Error renewing certificate

serafinimc · April 26, 2024, 9:55pm

Description

My certificates are usually renewed automatically but I got an expiration notice email and when I tried to manually revalidate I got the fail. There are a few domains with the same issue, I share only one here but I'm having the same problem. I checked and firewalls are not active and port 80 is open. But I'm out of ideas. I'd appreciate any help!

The basics

My domain is: ambulatorio3.insumate.com.ar

I ran this command: sudo certbot --nginx -d ambulatorio3.insumate.com.ar -v

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Certificate is due for renewal, auto-renewing...
Renewing an existing certificate for ambulatorio3.insumate.com.ar
Performing the following challenges:
http-01 challenge for ambulatorio3.insumate.com.ar
Waiting for verification...
Challenge failed for domain ambulatorio3.insumate.com.ar
http-01 challenge for ambulatorio3.insumate.com.ar

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: ambulatorio3.insumate.com.ar
  Type:   unauthorized
  Detail: 2800:6c0:5::26f: Invalid response from http://ambulatorio3.insumate.com.ar/.well-known/acme-challenge/P18mMMjoyikmnxfBAXDWEvhsZuSHFJHos1ywEjegwM8: 404

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): nginx 1.18.0

The operating system my web server runs on is (include version): Ubuntu 22.04

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.21.0

Some extras:

I also ran sudo nginx -T:

sudo nginx -T

and it produced:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	# server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}


#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
#
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}
#}

# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip2.conf:
load_module modules/ngx_http_geoip2_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:
load_module modules/ngx_http_image_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:
load_module modules/ngx_http_xslt_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:
load_module modules/ngx_mail_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:
load_module modules/ngx_stream_module.so;

# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip2.conf:
load_module modules/ngx_stream_geoip2_module.so;

# configuration file /etc/nginx/mime.types:

types {
    text/html                             html htm shtml;
    text/css                              css;
    text/xml                              xml;
    image/gif                             gif;
    image/jpeg                            jpeg jpg;
    application/javascript                js;
    application/atom+xml                  atom;
    application/rss+xml                   rss;

    text/mathml                           mml;
    text/plain                            txt;
    text/vnd.sun.j2me.app-descriptor      jad;
    text/vnd.wap.wml                      wml;
    text/x-component                      htc;

    image/png                             png;
    image/tiff                            tif tiff;
    image/vnd.wap.wbmp                    wbmp;
    image/x-icon                          ico;
    image/x-jng                           jng;
    image/x-ms-bmp                        bmp;
    image/svg+xml                         svg svgz;
    image/webp                            webp;

    application/font-woff                 woff;
    application/java-archive              jar war ear;
    application/json                      json;
    application/mac-binhex40              hqx;
    application/msword                    doc;
    application/pdf                       pdf;
    application/postscript                ps eps ai;
    application/rtf                       rtf;
    application/vnd.apple.mpegurl         m3u8;
    application/vnd.ms-excel              xls;
    application/vnd.ms-fontobject         eot;
    application/vnd.ms-powerpoint         ppt;
    application/vnd.wap.wmlc              wmlc;
    application/vnd.google-earth.kml+xml  kml;
    application/vnd.google-earth.kmz      kmz;
    application/x-7z-compressed           7z;
    application/x-cocoa                   cco;
    application/x-java-archive-diff       jardiff;
    application/x-java-jnlp-file          jnlp;
    application/x-makeself                run;
    application/x-perl                    pl pm;
    application/x-pilot                   prc pdb;
    application/x-rar-compressed          rar;
    application/x-redhat-package-manager  rpm;
    application/x-sea                     sea;
    application/x-shockwave-flash         swf;
    application/x-stuffit                 sit;
    application/x-tcl                     tcl tk;
    application/x-x509-ca-cert            der pem crt;
    application/x-xpinstall               xpi;
    application/xhtml+xml                 xhtml;
    application/xspf+xml                  xspf;
    application/zip                       zip;

    application/octet-stream              bin exe dll;
    application/octet-stream              deb;
    application/octet-stream              dmg;
    application/octet-stream              iso img;
    application/octet-stream              msi msp msm;

    application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet          xlsx;
    application/vnd.openxmlformats-officedocument.presentationml.presentation  pptx;

    audio/midi                            mid midi kar;
    audio/mpeg                            mp3;
    audio/ogg                             ogg;
    audio/x-m4a                           m4a;
    audio/x-realaudio                     ra;

    video/3gpp                            3gpp 3gp;
    video/mp2t                            ts;
    video/mp4                             mp4;
    video/mpeg                            mpeg mpg;
    video/quicktime                       mov;
    video/webm                            webm;
    video/x-flv                           flv;
    video/x-m4v                           m4v;
    video/x-mng                           mng;
    video/x-ms-asf                        asx asf;
    video/x-ms-wmv                        wmv;
    video/x-msvideo                       avi;
}

