I am trying to generate ssl certificates but getting error for every domains

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: support.aegyocafe.in

I ran this command:certbot --nginx -d support.aegyocafe.in

It produced this output:Requesting a certificate for cata.aegyocafe.in

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: support.aegyocafe.in
Type: unauthorized
Detail: 3.7.75.184: Invalid response from http://support.aegyocafe.in/.well-known/acme-challenge/jeXOfeVfnipgrTKoldePiG1M6xx1SoE1ndVTZk72o74: 404

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):nginx version: nginx/1.18.0 (Ubuntu)

The operating system my web server runs on is (include version):PRETTY_NAME="Ubuntu 22.04.4 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"

My hosting provider, if applicable, is:AWS

using Certbot version:certbot 2.11.0

Welcome @bharatkumar

A "404" error with the --nginx plugin is unusual.

Are you running that Certbot command on the EC2 server with that nginx system that is handling your support subdomain?

Would you show output of below command? We want to know if it matches what you have in your DNS

curl -4 https://ifconfig.io
4 Likes

the output of below command is

curl -4 https://ifconfig.io

3.7.75.184

Again facing same issue for catalogue.sassonrestaurant.in domain may be my ip address has been blocked pls unblock it.
Certificate is generated for one or two domains, after that this error starts coming for the whole day

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: support.aegyocafe.in
Type: unauthorized
Detail: 3.7.75.184: Invalid response from http://support.aegyocafe.in/.well-known/acme-challenge/jeXOfeVfnipgrTKoldePiG1M6xx1SoE1ndVTZk72o74: 404

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org . See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

pls share where i have to email for unblock ip address

Your IP is not blocked. A "404" error means you connected to Let's Encrypt. And, that the LE auth server reached you. But, your server replied with a "Not Found" instead of returning the proper auth token. If you were blocked you would have gotten a different error and much earlier.

This is unusual with the --nginx option. We will need to see your nginx config to debug this. Please post the output of below command

sudo nginx -T

An uppercase T is essential. Output will be long. If it is easier, pipe that output to a txt file and upload that file

sudo nginx -T >config.txt
6 Likes

please find the attachments here
config.txt (636.8 KB)

1 Like

Thanks. I see you have a very large number of server blocks in that nginx config.

I don't see anything wrong with your server block for this domain. But, with large nginx configs you probably need to add --sleep-seconds 3 to your Certbot command. Possibly a larger number but 3 is good first try.

Why? Certbot --nginx option makes a temp change to your nginx config. It then issues an nginx reload asynchronously. By default it just waits 1 second for this reload to finish. In your case you probably need longer.

So, try this

certbot --nginx -d support.aegyocafe.in --sleep-seconds 3

From the Certbot docs

--nginx-sleep-seconds NGINX_SLEEP_SECONDS
Number of seconds to wait for nginx configuration changes to apply when reloading. (default: 1)

3 Likes

root@proxy:/etc/nginx/conf.d# certbot --nginx -d support.aegyocafe.in --sleep-seconds 3
usage:
certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates. By default,
it will attempt to use a webserver both for obtaining and installing the
certificate.
certbot: error: unrecognized arguments: --sleep-seconds 3

Oh, sorry, the option is --nginx-sleep-seconds so

certbot --nginx -d support.aegyocafe.in --nginx-sleep-seconds 3
4 Likes

Dear MikeMc@ sir

The sleep option worked perfectly. Thank you so much for helping me!

5 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.