Domain on Hostzinger failing tls challenge ( cannot create certificate )

My domain is: waggingreens.com ( hosted on hostzinger , I mapped the a record to point to an azure vm public ip )

I ran this command:
sudo /opt/bitnami/letsencrypt/lego --tls --email="techteam@waggingreens.com" --domains="waggingreens.com" --domains="www.waggingreens.com" --path="/opt/bitnami/letsencrypt" run

It produced this output:
bitnami@waggingreens-marketplace-web:/tmp$ sudo /opt/bitnami/letsencrypt/lego --tls --email="techteam@waggingreens.com" --domains="waggingreens.com" --domains="www.waggingreens.com" --path="/opt/bitnami/letsencrypt" run
2024/04/16 05:44:13 [INFO] [waggingreens.com, www.waggingreens.com] acme: Obtaining bundled SAN certificate
2024/04/16 05:44:14 [INFO] [waggingreens.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/339071451537
2024/04/16 05:44:14 [INFO] [www.waggingreens.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/339071451547
2024/04/16 05:44:14 [INFO] [waggingreens.com] acme: use tls-alpn-01 solver
2024/04/16 05:44:14 [INFO] [www.waggingreens.com] acme: use tls-alpn-01 solver
2024/04/16 05:44:14 [INFO] [waggingreens.com] acme: Trying to solve TLS-ALPN-01
2024/04/16 05:44:18 [INFO] [www.waggingreens.com] acme: Trying to solve TLS-ALPN-01
2024/04/16 05:44:22 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/339071451537
2024/04/16 05:44:23 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/339071451547
2024/04/16 05:44:23 Could not obtain certificates:
error: one or more domains had a problem:
[waggingreens.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Cannot negotiate ALPN protocol "acme-tls/1" for tls-alpn-01 challenge
[www.waggingreens.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Cannot negotiate ALPN protocol "acme-tls/1" for tls-alpn-01 challenge

My web server is (include version): nginx

The operating system my web server runs on is (include version): Debian GNU/Linux 12 (bookworm)

My hosting provider, if applicable, is:

domain host is hostzinger while application with public ip runs on azure bitnami vm for wordpress nginx and ssl

What does this mean exactly? And on which host are you running lego?

1 Like
  • Domain name is purchased with hostzinger so i added an A record to point to azure vm public ip on the manage domain name section of hostzinger website
  • lego is run on azure vm

Your IPv4 address responds with an nginx server, but the IPv6 address that's configured says it's a Litespeed server.

The above is something that requires attention in any case. Further more: is there a specific reason why you're using the tls-alpn-01 challenge with the --tls option?

3 Likes

I really don't know what i am doing here , I just followed the instruction
https://docs.bitnami.com/azure/how-to/generate-install-lets-encrypt-ssl/

and I got stuck , I thought it would be easy peasy
all i did was run this

sudo /opt/bitnami/letsencrypt/lego --tls --email="[redacted]" --domains="waggingreens.com" --domains="www.waggingreens.com" --path="/opt/bitnami/letsencrypt" run

Does this implicitly use tls-alpn-01 ?

Explicitely even with the --tls option.

That said, didn't the bncert-tool work? Which should be easier than the manual steps of the guide. Maybe the bncert-tool approach, if you attempted this, didn't work due to an incorrect IPv6 address?

2 Likes

Will try out the bncert-tool and revert quickly

The server configuration has no IPV6 address @Osiris

But your domain has one configured, probably @ Hostzinger.

2 Likes

Yes Hostzinger has one configured , could that be the reason why ?

i also used bitnami cert tool and the same issue happens

Warning: Support for the nginx web server is limited. This tool will only be 
able to generate HTTPS certificates and configure certificate renewal. It will 
not enable/disable redirections or apply other types of server configurations.
Press [Enter] to continue:
----------------------------------------------------------------------------
Welcome to the Bitnami HTTPS Configuration tool.

----------------------------------------------------------------------------
Domains

Please provide a valid space-separated list of domains for which you wish to 
configure your web server.