# configuration file /etc/nginx/sites-enabled/default:
server {
        server_name api.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:7664/;
        }

        listen [::]:443 ssl; # managed by Certbot
        listen 443 ssl; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/api.insumate.com.ar/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/api.insumate.com.ar/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
        server_name remoto.insumate.com.ar;

        root /var/www/frontend;
        index index.html;
        location / {
                try_files $uri $uri/ /index.html;
        }


        listen [::]:443 ssl;
	listen 443 ssl; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/remoto.insumate.com.ar-0001/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/remoto.insumate.com.ar-0001/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {

        server_name riki.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1338/;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "Upgrade";
        }

        listen [::]:443 ssl; # managed by Certbot
	listen 443 ssl; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/riki.insumate.com.ar/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/riki.insumate.com.ar/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {

        server_name lm.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1340/;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
        }

    listen [::]:443 ssl; 	
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/lm.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/lm.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {

        server_name ambulatorio1.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1339/;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "Upgrade";
        }

    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/ambulatorio1.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/ambulatorio1.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {

        server_name ambulatorio2.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1341/;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
        }


    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/ambulatorio2.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/ambulatorio2.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {

        server_name ambulatorio3.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1342/;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
        }


    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/ambulatorio3.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/ambulatorio3.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {

        server_name robertot.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1343/;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
        }


    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/robertot.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/robertot.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {

        server_name belens.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1344/;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
        }


    listen [::]:443 ssl;
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/belens.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/belens.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {

        server_name vaninap.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1345/;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
        }

    listen [::]:443 ssl;
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/vaninap.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/vaninap.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {

        server_name paoladn.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1346/;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
        }

    listen [::]:443 ssl;
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/paoladn.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/paoladn.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {

        server_name germann.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1347/;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
        }

    listen [::]:443 ssl;
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/germann.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/germann.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {

        server_name pruebaceci.insumate.com.ar;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://localhost:1348/;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
        }

    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/pruebaceci.insumate.com.ar/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/pruebaceci.insumate.com.ar/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}



server {
        listen 80 default_server;
        server_name _;
        return 301 https://$host$request_uri;
}

server {
    if ($host = ambulatorio2.insumate.com.ar) {
        return 301 https://$host$request_uri;
    } # managed by Certbot



        server_name ambulatorio2.insumate.com.ar;
    listen 80;
    return 404; # managed by Certbot


}

server {
    if ($host = ambulatorio3.insumate.com.ar) {
        return 301 https://$host$request_uri;
    } # managed by Certbot



        server_name ambulatorio3.insumate.com.ar;
    listen 80;
    return 404; # managed by Certbot


}



server {
    if ($host = robertot.insumate.com.ar) {
        return 301 https://$host$request_uri;
    } # managed by Certbot



        server_name robertot.insumate.com.ar;
    listen 80;
    return 404; # managed by Certbot


}


server {
    if ($host = belens.insumate.com.ar) {
        return 301 https://$host$request_uri;
    } # managed by Certbot



        server_name belens.insumate.com.ar;
    listen 80;
    return 404; # managed by Certbot


}

server {
    if ($host = vaninap.insumate.com.ar) {
        return 301 https://$host$request_uri;
    } # managed by Certbot



        server_name vaninap.insumate.com.ar;
    listen 80;
    return 404; # managed by Certbot


}

server {
    if ($host = germann.insumate.com.ar) {
        return 301 https://$host$request_uri;
    } # managed by Certbot



        server_name germann.insumate.com.ar;
    listen 80;
    return 404; # managed by Certbot


}

server {
    if ($host = paoladn.insumate.com.ar) {
        return 301 https://$host$request_uri;
    } # managed by Certbot



        server_name paoladn.insumate.com.ar;
    listen 80;
    return 404; # managed by Certbot


