Having trouble verifying new domain

[Ununoctium117]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: fumo.website

I ran this command:
# certbot certonly --dry-run --webroot -w /var/www/fumosite -d fumo.website -vvvvvvv --debug-challenges >stdout 2>&1

It produced this output:
There’s a lot, so I put it in a pastebin. I can post the content as a reply/edit here if it’s preferred: https://pastebin.com/z7Cs5dHG

My web server is (include version): nginx 1.10.3 (Ubuntu)

The operating system my web server runs on is (include version): Ubuntu 16.04

My hosting provider, if applicable, is: DigitalOcean, but I’m not using any of their hosting services

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): 0.31.0

Using --debug-challenges when I’m not redirecting stdout, I can navigate to fumo.website/.well-known/acme-challenge/ and download the challenge binary from my browser (on a different machine), so I know it’s actually being served correctly. But, for some reason, the remote server is getting a 404 when trying to download the content.

[_az]

This is an IPv6 misconfiguration.

When visiting your site via its IPv4 address, everything is OK:

$ curl -X GET -I -4 fumo.website
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)

Over IPv6, it’s going to the default virtualhost:

$ curl -X GET -I -6 fumo.website
HTTP/1.1 404 Not Found
Server: nginx/1.10.3 (Ubuntu)

You will want to open up your nginx configuration, find the listen directive, and make sure the virtualhost is bound to both interfaces like:

listen 80;
listen [::]:80;

and reload nginx.

[freessltools.com]

@_az
You’d probably be able to answer this better than I: How would it be possible to download the challenge file if it was cleaned up?

[JimPas]

@Ununoctium117, Before you do wrap things up, you have mixed content on your site. Image(s) s with http URLs instead of https. You’ll have to correct those links also.

[_az]

--debug-challenges is a relatively unknown flag which causes Certbot to pause before it submits the challenge response to the ACME server.

It allows you, for a moment, to see what changes Certbot has made to your system, such as files written to webroot, or changes made to nginx/Apache configuration.

[freessltools.com]

Ah. I noticed the warning about using non-interactive and so wondered how.

[_az]

You are right. With the command in OP's post forcing non-interactivity, Certbot wouldn't pause. But:

@Ununoctium117

Using --debug-challenges when I’m not redirecting stdout

[freessltools.com]

Makes sense. I’m pretty fluent with the certification process, but not with certbot’s idiosyncrasies.

[Ununoctium117]

Perfect, thank you everyone. The advice about IPv6 being misconfigured was spot-on. I’ll also be sure to clean up my http image links