# Ispconfig 3.2 self-signed certificate
**URL:** https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904
**Category:** Help
**Created:** [June 1, 2021, 8:14am UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904 "2021-06-01T08:14:33Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@barbara2](https://community.letsencrypt.org/u/barbara2)
#### Post date: [June 1, 2021, 8:14am UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/1 "2021-06-01T08:14:33Z")
Hi,
My domain is:
[gliese.net4wing.com](http://gliese.net4wing.com)
I ran this command: when I create new ISPConfig SSL certificate during installation
It produced this output:
Checking / creating certificate for [gliese.net4wing.com](http://gliese.net4wing.com)
Using certificate path /etc/letsencrypt/live/gliese.net4wing.com
Using apache for certificate validation
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for [gliese.net4wing.com](http://gliese.net4wing.com)
Using the webroot path /usr/local/ispconfig/interface/acme for all unmatched domains.
Waiting for verification...
Challenge failed for domain [gliese.net4wing.com](http://gliese.net4wing.com)
http-01 challenge for [gliese.net4wing.com](http://gliese.net4wing.com)
Cleaning up challenges
Some challenges have failed.
Issuing certificate via certbot failed. Please check log files and make sure that your hostname can be verified by letsencrypt
Could not issue letsencrypt certificate, falling back to self-signed.
My web server is (include version):
Server version: Apache/2.4.41 (Ubuntu)
Server built: 2020-08-12T19:46:17
Server's Module Magic Number: 20120211:88
Server loaded: APR 1.6.5, APR-UTIL 1.6.1
Compiled using: APR 1.6.5, APR-UTIL 1.6.1
Architecture: 64-bit
Server MPM: prefork
threaded: no
forked: yes (variable process count)
Server compiled with....
-D APR\_HAS\_SENDFILE
-D APR\_HAS\_MMAP
-D APR\_HAVE\_IPV6 (IPv4-mapped addresses enabled)
-D APR\_USE\_SYSVSEM\_SERIALIZE
-D APR\_USE\_PTHREAD\_SERIALIZE
-D SINGLE\_LISTEN\_UNSERIALIZED\_ACCEPT
-D APR\_HAS\_OTHER\_CHILD
-D AP\_HAVE\_RELIABLE\_PIPED\_LOGS
-D DYNAMIC\_MODULE\_LIMIT=256
-D HTTPD\_ROOT="/etc/apache2"
-D SUEXEC\_BIN="/usr/lib/apache2/suexec"
-D DEFAULT\_PIDLOG="/var/run/apache2.pid"
-D DEFAULT\_SCOREBOARD="logs/apache\_runtime\_status"
-D DEFAULT\_ERRORLOG="logs/error\_log"
-D AP\_TYPES\_CONFIG\_FILE="mime.types"
-D SERVER\_CONFIG\_FILE="apache2.conf"
The operating system my web server runs on is (include version):
lsb\_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.2 LTS
Release: 20.04
Codename: focal
My hosting provider, if applicable, is: [amen.fr](http://amen.fr)
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): ispconfig
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 0.40.0
Here letsencrypt last logs:
Domain: [gliese.net4wing.com](http://gliese.net4wing.com)
Type: connection
Detail: Fetching [http://gliese.net4wing.com/.well-known/acme-challenge/WxcI6psy](http://gliese.net4wing.com/.well-known/acme-challenge/WxcI6psy)!
To fix these errors, please make sure that your domain name was entered correct!
2021-06-01 10:07:18,801:DEBUG:certbot.error\_handler:Encountered exception:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certbot/auth\_handler.py", line 91, in ha!
self.\_poll\_authorizations(authzrs, max\_retries, best\_effort)
File "/usr/lib/python3/dist-packages/certbot/auth\_handler.py", line 180, in \_!
raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.
2021-06-01 10:07:18,801:DEBUG:certbot.error\_handler:Calling registered functions
2021-06-01 10:07:18,801:INFO:certbot.auth\_handler:Cleaning up challenges
2021-06-01 10:07:18,802:DEBUG:certbot.plugins.webroot:Removing /usr/local/ispco!
