I ran this command: ./certbot-auto renew --dry-run
It produced this output:
Attempting to renew cert from /etc/letsencrypt/renewal/wofiel.com.conf produced an unexpected error: Failed authorization procedure. wofiel.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://wofiel.com/.well-known/acme-challenge/PcYcSaZ-junMDR6DmVrCO8Ku4fWgIR4hOc0fpp0_NGY: Error getting validation data. Skipping.
My web server is (include version): nginx/1.4.6
The operating system my web server runs on is (include version): Ubuntu 14.04.5 LTS
My hosting provider, if applicable, is: Digital Ocean
I can login to a root shell on my machine (yes or no, or I don’t know): Yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No
I’ve followed a few other threads on here, but none have seemed to help. The webroot seems correct in the LE conf, I have created a test page in acme-challenge and it is accessible via browser/curl via ipv4 and ipv6 at http://wofiel.com/.well-known/acme-challenge/test.html (redirects to https):
I believe so. Looking at the server logs I see that the validation authority tries to connect to your challenge server on IPv6 address 2604:a880:800:10::3401:4001 and then IPv4 address 188.8.131.52 and receives a connection refused error.
Hm, seems like the IPv6 redirect to https wasn’t working correctly for some reason. I’ve removed the AAAA record for now, so it shouldn’t try to use IPv6, but still no change ~18 hours after updating it.
Hmm - I have solved this with your hint of it being the webroot, but I’m not entirely sure of the root cause.
It was certainly using the correct directory from the config file, but the server was indeed getting no hits in the log. In the config file, it was specified in a way that I couldn’t find any documentation of?
wofiel.com = /path/to/webroot/
I ended up using the same details with certonly: certbot-auto certonly -w /path/to/webroot/ -d wofiel.com which authenticated correctly. Now I have a new line in my conf with webroot_path = /path/to/webroot, (comma included) which was not previously there. Doing a --dry-run of renew also now appears to work.