# How to know the location of CA to enable access to my server **URL:** \ **Category:** Help\ **Created:** [June 20, 2022, 6:15am UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733 "2022-06-20T06:15:30Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![sabinchacko](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@sabinchacko](https://community.letsencrypt.org/u/sabinchacko)\ **Post date:** [June 20, 2022, 6:15am UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733/1 "2022-06-20T06:15:30Z")
Hi, I was trying to install SSL for one of my domains. Our hosting providers allows connections only from UAE. So I asked them to enable connection from US to make it possible for certbot to access my server. After that I get this error. So it will be really helpful to get the country which I should allow access to my server to get the certificate installed. My domain is: courier.deliveryzone.ae I ran this command: > certbot --nginx certonly -d courier.deliveryzone.ae -d www.courier.deliveryzone.ae It produced this output: \> _Saving debug log to /var/log/letsencrypt/letsencrypt.log_ > _Requesting a certificate for courier.deliveryzone.ae and www.courier.deliveryzone.ae_ > > _Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:_ > > - Domain: courier.deliveryzone.ae\* > > - Type: connection\* > > - Detail: 5.195.207.140: Fetching [http://courier.deliveryzone.ae/.well-known/acme-challenge/5n2bE\_WBPY2Ihuu6WybvnHwMZ3APsOp-G\_tv\_nGDwjY:](http://courier.deliveryzone.ae/.well-known/acme-challenge/5n2bE_WBPY2Ihuu6WybvnHwMZ3APsOp-G_tv_nGDwjY:) Timeout after connect (your server may be slow or overloaded)\* > > - Domain: www.courier.deliveryzone.ae\* > > - Type: connection\* > > - Detail: 5.195.207.140: Fetching [http://www.courier.deliveryzone.ae/.well-known/acme-challenge/pxwBZs\_IfN61G2EECBD4FcjNOg5YSYKI1PAXRskL7uw:](http://www.courier.deliveryzone.ae/.well-known/acme-challenge/pxwBZs_IfN61G2EECBD4FcjNOg5YSYKI1PAXRskL7uw:) Timeout after connect (your server may be slow or overloaded)\* > > _Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet._ My web server is (include version): nginx The operating system my web server runs on is (include version): Ubuntu 20 My hosting provider, if applicable, is: Local one I can login to a root shell on my machine (yes or no, or I don't know): Yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 1.28.0 ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [June 20, 2022, 7:57am UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733/2 "2022-06-20T07:57:07Z")
Let's Encrypt uses [multi-perspective domain validation](https://letsencrypt.org/2020/02/19/multi-perspective-validation.html) from around the globe, so an exemption for just the USA (the origin of Let's Encrypt) won't be enough. It would be a better idea to globally allow requests for the path `/.well-known/acme-challenge/` which should not be a security risk (nothing should be present at that location except for validation tokens). Alternatively you might be able to use the `dns-01` challenge, if your DNS servers aren't affected by these strict rules from your hosting provider. ---
**Author:** ![sabinchacko](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@sabinchacko](https://community.letsencrypt.org/u/sabinchacko)\ **Post date:** [June 20, 2022, 8:48am UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733/3 "2022-06-20T08:48:38Z")
Thank you for your reply. I don't have any idea about how to do the dns-01 challenge. It will be helpful if there is any documentation on this one. I tried this command > certbot certonly --manual But it again asks me to put the token manually in **well-known/acme-challenge/** folder but it failed similarly then. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [June 20, 2022, 9:13am UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733/4 "2022-06-20T09:13:46Z")
> [@sabinchacko](#): > > I don't have any idea about how to do the dns-01 challenge. That really depends on your DNS provider and if it has an API to change resource records of the hosted zones. Certbot has a few DNS plugins which you can find here: [User Guide — Certbot 2.6.0 documentation](https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins) Alternatively, there are also a few third party DNS plugins available: [User Guide — Certbot 2.6.0 documentation](https://eff-certbot.readthedocs.io/en/stable/using.html#third-party-plugins) The manual plugin is documented here: [User Guide — Certbot 2.6.0 documentation](https://eff-certbot.readthedocs.io/en/stable/using.html#manual) It's HIGHLY recommended to automate issuance of certificates. The manual plugin requires scripts to make it automate issuance (and thus renewals). An ACME client with **a lot** of DNS plugins is `acme.sh`. You can find its DNS plugins here: [https://github.com/acmesh-official/acme.sh/tree/master/dnsapi](https://github.com/acmesh-official/acme.sh/tree/master/dnsapi) If `acme.sh` lists a DNS plugin for your DNS provider, but Certbot does not, you might be able to make the `acme.sh` DNS plugin compatible with the [`--manual-auth-hook` and `--manual-cleanup-hook`](https://eff-certbot.readthedocs.io/en/stable/using.html#hooks) of Certbot or switch over to `acme.sh` entirely. Note that `acme.sh` defaults to ZeroSSL as CA, although it does have an option to use Let's Encrypt as the CA using the (I believe) `--server` option. ---
**Author:** ![sabinchacko](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@sabinchacko](https://community.letsencrypt.org/u/sabinchacko)\ **Post date:** [June 20, 2022, 9:57am UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733/5 "2022-06-20T09:57:05Z")
Thank you. I have run this command > certbot certonly --manual --preferred-challenge dns and I was able to install SSL successfully after adding the txt records in dns settings. Don't know how to renew it. I will check the documents you provided. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [June 20, 2022, 10:01am UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733/6 "2022-06-20T10:01:06Z")
> [@sabinchacko](#): > > Don't know how to renew it. Note that `certbot renew` won't work with the `manual` plugin without the aformentioned hooks as you've done now. The only way to renew using this very literal manual method is to run the same command again over 60 days (and so forth). ---
**Author:** ![sabinchacko](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@sabinchacko](https://community.letsencrypt.org/u/sabinchacko)\ **Post date:** [June 20, 2022, 12:11pm UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733/7 "2022-06-20T12:11:53Z")
I am checking the documentation. My DNS provider is Hostgator and I need to figure out how to create hooks in that case. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [June 20, 2022, 2:45pm UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733/8 "2022-06-20T14:45:32Z")
> [@sabinchacko](#): > > My DNS provider is Hostgator and I need to figure out how to create hooks in that case. An alternative solution could be to use free DNS by e.g. Cloudflare and add a NS resource record for the required `_acme-challenge` label to the Cloudflare nameservers. There's a DNS plugin for Cloudflare DNS. Or use e.g. [acme-dns](https://github.com/joohoi/acme-dns), which has Certbot integration using a script. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 20, 2022, 2:45pm UTC](https://community.letsencrypt.org/t/how-to-know-the-location-of-ca-to-enable-access-to-my-server/179733/9 "2022-07-20T14:45:44Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.