Certbot - TLS-SNI Challenge Not Passing - No SSL Certificate on Domain

Help
1

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: www.ashish.com
    Type: connection
    Detail: Failed to connect to 69.172.201.153:443 for tls-sni-01
    challenge

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you’re using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.

PS - I have made virtual host on local www.ashish.com
it points to my local directory

Thanx in advance

2

Hi @ashish1

Please fill out the fields below so we can help you better.

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

Andrei

3

I ran this command - sudo certbot --apache -d www.ashish.com
It produced this output: -

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for www.ashish.com
Enabled Apache socache_shmcb module
Enabled Apache ssl module
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. www.ashish.com (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to 69.172.201.153:443 for tls-sni-01 challenge

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: www.ashish.com
    Type: connection
    Detail: Failed to connect to 69.172.201.153:443 for tls-sni-01
    challenge

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you’re using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.

My web server is (include version): localhost
The operating system my web server runs on is (include version):Ubuntu 14.04.1 LTS

4

Hi @ashish1,

This question is meaning to ask what web server application you use (e.g., Apache or Nginx).

5

Sorry my web server is Apache …

6

verson is Apache/2.4.7 (Ubuntu)

7

Hi @ashish1

I suspect that because you do not have a certificate on your port 443 the connection is not established. I believe you need to have a working TLS connection on port 443 for the challenge to pass.

image.png1176Ă—555 24.3 KB

image.png799Ă—386 6.72 KB

Andrei

8

No, this is not correct. certbot --apache will reconfigure Apache to listen on port 443 to pass the TLS-SNI-01 challenge. You do not need to have an existing certificate of any kind.

However, certbot --apache does need to be able to be reconfigured by Certbot to start listening on port 443.

@ashish1,

Are you running Certbot directly on your web server, and not on some other computer?

Do you have a pretty standard Apache configuration from your operating system packages?

Are you using a CDN?

Are you using a reverse proxy?

Could there be any firewall anywhere that blocks inbound connections on port 443?

9

hi @schoen

Interesting, because reading the spec https://tools.ietf.org/html/draft-ietf-acme-acme-01#section-7.3

The divergences state version 01 is used but no other differences. https://github.com/letsencrypt/boulder/blob/master/docs/acme-divergences.md

  1. Open a TLS connection to the domain name being validated on the
    requested port, presenting the value
    "<Zi[0:32]>.<Zi[32:64]>.acme.invalid" in the SNI field (where the
    comparison is case-insensitive).

So I was under the impression a working domain SSL binding would be needed to pass the challenge.

Are you saying certbot creates two bindings? One for the domain and for the acme.invalid?

Will have a look at the boulder code to confirm

Andrei

10

Certbot creates the .acme.invalid cert. The Apache plugin itself does not create a binding for the subject domain name as part of the validation process.

11

hi @schoen

Thanks for the clarification

Apologies for not being more verbose with how I reached the conclusion of what is wrong.

I noticed port 443 is open on www.ashish.com however as there is no certificate the TLS handshake doesn’t complete.

Hence my suspicion is that the fix is to put a certificate (even a self signed one) on to the 443 binding complete the challenge and then use certbot

@ashish1 - you can easily create a self signed certificate (until you get a Let’'s Encrypt one) here: https://zerossl.com/free-ssl/#self

Andrei

12

Hi @ahaw021 @schoen
Thanx for the replies , Actually i came to know that , We can,t generate certifinctes on local virtual hosts As i have made virtual host on my local machine for that domain and that domain doesn,t belong to me.
Is this the reason i was not able to generate certificates or i will check the things that you both were talking about ?

13

Of course, you need to own or at least control the domain to be able to issue a certificate for it. If we could issue certificates for domains that we don't own or control we could issue certs for google.com, paypal.com etc. which is insane :stuck_out_tongue:

1 Like
14

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.