I need support to fix the error during the certificate issuance process using Certbot.

Hi,
I have the following domain: dpm-ticket.chichchoe.com.vn.
I ran the command: certbot --apache -d dpm-ticket.chichchoe.com.vn.

It produced the following result:
Domain: dpm-ticket.chichchoe.com.vn
Type: unauthorized
Detail: 42.119.44.217: Invalid response from http://dpm-ticket.chichchoe.com.vn/.well-known/acme-challenge/zPyJL5sIOoTv36yLnI_418Xp60r6ei1ap-qb3pyqQrI: 404

My web server is: Apache/2.4.52 (Ubuntu).
The operating system my web server is running on is Ubuntu 20.04.
I am configuring this for the Zammad app.
The zammad.conf in sites-available looks like this

I had this problem just yesterday. I used letsdebug.com website to check my website, and it shows exactly what is returning from their queries to your web server. In my case, it was cloudflare intercepting it and taking them to the "Verify You Are Human" webpage. This caused the challenge to fail. My solution was to disable cloudflare long enough to renew my certs.

The '404' means your Apache returned a 404 (Not Found) to the Let's Encrypt authorization server. The --apache option should have setup your Apache to return the correct value. But, it did not in this case.

I am confident the reason is that your VirtualHost does not have a ServerName for dpm-ticket.chichchoe.com.vn. It only has a ServerName for your local IP. Because of this Certbot could not properly configure your Apache for the challenge.

If adding a ServerAlias to that VirtualHost for your domain name does not help let us know. There are other possibilities but they are less likely. In your case Cloudflare is not involved so that cannot possibly be the solution for you :slight_smile:

3 Likes

Hello MikeMcQ,

Thank you for your support. I followed your instructions and changed the ServerName in the .conf file.

However, the issue has not yet been resolved.
I’ve ensured that the firewall allows ports 80 and 443.

I used the command: nslookup dpm-ticket.chichchoe.com.vn, and the result was as follows:

I used the command: dig A dpm-ticket.chichchoe.com.vn, and the result was as follows:

After changing the ServerName, I tried accessing the URL: http://dpm-ticket.chichchoe.com, and the web returned the following result:

1 Like

Let's check your Apache VirtualHosts in more detail. Please show output of:

sudo apache2ctl -t -D DUMP_VHOSTS
2 Likes

Hi MikeMcQ
image

Was that the entire output? Because an Apache server replies on port 443. Do you have multiple Apache servers? Or just multiple VirtualHosts?

An https request to your dpm-ticket subdomain uses a cert for your dpm-asset subdomain. There must be more involved than you are showing. Would you please explain more?

Is your dpm-asset subdomain handled by this same Apache? How did you get its certificate?

2 Likes

The issue might be as you mentioned. I have two VMware instances running different services: Snipe-IT and Zammad.

  • VMware 1: Installed Snipe-IT with Apache server, domain name dpm-asset.chichchoe.com.vn. I obtained the SSL certificate using the command: certbot --apache -d dpm-asset.chichchoe.com.vn, and it is working fine.
  • VMware 2: Installed Zammad with Apache server, domain name dpm-ticket.chichchoe.com.vn. I obtained the SSL certificate using the command: certbot --apache -d dpm-asset.chichchoe.com.vn, and it is currently not working.

Both domain names are pointing to the same WAN IP

Did you mean to type certbot --apache -d dpm-ticket.chichchoe.com.vn ? Because that is what you had in your first post.

More important, how do you ensure requests from the public internet to dpm-ticket get to the correct VM? You should setup an access log for your dpm-ticket Apache and make sure HTTP requests arrive there.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.