Hi, I'm unable to get a certificate (problems started with cert renewal, I tried literally everything, from adding a location in nginx configuration, to purging/reinstalling certbot and creating new domain with whole new configuration). Strangely, when I was debugging what's happening with certbot I even managed to get the response on the challenge url (with the correct string), but acme challenge was failing with 403 response status.
My domain is:
filok.ml
I ran this command:
certbot certonly -v --dry-run --nginx -d filok.ml
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Simulating a certificate request for filok.ml
Performing the following challenges:
http-01 challenge for filok.ml
Waiting for verification...
Challenge failed for domain filok.ml
http-01 challenge for filok.ml
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: filok.ml
Type: unauthorized
Detail: Invalid response from filok.ml [195.20.53.96]: " \n \n filok.ml\n <meta http-equiv="refresh" content="1; URL=http://domain.dot.tk/p/?d=FILOK.ML&i"
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version):
nginx/1.18.0
The operating system my web server runs on is (include version):
Ubuntu 20.04.2 LT
My hosting provider, if applicable, is:
my vps
I can login to a root shell on my machine (yes or no, or I don't know):
yes
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 1.16.0
snippet of the letsencrypt log:
2021-06-17 13:22:07,778:DEBUG:acme.client:Received response: HTTP 200
Server: nginx
Date: Thu, 17 Jun 2021 11:22:07 GMT
Content-Type: application/json
Content-Length: 1196
Connection: keep-alive
Boulder-Requester: 19938934
Cache-Control: public, max-age=0, no-cache
Link: https://acme-staging-v02.api.letsencrypt.org/directory;rel="index"
Replay-Nonce: 0002PrLuxjRn2g8L7B7qfMkuUBkRWj4LR9Fcb3IQ2cdpBO0
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
"identifier": {
"type": "dns",
"value": "filok.ml"
},
"status": "invalid",
"expires": "2021-06-24T11:22:04Z",
"challenges": [
{
"type": "http-01",
"status": "invalid",
"error": {
"type": "urn:ietf:params:acme:error:unauthorized",
"detail": "Invalid response from filok.ml [195.20.53.96]: "\u003chtml\u003e \n \u003chead\u003e\n \u003cti
tle\u003efilok.ml\u003c/title\u003e\n \u003cmeta http-equiv=\"refresh\" content=\"1; URL=http://domain.dot.tk/p/?d=FILOK.ML\u0026i"",
"status": 403
},
"url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/70248474/r3msbA",
"token": "HSIlg4B0wtA7850Vlssnanzzq3TAHc3Knbi5VtsFVrc",
"validationRecord": [
{
"url": "filok.ml",
"hostname": "filok.ml",
"port": "80",
"addressesResolved": [
"195.20.53.96"
],
"addressUsed": "195.20.53.96"
}
],
"validated": "2021-06-17T11:22:06Z"
}
]
}
