Error 404 unauthorized, cannot add certificate

Help
1

So I am trying to add a certificate to my website and I keep failing. Here are a few details that might help with the investigation:

  • the domain is http://codexbanana.com. Originally the domain was hosted by Hostinger.com and it had an SSL certificate. You can see it here , if it helps: crt.sh | www.codexbanana.com
  • the server is Ubuntu 22.04 and I have root access
  • I started to move the domain to a VPS still hosted by Hostinger. I am using Apache.
  • I moved some of the files to VPS, now I can access the site using http://codexbanana.com. I also deleted the old certificate, hoping that this will allow me to create a new one
  • I tried to install the certificate using directions from here: How to Install SSL on VPS Using Certbot | Hostinger Help Center
  • it kept failing with error 404
  • so I decided to install it manually, because I thought that I can better understand the process.
  • I ran "sudo certbot certonly --manual", I created a file with the name required, I placed the text in the content of the file, and I made the file available at that address. I was able to open and view the content of the file
  • but the certificate was not installed, and I got this error:
    Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
    Domain: codexbanana.com
    Type: unauthorized
    Detail: 2a02:4780:b:664:0:2c25:8fd8:1: Invalid response from http://codexbanana.com/.well-known/acme-challenge/etnkPaiWNeTCg8fgEPJjHwHG8M-XJzlTCEUZ-ftpB6U: 404
    Hint: The Certificate Authority failed to verify the manually created challenge files. Ensure that you created these in the correct location.
    Some challenges have failed.
    Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
  • I do not know what else I can try, because I do not know what I am doing wrong. I am not an expert with Linux, nor with Apache. It I got this far it was only because I tried a lot, and eventually something worked. Now I am stuck. Do you have any hints about what else I can try ?
2

Hi @cbanana, and welcome to the LE community forum :slight_smile:

I found those two things stood out [to me].

For the first: Please show us the output of:
sudo apachectl -t -D DUMP_VHOSTS

For the last: Does your site [codexbanana.com] work via IPv6?
The IPv4 and IPv6 seem to be handled by two different systems:

curl -Ii4 codexbanana.com
HTTP/1.1 200 OK
Date: Fri, 15 Dec 2023 17:45:35 GMT
Server: Apache/2.4.52 (Ubuntu)     <<<<<<<<<<<<<<<<<<<<<<<<<
Last-Modified: Sat, 18 Nov 2023 17:32:16 GMT
ETag: "12c2-60a70a24f8800"
Accept-Ranges: bytes
Content-Length: 4802
Vary: Accept-Encoding
Content-Type: text/html

curl -Ii6 codexbanana.com
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Sat, 23 Apr 2022 14:17:29 GMT
etag: "126d-62640a79-76ffc30d83d0599e;;;"
accept-ranges: bytes
content-length: 4717
date: Fri, 15 Dec 2023 17:45:39 GMT
server: LiteSpeed     <<<<<<<<<<<<<<<<<<<<<<<<<
platform: hostinger     <<<<<<<<<<<<<<<<<<<<<<<<<
3 Likes
3

Here is the result for that command:
VirtualHost configuration:
*:80 is a NameVirtualHost
default server srv442953.hstgr.cloud (/etc/apache2/sites-enabled/000-default.conf:1)
port 80 namevhost srv442953.hstgr.cloud (/etc/apache2/sites-enabled/000-default.conf:1)
port 80 namevhost codexbanana.com (/etc/apache2/sites-enabled/codexbanana.conf:1)

It is possible that IPv4 and IPv6 are handled by two different systems. I tried to manually move the site, and host it on a VPS. It is very possible that I forgot something. Although the site appears to work, it is possible that there are some issues, as you noticed. Let me investigate the IPv4 and IPv6.

4

Did you "test" access from a system with IPv6?

3 Likes
5

I do not know how to test access from a system with IPv6. But I got a to website that gave me this result:

DNS (IPv6 NS) PASS Hostname codexbanana.com does have IPv6-addressed nameservers defined.
DNS (IPv6 TLD NS) PASS Hostname top-level domain (com.) does have IPv6-addressed nameservers defined.
DNS (IPv4 A Record) PASS Hostname codexbanana.com does have an IPv4 A record (178.16.140.219).
DNS (IPv6 AAAA Record) PASS Hostname codexbanana.com does have an IPv6 AAAA record (2a02:4780:b:664:0:2c25:8fd8:1).
DNS (MX Record) FAIL Hostname codexbanana.com does not have an MX with an AAAA record.
DNS (Glue) PASS Glue does not appear to be needed; nameserver configuration for codexbanana.com is not self-referencing.
IPv4 Connectivity PASS Successfully connected to codexbanana.com on port 80 over IPv4.
IPv6 Connectivity PASS Successfully connected to codexbanana.com on port 80 over IPv6.
IPv4 Literals WARN Could not establish connection to URL http://codexbanana.com.

6

for the DNS , I changed to this new value:
AAAA @ 0 2a02:4780:10:5ff8::1
I took the IPV6 from VPS, so I hope it works.
Do I need to wait to replicate now ?

7

I ran again the same commands you executed earlier (curl -Ii6 codexbanana.com and -Ii4) and now both appear to point to the same server.

8

I tried again the manual installation and it worked. I got the message "Successfully received certificate". So the problem was that my VPS IPv4 and IPv6 were pointing to different addresses. Once I corrected the Ipv6 , the certificate was installed :-))) Thank you very much. I would have never figure it out what was wrong. Now I am trying to determine why https://codexbanana.com/ does not open.

2 Likes
9

Here is a clue:

curl -Ii https://codexbanana.com/
curl: (35) error:0A000438:SSL routines::tlsv1 alert internal error

curl -Ii http://codexbanana.com:443/
HTTP/1.0 301 Moved Permanently
Location: https://codexbanana.com:443/
Cache-Control: private, no-cache, max-age=0
Pragma: no-cache
Server:LiteSpeed
Content-Length: 0
Connection: Close
3 Likes
10

I had to remove the default config files, because they were taking some ports (443). After I deleted 2 files from /etc/apache2/sites-available/ and restarted Apache, I was finally able to open my side using https. I am all set, thanks a lot !!!

1 Like
11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.