Having trouble with CNAME subdomain

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
the new one which I can't generate the certificate for -> nfe.penselaranja.com.br

All others work well, including other cnames (www, dev, assinaturas).penselaranja.combr

Which names would you like to activate HTTPS for?


1: eider.blog.br
2: www.eider.blog.br
3: eider.com.br
4: www.eider.com.br
5: eideroliveira.com.br
6: www.eideroliveira.com.br
7: penselaranja.com.br
8: assinaturas.penselaranja.com.br
9: dev.penselaranja.com.br
10: nfe.penselaranja.com.br
11: www.penselaranja.com.br
12: eider.photography
13: www.eider.photography
14: eideroliveira.com
15: www.eideroliveira.com
I ran this command:

certbot

It produced this output:

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: nfe.penselaranja.com.br
Type: dns
Detail: DNS problem: NXDOMAIN looking up A for nfe.penselaranja.com.br - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for nfe.penselaranja.com.br - check that a DNS record exists for this domain

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):
$ /usr/sbin/apache2 -v
Server version: Apache/2.4.52 (Ubuntu)
Server built: 2022-09-30T04:09:50

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is: self hosted

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

$ certbot --version
certbot 1.21.0

eider@website:/etc/apache2$ dig nfe.penselaranja.com.br

; <<>> DiG 9.18.1-1ubuntu1.2-Ubuntu <<>> nfe.penselaranja.com.br
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 50933
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;nfe.penselaranja.com.br. IN A

;; ANSWER SECTION:
nfe.penselaranja.com.br. 3600 IN CNAME pensealaranja.com.br.

;; AUTHORITY SECTION:
com.br. 900 IN SOA a.dns.br. hostmaster.registro.br. 2023084422 1800 900 604800 900

;; Query time: 680 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Sat Mar 25 10:36:19 PDT 2023
;; MSG SIZE rcvd: 142

Hello @eider, welcome to the Let's Encrypt community. :slightly_smiling_face:

Using Let's Debug yields these results https://letsdebug.net/nfe.penselaranja.com.br/1421023

NoRecords
Fatal
No valid A or AAAA records could be ultimately resolved for nfe.penselaranja.com.br. This means that Let's Encrypt would not be able to connect to your domain to perform HTTP validation, since it would not know where to connect to.
No A or AAAA records found. 
1 Like

Using this online tool https://unboundtest.com/ yields results https://unboundtest.com/m/CAA/nfe.penselaranja.com.br/Z7VS4SYO

This is the DNS CNAME Record
nfe.penselaranja.com.br. 0 IN CNAME pensealaranja.com.br.

Query results for CAA nfe.penselaranja.com.br

Response:
;; opcode: QUERY, status: NXDOMAIN, id: 28173
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;nfe.penselaranja.com.br.	IN	 CAA

;; ANSWER SECTION:
nfe.penselaranja.com.br.	0	IN	CNAME	pensealaranja.com.br.

;; AUTHORITY SECTION:
com.br.	0	IN	SOA	a.dns.br. hostmaster.registro.br. 2023084426 1800 900 604800 900

----- Unbound logs -----
Mar 25 17:47:15 unbound[848128:0] notice: init module 0: validator
1 Like

This definitely odd. I was able to obtain an A record from the canonical name.

3 Likes

I think I found the very, very stupid mistake I made:

nfe.penselaranja.com.br. 0 IN CNAME pensealaranja.com.br.

I added an extra 'a' into the CNAME record. Duh!!!!

5 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.