Create certificate failed - Windows WACS 2.2.9

Help
1

Hi, i'm having troubles to create my certificates, but I don't know what the problem is. Thanks in advance.

My domain is*: frozenforge.eu
I ran this command: .\wacs.exe --target manual --host frozenforge.eu --validation filesystem --webroot "C:\xampp\htdocs" --store pemfiles --pemfilespath "C:\xampp\apache\conf"

It produced this output:
A simple Windows ACMEv2 client (WACS)
Software version 2.2.9.1701 (release, pluggable, standalone, 64-bit)
Connecting to https://acme-v02.api.letsencrypt.org/...
Connection OK!
Scheduled task not configured yet
Please report issues at GitHub - win-acme/win-acme: A simple ACME client for Windows (for use with Let's Encrypt et al.)
Running in mode: Unattended
Source generated using plugin Manual: frozenforge.eu

Plugin Manual generated source frozenforge.eu with 1 identifiers
Plugin Single created 1 order
[frozenforge.eu] Authorizing...
[frozenforge.eu] Authorizing using http-01 validation (FileSystem)
Answer should now be browsable at http://frozenforge.eu/.well-known/acme-challenge/kFetT7y_eMEoYLjOMRZMn349TAvlwxoaB2vt5JlOnfk
Preliminary validation looks good, but the ACME server will be more thorough
[frozenforge.eu] Authorization result: invalid
[frozenforge.eu] {"type":"urn:ietf:params:acme:error:unauthorized","detail":"2a00:4b40:aaaa:2005::6: Invalid response from http://frozenforge.eu/.well-known/acme-challenge/kFetT7y_eMEoYLjOMRZMn349TAvlwxoaB2vt5JlOnfk: 404","status":403,"instance":null}
[frozenforge.eu] Deactivating pending authorization
Create certificate failed

My web server is (include version): apache2

The operating system my web server runs on is (include version): windows server 2022

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): WACS 2.2.9

2

Hello @Zindokar, welcome to the Let's Encrypt community. :slightly_smiling_face:

The domain name frozenforge.eu has 2 IP Addressed, one IPv4 and one IPv6;
they are not responding the same.

Using the online tool Let's Debug yields these results https://letsdebug.net/frozenforge.eu/2349086?debug=y

MultipleIPAddressDiscrepancy
Warning
frozenforge.eu has multiple IP addresses in its DNS records. While they appear to be accessible on the network, we have detected that they produce differing results when sent an ACME HTTP validation request. This may indicate that some of the IP addresses may unintentionally point to different servers, which would cause validation to fail.
[Address=2a00:4b40:aaaa:2005::6,Address Type=IPv6,Server=openresty,HTTP Status=404] vs [Address=45.131.135.128,Address Type=IPv4,Server=Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12,HTTP Status=404]

HTTPRecords
Debug
A and AAAA records found for this domain
frozenforge.eu. 0 IN A 45.131.135.128
frozenforge.eu. 0 IN AAAA 2a00:4b40:aaaa:2005::6

Using curl on both IPv4 and IPv6 we can see a difference

IPv6 check Server: openresty

>curl -6 -Ii http://frozenforge.eu
HTTP/1.1 200 OK
Server: openresty
Date: Tue, 28 Jan 2025 22:40:34 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=10
Vary: Accept-Encoding
Vary: Accept-Encoding

IPv4 check Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12

>curl -4 -Ii http://frozenforge.eu
HTTP/1.1 302 Found
Date: Tue, 28 Jan 2025 22:40:40 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
X-Powered-By: PHP/8.2.12
Location: http://frozenforge.eu/dashboard/
Content-Type: text/html; charset=UTF-8

All IP Addresses (both IPv4 & IPv6) must respond the same and presently they are not.

Since the IPv4 Address is serving Apache and you stated a web server of apache2,
I am assuming you do not want the IPv6 address (DNS AAAA Record) and should be removed.

1 Like
3

Thanks for the information, I will try what you said and yes, we will not use IPv4, the service we are using is not even compatible with IPv6, is something very niche so... Thanks again.

1 Like