Have been troubleshooting this issue for a few days now. I had a server running in a data center for a while, which had third party software that would launch certbot and nginx as docker containers. Setting up my original certs was painless, and renewals happened without issue. Recently, I moved my server to a different location and IP. I updated my DNS records, and things seemed to run fine, until it was time to renew the certs. Turns out the most recent attemps to do so failed, and now they're expired.
I ran this command: docker run --rm
--name certbot
-v path-to/.node-pilot/config/letsencrypt/config:/etc/letsencrypt
-v path-to/.node-pilot/config/letsencrypt/log:/var/log/letsencrypt
-v path-to/.node-pilot/config/nginx/public:/public
certbot/certbot renew --agree-tos
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided
--webroot-path/-w and that files created there can be downloaded from the internet.
My web server is (include version): Nginx
The operating system my web server runs on is (include version): 1.0.3
My hosting provider, if applicable, is: iwantmyname
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 3.0.1
ANotWorking
Error
nodes.winskitech.com has an A (IPv4) record (24.101.189.46) but a request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address.
Get "http://nodes.winskitech.com/.well-known/acme-challenge/letsdebug-test": net/http: HTTP/1.x transport connection broken: malformed HTTP status code "Ubuntu-3ubuntu13.5"
Trace:
@0ms: Making a request to http://nodes.winskitech.com/.well-known/acme-challenge/letsdebug-test (using initial IP 24.101.189.46)
@0ms: Dialing 24.101.189.46
@262ms: Experienced error: net/http: HTTP/1.x transport connection broken: malformed HTTP status code "Ubuntu-3ubuntu13.5"
IssueFromLetsEncrypt
Error
A test authorization for nodes.winskitech.com to the Let's Encrypt staging service has revealed issues that may prevent any certificate for this domain being issued.
24.101.189.46: Fetching http://nodes.winskitech.com/.well-known/acme-challenge/EJS3P274EifE_GTqiG-26y8-gtIboFET-TrcUdUF4ww: Error getting validation data
Here, Permanent link to this check report, is showing that HTTP Port 80 connection around the world are gettting "Connection reset by peer" results.
Edit
And this is what I get using curl
$ curl -i http://nodes.winskitech.com/.well-known/acme-challenge/sometestfile
curl: (1) Received HTTP/0.9 when not allowed
Thanks for the quick reply. From troubleshooting with chatgpt and looking at other posts, I am operating under the assumption that the issue with nginx. Here's a snippet from my configuration:
server {
# Port 80 is the default port for accepting HTTP connections
listen 80;
# These are the domain names (including subdomains) which this configuration will accept connections for
server_name nodes.winskitech.com;
# This line is for permanently redirecting to SSL/TLS
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name nodes.winskitech.com;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !aNULL !eNULL !LOW !kECDH !DSS !MD5 !RC4 !EXP !PSK !SRP !CAMELLIA !SEED';
ssl_prefer_server_ciphers on;
ssl_dhparam /ssl/dhparams.pem;
ssl_certificate /etc/letsencrypt/live/nodes.winskitech.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/nodes.winskitech.com/privkey.pem;
location / {
root /public;
try_files $uri @app;
}
location @app {
proxy_set_header X-Forwarded-For $remote_addr;
proxy_ssl_verify off;
proxy_pass http://host.docker.internal:34416;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}
I tried adding an exception for /.well-known, like this:
location /.well-known/acme-challenge/ {
root /public; # Replace /public with the directory Certbot writes to
allow all; # Ensure requests from Let's Encrypt are allowed
}
This is what I see trying ssh nodes.winskitech.com -p 80
$ ssh nodes.winskitech.com -p 80
The authenticity of host '[nodes.winskitech.com]:80 ([24.101.189.46]:80)' can't be established.
ED25519 key fingerprint is SHA256:XmZItKHtO5ENuBl051czO3eB8KcvNekd3sw9WgMEfpU.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?
Usually SSH runs on port 22. And a webserver serves HTTP on port 80. These are the default ports.
For some reason you have your SSH server listening on port 80. I have no clue how that could have happened, but this must be deliberately done by human action. E.g. by modifying the configuration file of the sshd daemon or an incorrect portmap.
