Failed authorization procedure. (tls-sni-01):

[mnordhoff]

app.re-roadmap.com is some sort of Google web server. On HTTP, it returns a redirect to http://159.203.124.184/ (a DigitalOcean IP). It doesn’t support HTTPS.

$ mhost app.re-roadmap.com.
app.re-roadmap.com.    (unsigned)  3600  CNAME  ghs.googlehosted.com.
ghs.googlehosted.com.  (unsigned)  300   A      216.58.193.179
ghs.googlehosted.com.  (unsigned)  300   AAAA   2607:f8b0:4002:812::2013

You need an actual A record with your actual DigitalOcean IP address if you want to use TLS-SNI-01 validation (or if you want to put a website there).

HTTP-01 validation (like with the webroot plugin) would work despite the Google redirect service, but TLS-SNI-01 won’t.

It sound like the subdomain is some sort of “URL forward” or something at the DNS provider. It should be a normal A record.

[schoen]

@mnordhoff, thanks for thinking of this. I noticed the ghs.googlehosted.com part last week but I didn’t notice that @ktys1 said it was supposed to be hosted on DigitalOcean. I guess in the future I need to check explicitly whether the hosting provider that I see in tests is the same hosting provider that the user expects to be using.

I completely agree with @mnordhoff’s diagnosis and think that accounts for 100% of the problems here!

[talonx]

If I understand the documentation correctly, running certbot out of the box does require 443, and it needs the --preferred-challenges option to override it. Is this correct? Also, nginx does not seem to support the http-01 plugin.

[ktys1]

Hey Everybody on this thread - sorry I dropped out for a week, but in fact
the Google “forwarding” process, which was the service requested for our
DNS, that @mnordhoff identified, would not work with the standard cert
process, so we switched to a full DNS mode rather than forwarding, and
everything seems to work as expected now.

Thanks a lot for once again working through a difficult setup issue.

[mnordhoff]

I'm glad you were able to solve it.

For posterity, though, on second thought:

@mnordhoff

HTTP-01 validation (like with the webroot plugin) would work despite the Google redirect service

That? Wrong. As a design decision, the validator won't follow redirects to IP addresses. http://any-website.example.com/? Yes. http://159.203.124.184.xip.io/? Also yes. (It's a real domain.) http://159.203.124.184/? Noo.