All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/moneytime.wattstelesales.com/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you’re using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
My operating system is (include version):
NAME="openSUSE Leap"
VERSION="42.1"
VERSION_ID="42.1"
PRETTY_NAME="openSUSE Leap 42.1 (x86_64)"
ID=opensuse
My web server is (include version):
Apache/2.4.23 (Linux/SUSE)
My hosting provider, if applicable, is:
N/A
I can login to a root shell on my machine (yes or no, or I don’t know):
yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The DNS A Record is correctly pointing to the server’s public IP address, there’s no firewall (except the server’s own iptables, which is set to allow both port 80 and 443). Browsing to the subdomain in chrome for both http and https works (http redirects to https, though, as per the original setup with letsencrypt)
The cert is now expired, but was working correctly before it expired…
Yes, there's a request from a validation server hosted by Let's Encrypt. That's necessary in order to demonstrate domain ownership.
Let's Encrypt doesn't publish a set of IP addresses for validation as it is bound to change. It's possible that validation requests will be sent from multiple, unpredictable IPs in the future, in order to make it harder to spoof validation requests. If you'd like to use the webroot plugin, your domain would have to be publicly available.
As an alternative, you can use a challenge type called DNS-01 that works using TXT records that you need to add to your DNS. This is currently not supported by certbot, but a number of other clients such as the bash clients or lego do support this.
Not sure if you still had that rule up when I tested it, but I still get a timeout. I would recommend testing connectivity via some other network before attempting renewal, to verify your changes are working. You could use a VPS somewhere, or go through Tor.
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/moneytime.wattstelesales.com/fullchain.pem
Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/moneytime.wattstelesales.com/fullchain.pem (success)