Getting a challenge http-01 failure on jira

Help
1

My domain is: jira.cleartrack.com

I ran this command: sudo certbot certonly --standalone -d jira.cleartrack.com

It produced this output: Performing the following challenges:
http-01 challenge for jira.cleartrack.com
Waiting for verification...
Challenge failed for domain jira.cleartrack.com
http-01 challenge for jira.cleartrack.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: jira.cleartrack.com
    Type: connection
    Detail: 69.2.197.137: Fetching
    http://jira.cleartrack.com/.well-known/acme-challenge/vlVGMGRdjmvtAbf6Z6wjaGig5aJcokpCXZv19VcpgyY:
    Timeout during connect (likely firewall problem)

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you're using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.

The operating system my web server runs on is (include version): Centos-7

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.11.0

Some more info. My server.xml file has the following so we use port 8443 to connect

2

Welcome to the Let's Encrypt Community! :slightly_smiling_face:

In order to satisfy an HTTP-01 challenge to prove control over the domain name, port 80 must be open and serving the public internet.

2 Likes
3

Thank you for the reply. Ok. Assuming I have root access to a shell how do I open port 80 and how do I verify that it is indeed open?

1 Like
4

That depends upon your firewall and networking configuration.

:crystal_ball: :eyes:

2 Likes
5

Testing --standalone is harder than other methods since nothing is listening on port 80 unless it is running. You can use --debug-challenges to help with that.

But, what might be easier is to use a DNS Challenge. You have Cloudflare as your DNS and that easily integrates with Certbot. See

https://certbot-dns-cloudflare.readthedocs.io/en/stable/

3 Likes
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.