Nginx - certbot - chain not updating

Help
21

I have made the folowing directories and file
sudo mkdir /apps/www/html/.well-known
sudo mkdir /apps/www/html/.well-known/acme-challenge
echo "YAY!" > /apps/www/html/.well-known/acme-challenge/Test-File-1234

http://atif.hippochat.io/.well-known/acme-challenge/Test-File-1234

the url download the file

22

I have made the following folders and file
sudo mkdir /apps/www/html/.well-known
sudo mkdir /apps/www/html/.well-known/acme-challenge
echo "YAY!" > /apps/www/html/.well-known/acme-challenge/Test-File-1234

It now downloads the file.

http://atif.hippochat.io/.well-known/acme-challenge/Test-File-1234

23

Perfect I can see the test file:

wget http://atif.hippochat.io/.well-known/acme-challenge/Test-File-1234 --no-check-certificate
--2021-10-06 22:05:55--  http://atif.hippochat.io/.well-known/acme-challenge/Test-File-1234
Resolving atif.hippochat.io (atif.hippochat.io)... 54.213.183.207
Connecting to atif.hippochat.io (atif.hippochat.io)|54.213.183.207|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://atif.hippochat.io/.well-known/acme-challenge/Test-File-1234 [following]
--2021-10-06 22:05:55--  https://atif.hippochat.io/.well-known/acme-challenge/Test-File-1234
Connecting to atif.hippochat.io (atif.hippochat.io)|54.213.183.207|:443... connected.
WARNING: cannot verify atif.hippochat.io's certificate, issued by ‘CN=Sectigo RSA Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB’:
  Unable to locally verify the issuer's authority.
WARNING: no certificate subject alternative name matches
        requested host name ‘atif.hippochat.io’.
HTTP request sent, awaiting response... 200 OK
Length: 4 [application/octet-stream]
Saving to: ‘Test-File-1234’

Test-File-1234                         100%[==========================================================================>]       4  --.-KB/s    in 0s

2021-10-06 22:05:56 (501 KB/s) - ‘Test-File-1234’ saved [4/4]

cat Test-File-1234
YAY

Now try to get a cert from the staging environment (use --dry-run).

24

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator nginx, Installer nginx

Simulating a certificate request for atif.hippochat.io

Performing the following challenges:

http-01 challenge for atif.hippochat.io

Waiting for verification...

Challenge failed for domain atif.hippochat.io

http-01 challenge for atif.hippochat.io

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:

Domain: atif.hippochat.io

Type: unauthorized

Detail: Invalid response from https://atif.hippochat.io/.well-known/acme-challenge/BCoVAi5CPPybQywVn2TdQ9b8gVlL2M-D7gzuytrFWbs [54.213.183.207]: "\r\n404 Not Found\r\n\r\n

404 Not Found

\r\n
nginx\r\n"

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

25

Then the certbot --nginx plugin is unable to find the correct path where to place the challenge file.
Please show the LE log file.

It should shed light on the problem.
OR
You could hobble on with whatever is wrong (likely within the nginx config) and switch from using:
"certonly --nginx"
to
"certonly --webroot -w /apps/www/html"

26

@rg305
Thanks mate , webroot helped to solve this.

1 Like
27

Glad to have helped :slight_smile:
Cheers from Miami :beers:

#FreeCUBA :cuba:

28

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.