Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter ‘c’ to cancel): 1
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for www.nace.network
Using default addresses 80 and [::]:80 ipv6only=on for authentication.
Waiting for verification…
Challenge failed for domain www.nace.network
http-01 challenge for www.nace.network
Cleaning up challenges
Some challenges have failed.
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
I have verified and the domain name has been entered correctly and the DNS A contains ip 52.33.85.110
my application is made in ruby on rails 5 and is hosted on an AWS server
Requesting to rerun ./letsencrypt-auto with root privileges…
./letsencrypt-auto has insecure permissions!
To learn how to fix them, visit Certbot-auto deployment best practices
/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/cryptography/hazmat/primitives/constant_time.py:26: CryptographyDeprecationWarning: Support for your Python version is deprecated. The next version of cryptography will remove support. Please upgrade to a release (2.7.7+) that supports hmac.compare_digest as soon as possible.
utils.PersistentlyDeprecated2018,
Saving debug log to /var/log/letsencrypt/letsencrypt.log
I have no idea why it stopped working, I have not made changes to the webserver setup or configuration. The command I used was
./letsencrypt-auto
and when I execute it the following appears
Requesting to rerun ./letsencrypt-auto with root privileges…
./letsencrypt-auto has insecure permissions!
To learn how to fix them, visit Certbot-auto deployment best practices
/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/cryptography/hazmat/primitives/constant_time.py:26: CryptographyDeprecationWarning: Support for your Python version is deprecated. The next version of cryptography will remove support. Please upgrade to a release (2.7.7+) that supports hmac.compare_digest as soon as possible.
utils.PersistentlyDeprecated2018,
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Which names would you like to activate HTTPS for?
1: www.nace.network
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter ‘c’ to cancel): 1
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for www.nace.network
Using default addresses 80 and [::]:80 ipv6only=on for authentication.
Waiting for verification…
Challenge failed for domain www.nace.network
http-01 challenge for www.nace.network
Cleaning up challenges
Some challenges have failed.
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
So Certbot’s trying to use its nginx plugin, but things aren’t working out somehow.
Can you post the Nginx virtual host for www.nace.network?
Looking at the website’s headers, Varnish and Phusion Passenger seem to be involved. What’s listening on port 80? Nginx?
I don’t remember how much detail /var/log/letsencrypt/letsencrypt.log includes, but does it show that Certbot has found and is modifying the correct virtual host?
@mnordhoff This is the nginx file left by the previous programmer,
server {
listen 8080 default_server;
listen [::]:8080 default_server ipv6only=on;
server_name www.nace.network;
passenger_enabled on;
rails_env production;
root /home/ubuntu/nace/public;
# redirect server error pages to the static page /50x.html
error_page 500 502 503 504 /50x.html;
location / {
deny 46.229.168.0;
deny 51.68.152.0;
}
location = /50x.html {
root html;
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/www.nace.network/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/www.nace.network/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
}
with this command netstat -tulpn | grep :80 it seems that port 80 is not listening to anything
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 14206/nginx: worker
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp6 0 0 :::8080 :::* LISTEN 14206/nginx: worker
tcp6 0 0 :::80 :::* LISTEN -
something curious happens and if I try to access the page from google then it sends me the alert that the site is not safe, until I put the https in the url, I must do something additional so that always access with the https or something ?
But your port 80 and port 443 configs look combined into one.
So I’m not sure how to tell just one config “go to the other config” when they are one and the same.
I would break them up in two, one for http and one for https.
And place the redirection only in the http config (block).
