Hi,
since a few days, certificate renewals fail with a "During secondary validation: No valid IP addresses found" error. This used to work without issue, and there have been no changes to DNS.
The domain in question is www.heinbockel.info (and heinbockel.info)
I'm using the http-01 challenge via dehydrated:
../dehydrated/dehydrated --cron --alias heinbockel.info \
--domain heinbockel.info --domain www.heinbockel.info \
--challenge http-01
This is the full output:
# INFO: Using main config file dehydrated.conf
Processing heinbockel.info with alternative names: www.heinbockel.info
+ Checking domain name(s) of existing cert... unchanged.
+ Checking expire date of existing cert...
+ Valid till Apr 6 01:00:47 2021 GMT (Less than 31 days). Renewing!
+ Signing domains...
+ Generating private key...
+ Generating signing request...
+ Requesting new certificate order from CA...
+ Received 2 authorizations URLs from the CA
+ Handling authorization for www.heinbockel.info
+ Handling authorization for heinbockel.info
+ 2 pending challenge(s)
+ Deploying challenge tokens...
+ Responding to challenge for www.heinbockel.info authorization...
+ Cleaning challenge tokens...
+ Challenge validation has failed :(
ERROR: Challenge is invalid! (returned: invalid) (result: ["type"] "http-01"
["status"] "invalid"
["error","type"] "urn:ietf:params:acme:error:dns"
["error","detail"] "During secondary validation: No valid IP addresses found for www.heinbockel.info"
["error","status"] 400
["error"] {"type":"urn:ietf:params:acme:error:dns","detail":"During secondary validation: No valid IP addresses found for www.heinbockel.info","status":400}
["url"] "https://acme-v02.api.letsencrypt.org/acme/chall-v3/11381604758/BF7dWA"
["token"] "9GovvxBxtH8FibN_gfEJrU1d2a2zb3dvFLMuU9iCOSc"
["validationRecord",0,"url"] "http://www.heinbockel.info/.well-known/acme-challenge/9GovvxBxtH8FibN_gfEJrU1d2a2zb3dvFLMuU9iCOSc"
["validationRecord",0,"hostname"] "www.heinbockel.info"
["validationRecord",0,"port"] "80"
["validationRecord",0,"addressesResolved",0] "194.55.14.91"
["validationRecord",0,"addressesResolved"] ["194.55.14.91"]
["validationRecord",0,"addressUsed"] "194.55.14.91"
["validationRecord",0] {"url":"http://www.heinbockel.info/.well-known/acme-challenge/9GovvxBxtH8FibN_gfEJrU1d2a2zb3dvFLMuU9iCOSc","hostname":"www.heinbockel.info","port":"80","addressesResolved":["194.55.14.91"],"addressUsed":"194.55.14.91"}
["validationRecord"] [{"url":"http://www.heinbockel.info/.well-known/acme-challenge/9GovvxBxtH8FibN_gfEJrU1d2a2zb3dvFLMuU9iCOSc","hostname":"www.heinbockel.info","port":"80","addressesResolved":["194.55.14.91"],"addressUsed":"194.55.14.91"}])
An error occured!
My web server is (include version): apache 2.4.38-3+deb10u4
The operating system my web server runs on is (include version): debian buster
I can login to a root shell on my machine: yes
The version of my client is: latest
DNS records look good to me:
www.heinbockel.info:
$ dig www.heinbockel.info
; <<>> DiG 9.11.27-RedHat-9.11.27-1.fc33 <<>> www.heinbockel.info
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62215
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;www.heinbockel.info. IN A
;; ANSWER SECTION:
www.heinbockel.info. 60 IN CNAME vserver.heinbockel.info.
vserver.heinbockel.info. 59 IN A 194.55.14.91
heinbockel.info:
$ dig heinbockel.info
; <<>> DiG 9.11.27-RedHat-9.11.27-1.fc33 <<>> heinbockel.info
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46823
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;heinbockel.info. IN A
;; ANSWER SECTION:
heinbockel.info. 60 IN A 194.55.14.91
;; Query time: 166 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: So Mär 07 17:26:57 CET 2021
;; MSG SIZE rcvd: 60