Nagios is not able to auto renew the certificate

Help
1

When I am trying to auto renew the SSL certificate its showing me the below error.

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for nagios1.tranzact.com

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: nagios1.tranzact.com
Type: connection
Detail: During secondary validation: 50.226.15.251: Fetching http://nagios1.tranzact.com/.well-known/acme-challenge/jSzj2jP7pXfMlfK27Np7vjKRL0da5MCJ93rX_xiod7Y: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

2

Let's Encrypt check your domain from multiple geographic locations. A failure during "secondary" validation suggests you have a firewall or security product blocking http requests either from certain IP ranges or based on geographic location.

3 Likes
3

Yes the site is only accessible in US region.
what can be the solution for it?

4

Remove "defences" altogether or temporarily lift them for the challenges to complete.

3 Likes
5

It's preferable to at least allow all http requests to /.well-known/acme-challenge but that depends on the capabilities of your firewall.

You can also (in practice) block specific countries, assuming you have certain ones in mind, and still pass validation.

If you're firmly against http being open you would need to switch to DNS domain validation.

6 Likes
6

You may find this post helpful:

5 Likes