webpages.com
http-01 challenge for huzizit.com
http-01 challenge for wml.vancouver-webpages.com
http-01 challenge for www.geotags.com
http-01 challenge for www.sexrejects.com
Waiting for verification…
Challenge failed for domain huzizit.com
http-01 challenge for huzizit.com
Cleaning up challenges
Some challenges have failed.

huzizit.com is a CNAME. The A record is the same as the other virtual hosts. It had a LetsEncrypt certificate before, which expired in May 2019

I can access the website just fine in my browser, though currently there’s just the Apache splash page. I’m not sure why the LE robot would be timing out on that URL. The directory exists on the server.
A test file http://huzizit.com/.well-known/acme-challenge/xx is accessible

[mnordhoff]

It looks like your websites have two different IP addresses:

huzizit.com.                 14400  A  199.103.62.188
www.huzizit.com.             14400  A  199.103.62.188
www.daviel.org.              14400  A  199.103.57.96
vancouver-webpages.com.      14400  A  199.103.57.96
ads.vancouver-webpages.com.  14400  A  199.103.57.96
wml.vancouver-webpages.com.  14400  A  199.103.57.96
www.vancouver-webpages.com.  14400  A  199.103.57.96
geotags.com.                 14400  A  199.103.57.96
www.geotags.com.             14400  A  199.103.62.188
sexrejects.com.              14400  A  199.103.57.96
www.sexrejects.com.          14400  A  199.103.57.96

I get a "no route to host" error if I try to connect to 199.103.62.188 on port 80.

@adaviel

huzizit.com is a CNAME.

For what it's worth, the zone apex isn't allowed to be a CNAME. Some DNS software will let you do it, but it's not valid, and it won't work reliably.

I don't see a CNAME record on dns1.vancouver-webpages.com, though.

[adaviel]

I just realized this is connected to DNS issues I have been having. Network Solutions hides the DNS IP address in their database view and only shows the name. So some domains were using stale DNS entries in gtld-servers.net and org.afilias-nst.org, although when I did a DNS lookup here I got the correct new values pulled from 199.103.57.96 or 35.182.72.145
I’ve just changed the DNS servers for all my domains on Network Solutions to new names dns3.vancouver-webpages.com, dns4… with those IP addresses. Those seem to have been pushed to the TLD servers.

I think this is solved; I was able to renew the cert for huzizit.com. It’s a bit weird though - as I say I had obtained a certificate this year although the DNS issue has been present since late 2018.

I was mistaken; huzizit.com is not a CNAME. andrew.daviel.org is a CNAME

Thank you - Andrew