Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: panel.prolazer.net
Type: dns
Detail: DNS problem: looking up A for panel.prolazer.net: DNSSEC: RRSIGs Missing; no valid AAAA records found for panel.prolazer.net
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
My web server is (include version):
The operating system my web server runs on is (include version):
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
ReservedAddress
FATAL
A private, inaccessible, IANA/IETF-reserved IP address was found for panel.prolazer.net. Let's Encrypt will always fail HTTP validation for any domain that is pointing to an address that is not routable on the internet. You should either remove this address and replace it with a public one or use the DNS validation method instead.
192.168.0.103
You need to use a Public facing Internet IP Address.
To help in finding your Public facing Internet IP Address
NoRecords
FATAL
No valid A or AAAA records could be ultimately resolved for panel.prolazer.net. This means that Let's Encrypt would not be able to connect to your domain to perform HTTP validation, since it would not know where to connect to.
No A or AAAA records found.
You need to update the DNS to have an A or AAAA records.
Now it looks like there is a router and/or firewall filtering (i.e. blocking) Ports 80 & 443.
$ nmap -Pn -p80,443 panel.prolazer.net
Starting Nmap 7.80 ( https://nmap.org ) at 2024-03-04 22:36 UTC
Nmap scan report for panel.prolazer.net (172.117.186.167)
Host is up.
rDNS record for 172.117.186.167: 172-117-186-167.res.spectrum.com
PORT STATE SERVICE
80/tcp filtered http
443/tcp filtered https
Nmap done: 1 IP address (1 host up) scanned in 3.30 seconds
ANotWorking
ERROR
panel.prolazer.net has an A (IPv4) record (172.117.186.167) but a request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address.
A timeout was experienced while communicating with panel.prolazer.net/172.117.186.167: Get "http://panel.prolazer.net/.well-known/acme-challenge/letsdebug-test": context deadline exceeded
Trace:
@0ms: Making a request to http://panel.prolazer.net/.well-known/acme-challenge/letsdebug-test (using initial IP 172.117.186.167)
@0ms: Dialing 172.117.186.167
@10001ms: Experienced error: context deadline exceeded
IssueFromLetsEncrypt
ERROR
A test authorization for panel.prolazer.net to the Let's Encrypt staging service has revealed issues that may prevent any certificate for this domain being issued.
172.117.186.167: Fetching http://panel.prolazer.net/.well-known/acme-challenge/IwF8aot2M-sjHJJS6Emw4at5_bEYZhj4KTyx_RkXER4: Timeout during connect (likely firewall problem)
rDNS record for 172.117.186.167: 172-117-186-167.res.spectrum.com
@lazer00 You should contact Spectrum and make sure port 80 is not blocked by them. Some residential ISP block that port (and sometimes others).
Otherwise, as @Bruce5051 has pointed out many times you have some connectivity problem from the public internet to your server. Use the https://letsdebug.net test site to check changes you make.
You could also try using a mobile phone with wifi disabled so using your carrier's public internet connection to try to reach your domain. This or Let's Debug are good ways to test new setups.
If Spectrum is blocking port 80 but does not block port 443 you could try getting a cert using a DNS Challenge. But, these are more difficult to setup especially for novices. Getting a cert this way would avoid problems with port 80 and allow use of HTTPS on port 443 (or any other port Spectrum allows).
Now Port 443 is still filtered, however if you only need HTTPS for your local network that would be expected.
$ nmap -Pn -p80,443 panel.prolazer.net
Starting Nmap 7.80 ( https://nmap.org ) at 2024-03-05 00:07 UTC
Nmap scan report for panel.prolazer.net (172.117.186.167)
Host is up (0.43s latency).
rDNS record for 172.117.186.167: 172-117-186-167.res.spectrum.com
PORT STATE SERVICE
80/tcp open http
443/tcp filtered https
Nmap done: 1 IP address (1 host up) scanned in 5.43 seconds
