Manual renew: Certbot failed to authenticate [but links okay?]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: artprocess.org (and others in command)

I ran this command: sudo certbot certonly --cert-name artprocess.org --manual -d '.artprocess.org' -d artprocess.org -d '.justatest.com' -d justatest.com -d '.artprocess.com' -d artprocess.com -d '.artprocess.net' -d artprocess.net -d '.justatest.org' -d justatest.org -d '.justatest.ie' -d justatest.ie -d '*.alternativeart.org' -d alternativeart.org --email jp@justatest.com

It produced this output:

My web server is (include version): tomcat 10.1.28

The operating system my web server runs on is (include version): Linux (Ubuntu 20.04.6 LTS)

My hosting provider, if applicable, is: Linode

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 3.3.0

Manual renewal fails because of extra colon ":" in links e.g.:
Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: alternativeart.org
Type: connection
Detail: 172.105.67.175: Fetching http://alternativeart.org/.well-known/acme-challenge/OJOSSQHWeLy_dfu9ubHlM8UCe_GSe60xAc5uJYImUf8: Connection refused

The setup instructed me to create the file: OJOSSQHWeLy_dfu9ubHlM8UCe_GSe60xAc5uJYImUf8

but the check at the end by the system looks for:
OJOSSQHWeLy_dfu9ubHlM8UCe_GSe60xAc5uJYImUf8:
(that has an extra : at the end of the filename)

I've renewed my certificate this way for years now and this is the first time I've encountered this issue.

So I ran the command again and created a file with a colon at the end but it still fails despite the links in the error message actually working:

Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: alternativeart.org
Type: connection
Detail: 172.105.67.175: Fetching http://alternativeart.org/.well-known/acme-challenge/mCKWjDegrvlPP92NGQOpjZ2JNKnUACd7zrVzX1tLF8A: Connection refused

Domain: artprocess.com
Type: connection
Detail: 172.105.67.175: Fetching http://artprocess.com/.well-known/acme-challenge/9tqGFwzIhh-qPglmnp7PYWz2278rpv7yrXCWMDQulkQ: Connection refused

Domain: artprocess.net
Type: connection
Detail: 172.105.67.175: Fetching http://artprocess.net/.well-known/acme-challenge/_NJ1D_TtJDgEPZQuuWAGam9tDaG24_bJ3aFE-e_68ig: Connection refused

Domain: artprocess.org
Type: connection
Detail: 172.105.67.175: Fetching http://artprocess.org/.well-known/acme-challenge/gADi6jV5cwM7muElpCk1bd8LcVti_UnOx98_mAIfDws: Connection refused

Domain: justatest.com
Type: connection
Detail: 172.105.67.175: Fetching http://justatest.com/.well-known/acme-challenge/UKU-ZLtDFTWdyktX_kg23LaAGtRvn9qq7R1gJdFSde0: Connection refused

Domain: justatest.ie
Type: connection
Detail: 172.105.67.175: Fetching http://justatest.ie/.well-known/acme-challenge/rLQZBLj4c1sB8C6rPycAHJ4QE5ShhldXQEMmMRVmPE8: Connection refused

Domain: justatest.org
Type: connection
Detail: 172.105.67.175: Fetching http://justatest.org/.well-known/acme-challenge/b9xEbnNd54HhsUurP7zdinzeaYAG3PmZt0t4VQ4iBE0: Connection refused

Hint: The Certificate Authority failed to verify the manually created challenge files. Ensure that you created these in the correct location.

Any suggestions would be highly appreciated!
thanks,
JP

"Connection refused" error happens on the level below http, so the URL doesn't matter. While I can reach your webserver, many places around the world can't:

Try checking your firewalls.

2 Likes

Much obliged Nekit for your swift and spot-on reply.
Some months previous I had turned off port redirect 80 to 443 (and had forgotten!)
Reversing that, then launching certbot command again, the cert renewal succeeded.
Many thanks!
JP

2 Likes