What "also failed" - please use more words.
3 Likes
dorian@carry:~$ sudo certbot --nginx -v
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Which names would you like to activate HTTPS for?
Now it requires me to choose the domains and the process that follows, but in the end it fails: I'll show you.
If you already have cert(s), then please use:
sudo certbot renew
If you are unsure about what certificate(s) you have, use:
sudo certbot certificates
3 Likes
Please take your time to make proper posts with all the informaton (i.e., the entire output) instead of spreading snippets of output into multiple posts.
2 Likes
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: www.********.com
Type: unauthorized
Detail: 2a02:4780:10:4027::1: Invalid response from http://www.*******.com/.well-known/acme-challenge/wlNhskLaE0_3LMUEPtcAcWEPkpraT8hnxYo-v36IjOw: 404
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
dorian@carry:~$
Why are you hiding the domain name?
Does your site work correctly via IPv6?
3 Likes
Okay, am verry sorry.
1 Like
I concur with Rudy, we need the actual hostname or hostnames for which you're trying to get a certificate for. It's actually mandatory to disclose as also mentioned in the questionnaire mentioned by Bruce earlier.
(Might be some IPv4 vs. IPv6 issue.)
3 Likes
My domain is: http://www.carry.assistanceserves.fr/
My web server is (include version): Ubuntu 22.04 64bit
The operating system my web server runs on is (include version): No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04.2 LTS
Release: 22.04
Codename: jammy
I can login to a root shell on my machine (yes or no, or I don't know): YES
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): NO
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.21.0
I'm not English, I'm French and I don't understand English very well, which is why I express myself with the few words I know in English 
Result to sudo cerbot --nginx -v:
dorian@carry:~$ sudo certbot --nginx -v
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Which names would you like to activate HTTPS for?
1: carry.assistanceserves.fr
2: www.carry.assistanceserves.fr
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1 2
Requesting a certificate for carry.assistanceserves.fr and www.carry.assistanceserves.fr
Performing the following challenges:
http-01 challenge for carry.assistanceserves.fr
http-01 challenge for www.carry.assistanceserves.fr
Waiting for verification...
Challenge failed for domain carry.assistanceserves.fr
Challenge failed for domain www.carry.assistanceserves.fr
http-01 challenge for carry.assistanceserves.fr
http-01 challenge for www.carry.assistanceserves.fr
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: carry.assistanceserves.fr
Type: unauthorized
Detail: 2a02:4780:10:4027::1: Invalid response from http://carry.assistanceserves.fr/.well-known/acme-challenge/tS7Lxv_Sou15a-ZkSjcqxDCkLQmoVKmRfwu0Uap2iRg: 404
Domain: www.carry.assistanceserves.fr
Type: unauthorized
Detail: 2a02:4780:10:4027::1: Invalid response from http://www.carry.assistanceserves.fr/.well-known/acme-challenge/Gkt__Yejj6ep-ivGEUR6AqyMoohgDCPtOi7uhbnM3pU: 404
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
dorian@carry:~$
I'm really sorry for the late reply.
Hm, interesting. I would have expected your IPv6 not working entirely, but for some reason your IPv6 shows the default nginx welcome page, but your IPv4 is showing a 404 file not found even when simply surfing to your website.
Is your website supposed to be operational? Or is the default nginx welcome page something you'd expect? Or the 404 file not found?
In any case I'd like to see the entire output of the command sudo nginx -T. Please put three backticks (```) before and after (on their own line) the output of that command when posting it here for better readability.
Also interesting is to see that the 404 file not founds for the challenge file differ between IPv4 and IPv6 when looking at the headers. So this leads me to believe either their configuration is completely different in nginx (hence the required output mentioned above) or the servers might be entirely different (but by chance both having nginx 1.18.0 running on Ubuntu).
6 Likes
Supplemental information: Port 443 is not Open but filtered, at least for IPv4.
