Error while certificate with certbot, already try some of topics

Help
1

I ran this command:

sudo certbot certonly --nginx -d smartco.cl -d www.smartco.cl

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for smartco.cl and www.smartco.cl

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: smartco.cl
Type: unauthorized
Detail: Invalid response from https://ssl-challenges.infomaniak.com/acme-challenge/FcmjPktLIcxBqBtxvQMBX-5aFZD4gThZnO308J223bM [2001:1600:0:aaaa::2:a]: 404

Domain: www.smartco.cl
Type: unauthorized
Detail: Invalid response from https://ssl-challenges.infomaniak.com/acme-challenge/TgDUwPM4NOGKJ7nVtIhySOM39f8CWfw3q-8_yMYFhXM [2001:1600:0:aaaa::2:a]: 404

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

The operating system my web server runs on is (include version):

CentOS 7

I can login to a root shell on my machine (yes or no, or I don't know):

yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot 1.16.0

1 Like
2

Hi @sanchezjuan,

Your domain has some IPv6/AAAA records which do not point to your nginx server.

If your nginx server has an IPv6 address, I suggest updating the DNS records for your domain to match it.

Otherwise, remove the DNS AAAA records, wait a bit, and try again.

2 Likes
3

Hi @sanchezjuan and welcome to the LE community forum :slight_smile:

I fail to understand how an HTTP validation request on this domain:

failed with an HTTPS validation request against this domain:

Yes, there a definite IPv6 problem... but I still fail to see the connection.

2 Likes
4

Indeed there was some errors with DNS and ipv6, I fixed already but now I got this:

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: smartco.cl
  Type:   unauthorized
  Detail: Invalid response from http://smartco.cl/.well-known/acme-challenge/z4rL_5h8JBfVRwRz3KoQe9r0sxA9AMJtUqszgSU5NMM [165.227.241.147]: "<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx/1.16.1</ce"

  Domain: www.smartco.cl
  Type:   unauthorized
  Detail: Invalid response from http://www.smartco.cl/.well-known/acme-challenge/19qu7q2JnChZEmXeZxSMBTufAay5VmzqEfFDfcl-yes [165.227.241.147]: "<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx/1.16.1</ce"

But I don't know if this had something related becase those point to a load balancer.

1 Like
5

A "load balancer" ?
That can surely explain the weirdness.
You might do better by using DNS validation (if that is supported by your DNS provider and your ACME client)

1 Like
6

I change it to point directly and still got the 403 reply:

Domain: smartco.cl
Type: unauthorized
Detail: Invalid response from http://smartco.cl/.well-known/acme-challenge/lm6e5-9ddY19Le2JhoRcS3zRNjIySIMoLCx9X7UOoSQ [DIRECT IP]: "\r\n403 Forbidden\r\n\r\n

403 Forbidden

\r\n
nginx/1.16.1</ce"

1 Like
7

I would confirm that the expected challenge file location can serve files correctly to the Internet.
That means looking through the nginx code to find where HTTP requested files for /.well-known/acme-challenge/ should be served from. Then placing a test-text-file in that location. Then try accessing that file from the Internet: http://smartco.cl/.well-known/acme-challenge/test-text-file

1 Like
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.