2021-06-01 10:07:18,802:DEBUG:certbot.plugins.webroot:All challenges cleaned up
2021-06-01 10:07:18,803:DEBUG:certbot.log:Exiting abnormally:
Traceback (most recent call last):
File "/usr/bin/letsencrypt", line 11, in
load\_entry\_point('certbot==0.40.0', 'console\_scripts', 'certbot')()
File "/usr/lib/python3/dist-packages/certbot/main.py", line 1382, in main
return config.func(config, plugins)
File "/usr/lib/python3/dist-packages/certbot/main.py", line 1265, in certonly
lineage = _get\_and\_save\_cert(le\_client, config, domains, certname, lineage)
File "/usr/lib/python3/dist-packages/certbot/main.py", line 121, in get\_and!
lineage = le\_client.obtain\_and\_enroll\_certificate(domains, certname)
File "/usr/lib/python3/dist-packages/certbot/client.py", line 417, in obtain_!
cert, chain, key, \_ = self.obtain\_certificate(domains)
File "/usr/lib/python3/dist-packages/certbot/client.py", line 348, in obtain\_!
orderr = self.\_get\_order\_and\_authorizations(csr.data, self.config.allow\_sub!
File "/usr/lib/python3/dist-packages/certbot/client.py", line 396, in \_get\_or!
authzr = self.auth\_handler.handle\_authorizations(orderr, best\_effort)
File "/usr/lib/python3/dist-packages/certbot/auth\_handler.py", line 91, in ha!
self.\_poll\_authorizations(authzrs, max\_retries, best\_effort)
File "/usr/lib/python3/dist-packages/certbot/auth\_handler.py", line 180, in \_!
raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.
Thank you for any suggestions
---
### Author:  [@webprofusion](https://community.letsencrypt.org/u/webprofusion)
#### Post date: [June 1, 2021, 9:35am UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/2 "2021-06-01T09:35:53Z")
I'd suggest updating your version of certbot first, various things have changed since certbot 0.4 (Feb 2016).
---
### Author:  [@hebbet](https://community.letsencrypt.org/u/hebbet)
#### Post date: [June 1, 2021, 11:49am UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/3 "2021-06-01T11:49:38Z")
switch to snapd version of certbot.
> **[Certbot - Ubuntufocal Apache](https://certbot.eff.org/lets-encrypt/ubuntufocal-apache)**
>
> Automatically enable HTTPS on your website with EFF's Certbot, deploying Let's Encrypt certificates.
or install acme.sh, which is also supported by ispconfig 3.2.
---
### Author:  [@barbara2](https://community.letsencrypt.org/u/barbara2)
#### Post date: [June 1, 2021, 12:47pm UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/4 "2021-06-01T12:47:44Z")
Hi, thank you both for your help,
I updated certbot (now 1.15.0) via snapd
But after the force update with ispconfig 3.2, asking for a new ssl certificate, I got the same error and therefore a self-signed certificate:
http-01 challenge for [gliese.net4wing.com](http://gliese.net4wing.com)
Using the webroot path /usr/local/ispconfig/interface/acme for all unmatched domains.
Waiting for verification...
Challenge failed for domain [gliese.net4wing.com](http://gliese.net4wing.com)
http-01 challenge for [gliese.net4wing.com](http://gliese.net4wing.com)
Cleaning up challenges
**Some challenges have failed**.
**Issuing certificate via certbot failed**. Please check log files and make sure that your hostname can be verified by letsencrypt
Could not issue letsencrypt certificate, falling back to self-signed.
Other ideas?
---
### Author:  [@barbara2](https://community.letsencrypt.org/u/barbara2)
#### Post date: [June 1, 2021, 1:48pm UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/5 "2021-06-01T13:48:40Z")
I add that the log says:
Domain: [gliese.net4wing.com](http://gliese.net4wing.com)
Type: connection
Detail: Fetching [http://gliese.net4wing.com/.well-known/acme-challenge/wmwKpxlDerWjKqweaimLalrp-oJDKRNAHR2SV84XnDY:](http://gliese.net4wing.com/.well-known/acme-challenge/wmwKpxlDerWjKqweaimLalrp-oJDKRNAHR2SV84XnDY:) **Connection refused**
To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address. !
2021-06-01 15:12:31,505:DEBUG:certbot.\_internal.error\_handler:Encountered exception...
