DNS problem: query timed out

Help
1

I am having issues generating an SSL cert for one of my domains.
The DNS query always times out.

I am hosting several other domains, all with an identical configuration in terms of nginx config, nameserver, DNS zone files, etc, and they are all working without issue.

I can't figure out why this one domain refuses to work and always times out, yet the rest are ok.

My domain is:
johnfordemotors.net

I ran this command:
certbot certonly -d johnfordemotors.net -d www.johnfordemotors.net -v --webroot --webroot-path /srv/www/ssl-backend/public_html

It produced this output:

Plugins selected: Authenticator webroot, Installer None
Requesting a certificate for johnfordemotors.net and www.johnfordemotors.net
Performing the following challenges:
http-01 challenge for johnfordemotors.net
http-01 challenge for www.johnfordemotors.net
Using the webroot path /srv/www/ssl-backend/public_html for all unmatched domains.
Waiting for verification...
Challenge failed for domain johnfordemotors.net
Challenge failed for domain www.johnfordemotors.net
http-01 challenge for johnfordemotors.net
http-01 challenge for www.johnfordemotors.net

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: johnfordemotors.net
  Type:   dns
  Detail: DNS problem: query timed out looking up A for johnfordemotors.net; DNS problem: query timed out looking up AAAA for johnfordemotors.net

  Domain: www.johnfordemotors.net
  Type:   dns
  Detail: DNS problem: query timed out looking up A for www.johnfordemotors.net; DNS problem: query timed out looking up AAAA for www.johnfordemotors.net

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Cleaning up challenges
Some challenges have failed.

My web server is (include version):
nginx/1.14.1

The operating system my web server runs on is (include version):
AlmaLinux release 8.8

My hosting provider, if applicable, is:
N/A (private cloud)

I can login to a root shell on my machine (yes or no, or I don't know):
Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 1.23.0

I have performed DNS lookups using a few different online services and they all return valid results, so as far as I can tell everything is setup correctly.

I have checked it serveral times using letsdebug.net and it returns an timeout error every time except once.

An example of another of my domains on the same server, nameserver, etc, that is working correctly is: www.velocitymotors.co.uk

Any assistance would be greatly appreciated as I am at a complete loss.

2

Trying to resolve your domain directly at both of your NSes from my RU and NL boxes end up with timeouts. DNSViz shows errors and warnings. Unboundtest also timeouts (though deciphering its output is somewhat above my pay grade). But public resolvers like 1.1.1.1 and 8.8.8.8 resolve just fine, curious.

Querying your velocitymotors domain also timeouts on my boxes, DNSViz is also stuck analyzing for a while. But does resolve fine on Unboundtest. Go figure.

Other volunteers might have some other ideas, but I would recommend contacting your DNS provider. Perhaps point them to this thread.

2 Likes
3

I have over 200 domains on the same nameserver, and all of them are able to generate certificates using certbot/letsencrypt without any issues or timeouts.

This issue is only affecting a single domain.

4

I've moved the domain to different nameservers and was able to generate a cert.

Would love to figure out what the actual cause was, but I can at least get the site up and running again for now

5

You need to have a triple PhD in quantum mechanics, IT and the fine art. Only then you're able to understand the dredge that Unbound produces.. :rofl:

3 Likes