Domain list []: waggingreens.com www.waggingreens.com

----------------------------------------------------------------------------
Changes to perform

The following changes will be performed to your Bitnami installation:

1. Stop web server
2. Configure web server to use a free Let's Encrypt certificate for the domains: 
waggingreens.com www.waggingreens.com
3. Configure a cron job to automatically renew the certificate each month
4. Start web server once all changes have been performed



Do you agree to these changes? [Y/n]: y


----------------------------------------------------------------------------
Create a free HTTPS certificate with Let's Encrypt

Please provide a valid e-mail address for which to associate your Let's Encrypt 
certificate.

Domain list: waggingreens.com www.waggingreens.com

Server name: waggingreens.com

E-mail address []: techteam@waggingreens.com

The Let's Encrypt Subscriber Agreement can be found at:

https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf

Do you agree to the Let's Encrypt Subscriber Agreement? [Y/n]: y


----------------------------------------------------------------------------
Performing changes to your installation

The Bitnami HTTPS Configuration Tool will perform any necessary actions to your 
Bitnami installation. This may take some time, please be patient.

|

An error occurred creating certificates with Let's Encrypt:


2024/04/16 08:53:18 [INFO] [waggingreens.com, www.waggingreens.com] acme: 
Obtaining bundled SAN certificate
2024/04/16 08:53:18 [INFO] [waggingreens.com] AuthURL: 
https://acme-v02.api.letsencrypt.org/acme/authz-v3/339123819917
2024/04/16 08:53:18 [INFO] [www.waggingreens.com] AuthURL: 
https://acme-v02.api.letsencrypt.org/acme/authz-v3/339123819927
2024/04/16 08:53:18 [INFO] [waggingreens.com] acme: use tls-alpn-01 solver
2024/04/16 08:53:18 [INFO] [www.waggingreens.com] acme: use tls-alpn-01 solver
2024/04/16 08:53:18 [INFO] [waggingreens.com] acme: Trying to solve TLS-ALPN-01
2024/04/16 08:53:26 [INFO] [www.waggingreens.com] acme: Trying to solve 
TLS-ALPN-01
2024/04/16 08:53:31 [INFO] Deactivating auth: 
https://acme-v02.api.letsencrypt.org/acme/authz-v3/339123819917
2024/04/16 08:53:31 [INFO] Deactivating auth: 
https://acme-v02.api.letsencrypt.org/acme/authz-v3/339123819927
2024/04/16 08:53:32 Could not obtain certificates:
	error: one or more domains had a problem:
[waggingreens.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized 
:: Cannot negotiate ALPN protocol "acme-tls/1" for tls-alpn-01 challenge
Press [Enter] to continue:
[www.waggingreens.com] acme: error: 403 :: 
urn:ietf:params:acme:error:unauthorized :: Cannot negotiate ALPN protocol 
"acme-tls/1" for tls-alpn-01 challenge

Please check our documentation and support forums, we'll be happy to help!

* Bitnami Documentation: https://docs.bitnami.com
* Bitnami Community: https://github.com/bitnami/vms

Press [Enter] to continue:
----------------------------------------------------------------------------
Error

An error occurred when applying configurations.

The web server configuration was left unchanged. There was an error in the new 
configuration, so it was reverted.

Failed steps:
* Running Let's Encrypt: Error creating certificates

Find more details in the log file:

/tmp/bncert-202404160852.log

If you find any issues, please check Bitnami Support forums at:

https://github.com/bitnami/vms

Press [Enter] to continue:

Probably, see the details in the authorization object @ https://acme-v02.api.letsencrypt.org/acme/authz-v3/339123819927:

      "addressUsed": "2a02:4780:a:807:0:18cf:644d:2"

Having an incorrect IPv6 address in DNS is not a good thing, not just for this certificate issue, but in general.

2 Likes

Some how ifeel this V6 address is still referenced from hostzinger side

Screenshot 2024-04-16 at 12.14.04

Issue resolved , i deleted the ipv6 from hostzinger AAAA record and was able to create a certificate

2 Likes