More than 30 days ago, I created the first LE certificates on some of my domains. Everything worked out great. Today I wanted to secure the missing domains with LE. I got this message:
I started the routine with:
sudo /opt/letsencrypt/letsencrypt-auto certonly --webroot --rsa-key-size 4096 -w /var/www/xyz.de/web/ -d www.xyz.de -d xyz.de
`IMPORTANT NOTES:
_ - The following errors were reported by the server:_
_ Domain: XYZ.de_
_ Type: connection_
_ Detail: Could not connect to url /.well-known_
_ /acme-challenge_
_ Domain:xyz_
_ Type: connection_
_ Detail: Could not connect to url/.well-_
_ known/acme-challenge_
_ To fix these errors, please make sure that your domain name was_
_ entered correctly and the DNS A record(s) for that domain_
_ contain(s) the right IP address. Additionally, please check that_
_ your computer has a publicly routable IP address and that no_
_ firewalls are preventing the server from communicating with the_
_ client. If you’re using the webroot plugin, you should also verify_
_ that you are serving files from the webroot path you provided._
`
Then I wanted to know if the renewal of the existing certificates works or fails with the same message. Fortunately for me, the renewal worked flawlessly.
Can you verify that you’re able to manually browse to a file in http://example.com/.well-known/acme-challenge?
Try putting a file called test in there (with some random content) and make sure your browser is able to open it.
Please provide more information about the steps you’re following to produce this error.
Which client are you using to request certificates for XYZ.de? Is some other server perhaps running on port 80 for that domain?
You’ve asked it to run the acme challenge on port 80 but your apache instance is already bound to 80 on all interfaces:
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 7007/apache2
Try stopping apache and then rerunning the command.
@sleepypikachu: --webroot doesn't bind to any port, it just puts challenge files in a directory. The existing web server (apache) is supposed to serve the challenge files.
@MikeFrizz: Take a look at my reply (example.com is your domain in this example):
Is one of the affected domains behind a firewall that blocks access from the public internet?
If you wouldn’t mind sharing the URL to your test file, that would probably help analyze the problem. Note that all domains you request a certificate for a published to Certificate Transparency log servers, so they are in some way already public anyway.