Record A is ok - port 80 and 443 are open and I can read the file inside acme-challenge through the browser:
[http://gliese.net4wing.com/.well-known/acme-challenge/empty.dir](http://gliese.net4wing.com/.well-known/acme-challenge/empty.dir)
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [June 1, 2021, 2:30pm UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/6 "2021-06-01T14:30:28Z")
~~Is there some GEO-Location type blocking in line?~~
I have access to it now.
Please place a test text file (without any extension, nor period, in the name) in that challenge location.
Also, please show the output of:
`sudo apachectl -S`
---
### Author:  [@barbara2](https://community.letsencrypt.org/u/barbara2)
#### Post date: [June 1, 2021, 4:18pm UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/7 "2021-06-01T16:18:11Z")
Hi, thank you,
so I put a textfile here
[http://gliese.net4wing.com/.well-known/acme-challenge/testtext](http://gliese.net4wing.com/.well-known/acme-challenge/testtext)
below the output of `sudo apachectl -S`
#apachectl -S
AH00548: NameVirtualHost has no effect and will be removed in the next release /etc/apache2/sites-enabled/000-ispconfig.vhost:7
VirtualHost configuration:
\*:8081 [gliese.net4wing.com](http://gliese.net4wing.com) (/etc/apache2/sites-enabled/000-apps.vhost:9)
\*:8080 [gliese.net4wing.com](http://gliese.net4wing.com) (/etc/apache2/sites-enabled/000-ispconfig.vhost:9)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex proxy: using\_defaults
Mutex ssl-cache: using\_defaults
Mutex default: dir="/var/run/apache2/" mechanism=default
Mutex mpm-accept: using\_defaults
Mutex fcgid-pipe: using\_defaults
Mutex authdigest-opaque: using\_defaults
Mutex watchdog-callback: using\_defaults
Mutex rewrite-map: using\_defaults
Mutex ssl-stapling-refresh: using\_defaults
Mutex authdigest-client: using\_defaults
Mutex fcgid-proctbl: using\_defaults
Mutex ssl-stapling: using\_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP\_VHOSTS
Define: DUMP\_RUN\_CFG
Define: MODPERL2
Define: ENABLE\_USR\_LIB\_CGI\_BIN
User: name="www-data" id=33
Group: name="www-data" id=33
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [June 1, 2021, 5:17pm UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/8 "2021-06-01T17:17:12Z")
This name duplication may be confusion `certbot`:
> [@barbara2](#):
>
> \*:8081 [gliese.net4wing.com](http://gliese.net4wing.com) (/etc/apache2/sites-enabled/000-apps.vhost:9)
> \*:8080 [gliese.net4wing.com](http://gliese.net4wing.com) (/etc/apache2/sites-enabled/000-ispconfig.vhost:9)
Q1. What was the complete `certbot` command you ran?
Q2. To which ports are the external 80 and 443 forwarding to?
---
### Author:  [@barbara2](https://community.letsencrypt.org/u/barbara2)
#### Post date: [June 1, 2021, 6:41pm UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/9 "2021-06-01T18:41:35Z")
As concerns the duplication, I'm using ispconfig 3.2: 8080 is the ispconfig panel; 8081 is the webmail (roundcube)
Q1. I don't know which is the command as it's ipconfig force update which manage letsencrypt
Q2. 80 goes to 80 and 443 goes to 443
---
### Author:  [@barbara2](https://community.letsencrypt.org/u/barbara2)
#### Post date: [June 2, 2021, 4:50pm UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/10 "2021-06-02T16:50:40Z")
Hi,
I eventually rebuilt the machine from scratch and everything went smoothly.
At the first attempt I had two-three problems:
1. I missed the A record
2. the port 80 was closed
3. (maybe) file hosts missing the external IP
I fixed all the issues on the go and then run the ispconfig\_update.sh (many times), with no result (always "Connection refused" in the log).
The impression is that after the first failure, the ispconfig force update for some reason couldn't succeed in releasing the certificate.
[Cisco Bug: CSCvt34984 - ACME certificate signing failing (connection refused) if initially not correctly set up](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvt34984)
Hope this is helpful to whoever has the same problem.
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [July 2, 2021, 4:51pm UTC](https://community.letsencrypt.org/t/ispconfig-3-2-self-signed-certificate/152904/11 "2021-07-02T16:51:40Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.