google chrome download the file with no timeout . and when i do the validation i get
Timeout during connect (likely firewall problem) .
and in the letsencript.log :
{
"identifier": {
"type": "dns",
"value": "quranreading.app"
},
"status": "invalid",
"expires": "2023-05-24T11:26:31Z",
"challenges": [
{
"type": "http-01",
"status": "invalid",
"error": {
"type": "urn:ietf:params:acme:error:connection",
"detail": "91.170.249.179: Fetching http://quranreading.app/.well-known/acme-challenge/GU9GC-bZ-JMXSTk00gQposH_ODpn6XRvpLBNR1_cChA: Timeout during connect (likely firewall problem)",
"status": 400
},
"url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/6520024264/rajOKg",
"token": "GU9GC-bZ-JMXSTk00gQposH_ODpn6XRvpLBNR1_cChA",
"validationRecord": [
{
"url": "http://quranreading.app/.well-known/acme-challenge/GU9GC-bZ-JMXSTk00gQposH_ODpn6XRvpLBNR1_cChA",
"hostname": "quranreading.app",
"port": "80",
"addressesResolved": [
"91.170.249.179"
],
"addressUsed": "91.170.249.179"
}
],
"validated": "2023-05-17T11:26:31Z"
}
]
}```
My domain is: quranreading.app
I ran this command:
certbot certonly --webroot -w /home/akli/Documents/quranreadingapp --dry-run -d quranreading.app
or certbot certonly --dry-run --manual -d quranreading.app
It produced this output:
My web server is (include version): nginx
The operating system my web server runs on is (include version):
fresh debian 11
My hosting provider, if applicable, is:
at home
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 1.12.0
Your domain must be reachable on the public Internet I believe you have some sort of firewall blocking access. I cannot reach it with various tools on the public Internet. when you tested it with chrome was that from your own private network?
i have found this sites that do some external checks
and this one
they both report a problem to get file from http://quranreading.app/.well-known/acme-challenge/...
but i don't understand the problem i am just behid the router of the fai . and i enable a dmz in direction of the server. me i am on another pc on the same network.
Do you have a mobile phone you could try? Turn off Wi-fi so you use your provider's public Internet connection and see if you can connect to your domain that way
if i try to access while looking at the tcp dump there is just two coms that happen after 15s after loading the website
sudo tcpdump -i enp0s31f6 port 80
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on enp0s31f6, link-type EN10MB (Ethernet), snapshot length 262144 bytes
10:36:45.986569 IP 192.168.1.254.58638 > 192.168.1.15.http: Flags [.], ack 3288506695, win 501, options [nop,nop,TS val 3192663785 ecr 3283457494], length 0
10:36:45.986598 IP 192.168.1.15.http > 192.168.1.254.58638: Flags [.], ack 1, win 505, options [nop,nop,TS val 3283502581 ecr 3192618753], length 0
i only have the possibility to do a dmz because strangely/commercially they only accept redirection of port for port above 32000 otherwise we must pay for a 'ungrouped fiber'. it's the biggest fai in France
edit: my quranreading.app in sites-available :
server {
listen 80 default_server;
listen [::]:80 default_server;
root /home/akli/Documents/quranreadingapp;
server_name quranreading.app;
index index.html;
}
nginx is running of course
but how to explain that i can access quranreading.app or 91.170.249.179 from my home network and not externally ? !!
edit: maybe the router that answere the dns query so this is why i can go to quranreading.app and believe that all is ok
Presently I am seeing Ports 80 & 443 are filtered.
$ nmap -Pn -p80,443 quranreading.app
Starting Nmap 7.80 ( https://nmap.org ) at 2023-05-17 15:35 UTC
Nmap scan report for quranreading.app (91.170.249.179)
Host is up.
Other addresses for quranreading.app (not scanned): 2a01:e0a:2be:6ce0::1
rDNS record for 91.170.249.179: 91-170-249-179.subs.proxad.net
PORT STATE SERVICE
80/tcp filtered http
443/tcp filtered https
Nmap done: 1 IP address (1 host up) scanned in 3.34 seconds
ok i have found that the isp has changed his way of managing ips : due to the lack of ipv4 addresses the ISP shares the ips for 4 subscribers by dividing the ports into 4 slices. to have a "full stack ip" as say call it you have to ask for it, it's free. i am waiting 30 min as asked by the isp , make it work and i will close the topic if it work . thank you @MikeMcQ@Bruce5051
% correct. 