Help No valid IP address found:

Hello all,

Please forgive my ignorance if this has been asked already. I’m a noob and am need some help.

I have a web server with an internal IP address that’s NAT’d at the router, I am using Dnydns since I don’t have a static IP. All works well there, I am setting up a mail server running VMware off of my server, giving it a different internal IP, again all good. My problem is when trying to get a cert I get the error below.

My domain is:

I ran this command: sudo certbot certonly --webroot --agree-tos --email -d -w /var/www/html/

It produced this output: Domain:
Type: connection
Detail: unknownHost :: No valid IP addresses found for

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you’re using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.

My web server is (include version): I’m running my web server on Mac OS 10.14.5

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

Hi @jgrant

there are some older checks of your main domain ( ):

There you see: You have a valid ipv4 - address:

Host T IP-Address is auth. ∑ Queries ∑ Timeout A
Meridian/Idaho/US yes 5 4
AAAA yes C yes 1 0
Meridian/Idaho/US yes

But checking your mail - subdomain ( ):

Host T IP-Address is auth. ∑ Queries ∑ Timeout A yes 1 0
AAAA yes Name Error yes 1 0

There is no ip address defined.

So Letsencrypt can't check that domain.

Add an A entry, perhaps the same your main domain uses.

1 Like

Thanks, Juergen

I just added an “A” record for I’ll see if that helps. Much appreciated!!

After applying the to an A record, i get the error below.

Any suggestions?

Type: unauthorized
Detail: Invalid response from
[]: “\n\n404 Not

Not Found


Read the output of your last check -

Domainname Http-Status redirect Sec. G 302 0.350 E 200 1.953 N
Certificate error: RemoteCertificateNameMismatch 200 1.946 A 302 0.350 E
Visible Content: Found The document has moved here . 404 1.614 A
Not Found
Visible Content: Not Found The requested URL /.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de was not found on this server.

Looks like you don't have defined an own port 80 vHost. So the standard port 80 vHost is used. There is a redirect to your main domain. But there isn't the validation file /.well-known/acme-challenge/random-filename.

So copy your existing vHost definition, change the ServerName and remove the redirect http -> https.

Perhaps add a DocumentRoot and use that.

My apologies,

Can you help me understand what you are saying?

On my mail.abovethegaragestudio server, i have Port 80 open,

You mentioned something about a redirect – can you explain? If i try to understand, i think you are saying on my web server i should have a /.well-known/acme-challenge/random-filename?

lastly, copy “vHost definition”?

You have a vHost definition file (virtualHost). Check your Apache config

|-- apache2.conf
|       `--  ports.conf
|-- mods-enabled
|       |-- *.load
|       `-- *.conf
|-- conf-enabled
|       `-- *.conf
|-- sites-enabled
|       `-- *.conf

in sites-enabled.

There you may have a config file of your main domain. Copy that and change it to your mail-subdomain.

And your check says: There is a redirect, that can't work with your subdomain. So remove that redirect in your copied file.

No. Please start with some basics:

Then read something about challenges:

thank you Juergen, i’ll let you know how it works out.

1 Like

On my web server in /etc/apache2/ i have an httpd.conf file and i have an /extra folder with a httpd.vhost.conf file.

do i copy the httpd.conf file to my VMware running my mail server in the same location /etc/apache2 ?

I could really use some help. I really don’t understand what’s happening.

my shell command:
certbot certonly --webroot --agree-tos --email -d -w /var/www/html/

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for
Using the webroot path /var/www/html for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from []: “\n\n404 Not Found\n\n

Not Found



If you use webroot and if you have that error message, your webroot is wrong.

What you have:
1 IP address
1 computer (real or virtual) with Apache
1 computer (real or virtual) with a ‘mail server’. Does this mean something you connect to with smtp, on port 25, to accept mails from the Internet ? Well, you created a MX record for the domain that points to the server, so I guess the answer is yes.

This does not seem very logical to me. There is no need for a specific ‘mail server’ at the Internet level, since all you are doing is redirecting ports on your Internet router.
You could have a domain with 2 A records ( and, and a MX record =
It would all appear as a single server on the Internet, but at the router level you would have a redirection to the port 25 of your mail computer and to the 80 and 443 ports of the Apache computer.
In this case you don’t need anything like a on your certificate.

On the other hand, if you need Web access from the Internet to your mail computer (if it’s say, an Exchange server) you would need indeed an Internet mail server appearing with a different name, but you would need also to setup things differently since a simple redirection would not work, a http proxy would be necessary.

If for some mysterious reason you still want a yet only need the port 25 on your internal mail server, it’s possible but you have to manage the transfert of the certificate yourself, using a post hook. The one and only web server you have in this case, the Apache server, would have to get the 2 certificates while pretending to be the mail server, and it would be transferred by some copy (sftp or anything like that) to the internal mail server, that can’t get the certificate itself since it don’t answer to port 80 on the Internet (you are redirecting the port 80 from your router to the Apache server)
Hope I am not confusing you further :slight_smile:


Thank you for the feedback, I really don’t need mail at the internet level. So I will try the first suggestion in your email.


What is the purpose of having to A records as listed in your email? Wouldn’t a cname work the same for and still have the MX record = and route port 25 to the internal mail server?

For my web server I have a certificate from SSL, is this going to work with the above?

Thanks for the help :+1:t3:

Yes, of course CNAME record is the preferred way to setup a www. It’s just that you don’t have a lot of records really so updates are hardly a burden.
MX record should point to A record, in this case

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.