$ nmap -Pn -p80,443 www.carry.assistanceserves.fr
Starting Nmap 7.80 ( https://nmap.org ) at 2023-07-11 19:45 UTC
Nmap scan report for www.carry.assistanceserves.fr (191.101.14.47)
Host is up (0.043s latency).
Other addresses for www.carry.assistanceserves.fr (not scanned): 2a02:4780:10:4027::1
PORT STATE SERVICE
80/tcp open http
443/tcp filtered https
Nmap done: 1 IP address (1 host up) scanned in 2.27 seconds
$ nmap -Pn -p80,443 carry.assistanceserves.fr
Starting Nmap 7.80 ( https://nmap.org ) at 2023-07-11 19:46 UTC
Nmap scan report for carry.assistanceserves.fr (191.101.14.47)
Host is up (0.042s latency).
Other addresses for carry.assistanceserves.fr (not scanned): 2a02:4780:10:4027::1
PORT STATE SERVICE
80/tcp open http
443/tcp filtered https
Nmap done: 1 IP address (1 host up) scanned in 2.02 seconds
And curl -Ii http://www.carry.assistanceserves.fr returned HTTP/1.1 404 Not Found, again at least for IPv4.
$ curl -Ii http://www.carry.assistanceserves.fr/
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Tue, 11 Jul 2023 19:50:00 GMT
Content-Type: text/html
Content-Length: 179
Connection: keep-alive
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
3 Likes
Yes, my website is up and running and I was expecting a non-functional page on the home page.
[sudo] password for dorian:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
##
# Gzip Settings
##
gzip on;
# gzip_vary on;
# gzip_proxied any;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
##
# Virtual Host Configs
##
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
#mail {
# # See sample authentication script at:
# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
# # auth_http localhost/auth.php;
# # pop3_capabilities "TOP" "USER";
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
# server {
# listen localhost:110;
# protocol pop3;
# proxy on;
# }
#
# server {
# listen localhost:143;
# protocol imap;
# proxy on;
# }
#}
# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip2.conf:
load_module modules/ngx_http_geoip2_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:
load_module modules/ngx_http_image_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:
load_module modules/ngx_http_xslt_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:
load_module modules/ngx_mail_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:
load_module modules/ngx_stream_module.so;
# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip2.conf:
load_module modules/ngx_stream_geoip2_module.so;
# configuration file /etc/nginx/mime.types:
types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;
image/png png;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;
image/svg+xml svg svgz;
image/webp webp;
application/font-woff woff;
application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.wap.wmlc wmlc;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xspf+xml xspf;
application/zip zip;
application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;
video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;
}
# configuration file /etc/nginx/sites-enabled/default:
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##
# Default server configuration
#
server {
listen 80 default_server;
listen [::]:80 default_server;
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
# pass PHP scripts to FastCGI server
#
#location ~ \.php$ {
# include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
# listen 80;
# listen [::]:80;
#
# server_name example.com;
#
# root /var/www/example.com;
# index index.html;
#
# location / {
# try_files $uri $uri/ =404;
# }
#}
# configuration file /etc/nginx/sites-enabled/payment:
server {
listen 80;
server_name carry.assistanceserves.fr www.carry.assistanceserves.fr;
location = /favicon.ico { access_log off; log_not_found off; }
location /static/ {
root /home/dorian/payment/;
}
location / {
include proxy_params;
proxy_pass http://unix:/run/payment.sock;
}
}
# configuration file /etc/nginx/proxy_params:
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
dorian@carry:~$
Your default server is the only one listening on IPv6
You should also listen to IPv6 in this server block
6 Likes
Please like this?
server {
listen 80;
listen [::]:80;
server_name carry.assistanceserves.fr www.carry.assistanceserves.fr;
location = /favicon.ico { access_log off; log_not_found off; }
location /static/ {
root /home/dorian/payment/;
}
location / {
include proxy_params;
proxy_pass http://unix:/run/payment.sock;
}
}
And do I change the IPv6 default mode in the nginx default file?
2 Likes
Yeah, great. We're good now.
Thank you very much.
You're all bosses.
My respects again.
3 Likes
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.