Having problems updating cert from different machine

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

I am moving my web server to a different machine and I'm trying to get my cert update mechanism to work. The original machine was Ubuntu 20.4 and apache 2.4.52. It contained the apache server that connects to the outside world (with my web files) and also contains the certbot install. I have created deployment scripts that copy the updated certs to a number of different machines that also face the internet through very odd port numbers. (hence the extra domains)

The new installation has my web files on an apache red hat installation. It works fine now as a web server, but I have no way of getting cerbot to execute reliably there. So I have installed certbot on a Ubuntu 24.04 client machine and copied over all the LE files from the Ubuntu 20.04 server. I had to install apache in order to get the authentication to work happily. However, this version of apache does not face the internet.

My domain is:
illuminosi.com & others

I ran this command:
sudo certbot certonly
--dry-run
--email tomf@illuminosi.com
--agree-tos --manual-public-ip-logging-ok
-d illuminosi.com,www.illuminosi.com,mail.illuminosi.com
-d unifi.illuminosi.com,unvr-1.illuminosi.com,untangle.illuminosi.com
--deploy-hook /etc/letsencrypt/renewal-hooks/deploy/my-deploy

It produced this output:
Use of --manual-public-ip-logging-ok is deprecated.
Saving debug log to /var/log/letsencrypt/letsencrypt.log

An RSA certificate named illuminosi.com already exists. Do you want to update
its key type to ECDSA?

(U)pdate key type/(K)eep existing key type: u
Simulating renewal of an existing certificate for illuminosi.com and 5 more domains

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: illuminosi.com
Type: unauthorized
Detail: 208.70.146.4: Invalid response from https://illuminosi.com/.well-known/acme-challenge/oGZFXwwWOUEir5Qp0MvdohP5b4zVCB6AjsCNQp9AwVg: 404

Domain: mail.illuminosi.com
Type: unauthorized
Detail: 208.70.146.4: Invalid response from http://mail.illuminosi.com/.well-known/acme-challenge/XWl8d8oRim6_tnIX3IYqT4Mgm5W0JWm5SPkd4KXriv8: 404

Domain: unifi.illuminosi.com
Type: unauthorized
Detail: 208.70.146.4: Invalid response from http://unifi.illuminosi.com/.well-known/acme-challenge/0K4DUIFNSO5E4XzszOknolPQJoT9IadUKJ4GQzbl4FE: 404

Domain: untangle.illuminosi.com
Type: unauthorized
Detail: 208.70.146.4: Invalid response from http://untangle.illuminosi.com/.well-known/acme-challenge/RCCys6c1ivOnUIgE8_yfUdp8bJUvgdJycKFotI_UJX8: 404

Domain: unvr-1.illuminosi.com
Type: unauthorized
Detail: 208.70.146.4: Invalid response from http://unvr-1.illuminosi.com/.well-known/acme-challenge/bYjOse1STbnvs7GsulncefjzZ5hGpNxavnDA8w1lAuU: 404

Domain: www.illuminosi.com
Type: unauthorized
Detail: 208.70.146.4: Invalid response from https://www.illuminosi.com/.well-known/acme-challenge/PSPyqzlHCNYpvVNgXDNFLV24cYf8rcTNtCQYDIEVR7Q: 404

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
All done updating certificates!

My web server is (include version):
Apache 2.4.55 r17

The operating system my web server runs on is (include version):
Linux RH-
Linux 5.13.x #1 SMP Fri Jul 5 00:11:59 CST 2024 x86_64 GNU/Linux

My hosting provider, if applicable, is:
N/A
I can login to a root shell on my machine (yes or no, or I don't know):
Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No.

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
cerbot 2.9.0

2

BTW, I can mount the web server files on this machine and make them available to the auth script. Is there a way to point the http script to a specific path so that it can write the temp auth files?

3

Sure, just use --webroot -w (folder) for your Certbot options.

Certbot will write the challenge tokens to that folder. The LE Auth Server will still send the challenge to the IP in the public DNS. As long as LE gets the proper response it should be fine.

Your example command did not show the Certbot method. Were you using --apache method because that for sure won't work.

2 Likes
4

Yes, I'm currently using apache method (I think) Here's my cli.ini file:

> # Because we are using logrotate for greater flexibility, disable the
> # internal certbot logrotation.
> max-log-backups = 0
> # Adjust interactive output regarding automated renewal
> preconfigured-renewal = True
> 
> # Use a 4096 bit RSA key instead of 2048
> rsa-key-size = 4096
> 
> # Uncomment and update to register with the specified e-mail address
> email = tomf@illuminosi.com
> agree-tos = true
> authenticator = apache
> # cert-name = www.illuminosi.com
> # domain = illuminosi.com, www.illuminosi.com, mail.illuminosi.com,unifi.illuminosi.com
> deploy-hook = /etc/letsencrypt/renewal-hooks/deploy/my-deploy

So if I use the --webroot option, I can specify the path I need. That's great. How do I specify that I'm using http auth, when the apache server is not on this machine?

5

Where is the Apache server?
certbot seems to be using it for authentication:

1 Like
6

The apache server that is feeding the internet (80 & 443) is not the machine I'm running certbot on. Yes, for the moment, I have also installed apache on the client machine that will be running certbot. In an ideal world, I would not have apache on this client machine.

If I specify "authenticator = webroot" and add the "-w option, will that work?

7

Only on the system that is being reached from the Internet.

^^ on that system ^^

1 Like
8

That said, are the two systems [client and server] within the same network?

1 Like
9

Yes, they are on the same sub-net.

10

Yes, as long as the -w path is available to the Apache pointed to by the public DNS. You said there was a mounted drive shared between your Certbot machine and it. Can you use that shared drive for the -w path?

But do not manually modify the ../renewal/.. config file. Just rerun the Certbot command with certonly --webroot -w (folder) instead of --apache

2 Likes
11

I've pretty much got that all figured out and working, except for a cockpit issue of mounting the directory with write perms... Thanks for your help Mike, I really appreciate it.

2 Likes
12

Which directory?

1 Like
13

One of the remote directories housing my web files. All is done now, and it all works correctly.

2 Likes
14

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.