}


server {
    if ($host = pruebaceci.insumate.com.ar) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        listen [::]:80;

        server_name pruebaceci.insumate.com.ar;
    return 404; # managed by Certbot


}
# configuration file /etc/letsencrypt/options-ssl-nginx.conf:
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.

ssl_session_cache shared:le_nginx_SSL:10m;
ssl_session_timeout 1440m;
ssl_session_tickets off;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256

catharsis · April 26, 2024, 10:39pm

I'm an Apache guy but looking at your configuration, it seems like most of your port 80 vhosts (or "servers" as I guess nginx calls them) have listen 80; but not listen [::]:80;. I assume this means they're enabled only for IPv4, not IPv6. But you do have an AAAA record so you need to be prepared for requests from LetsEncrypt to come in over either IPv4, IPv6, or a mix of the two. So probably the IPv6 traffic is matching the wrong vhost. You'll note that HTTP traffic to the hostname always gets a 404 when using IPv6, but forwards to HTTPS when using IPv4

$ curl -4 -I http://ambulatorio3.insumate.com.ar/
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 26 Apr 2024 22:39:45 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://ambulatorio3.insumate.com.ar/

$ curl -6 -I http://ambulatorio3.insumate.com.ar/
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 26 Apr 2024 22:39:49 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive

griffin · April 26, 2024, 10:42pm

Welcome to the Let's Encrypt Community, @serafinimc!

I concur with your thoughts, @catharsis.

griffin · April 26, 2024, 10:46pm

This one looks correct:

serafinimc:

server {
    if ($host = pruebaceci.insumate.com.ar) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        listen [::]:80;

        server_name pruebaceci.insumate.com.ar;
    return 404; # managed by Certbot


}

The reason for not using a catch-all server block (server_name _) to replace all the port 80 server blocks is because certbot won't recognize the catch-all for any particular (sub)domain name based on the server_name directive in order to add its exception to satisfy the ACME HTTP-01 challenge. I forgot about this and when I remembered I deleted my post directly below suggesting a catch-all.

griffin · April 26, 2024, 10:54pm

@catharsis

Let's Encrypt always prefers IPv6 for HTTP-01 challenges when a AAAA record is present, so your advice is quite sound.

rg305 · April 27, 2024, 1:46am

Thinking one step further/beyond the currently [made] obvious...

The HTTP ACME challenge requests are redirected to HTTPS.
The HTTPS ACME challenge requests are proxied to http://localhost:1342/.
I don't see an nginx vhost for that port.
What is handling the proxied HTTP ACME challenge requests on port 1342?

Note: certbot might be able to rewrite the config to handle the request [--nginx].
But I just don't like depending on things I can't control.
I'd much rather use --webroot and be certain about how things are being done.

griffin · April 27, 2024, 4:27am

I thought --nginx was supposed to temporarily add an exception to the server block to prevent that from happening. Granted IPv6 for the port 80 server block for the specific subdomain name(s) (not the catch-all) need(s) to be added first for that to happen. I think using --webroot here might make things more complicated than the --nginx exception since some logic would be needed to prevent the HTTP-01 requests from being proxied to the backend. It's highly possible (likely even) that certbot might not be able to write the HTTP-01 challenge file to whatever is handling the backend requests. I know you know all this, @rg305. I say these things for @serafinimc's benefit.

serafinimc · April 29, 2024, 1:25pm

Thank you all for the prompt responses! I did not notice the lack of access for IPv6 in port 80 in some server blocks!
I'll add that to the rest of the server blocks and see if that works now. Again, thank you so much also to @catharsis!

update: it did, I had no trouble renewing the certificates now so I changed the rest of the servers to and see if those can auto renew when their time comes.

system · May 29, 2024, 1:25pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Problem renewing certificates Help	14	4844	August 18, 2021
Cert Renewal Failure Help	4	296	March 12, 2024
Certbot failed to authenticate some domains (authenticator: nginx) Help	10	207	November 22, 2024
No longer able to renew existing cert, nor make new certs Help	7	532	September 24, 2021
Renewing an existing certificate Help	10	1042	February 6, 2023

Error renewing certificate

Description

The basics

Some extras:

Related topics