Nginx http-01 challenge error

[Dino-W]

My domain is:kashinobi.com

I ran this command:sudo certbot renew

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log

---

Processing /etc/letsencrypt/renewal/kashinobi.com.conf

---

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for kashinobi.com
http-01 challenge for www.kashinobi.com
Waiting for verification...
Challenge failed for domain kashinobi.com
Challenge failed for domain www.kashinobi.com
http-01 challenge for kashinobi.com
http-01 challenge for www.kashinobi.com
Cleaning up challenges
Attempting to renew cert (kashinobi.com) from /etc/letsencrypt/renewal/kashinobi.com.conf produced an unexpected error: Some challenges have failed.. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/kashinobi.com/fullchain.pem (failure)

---

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/kashinobi.com/fullchain.pem (failure)

---

1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: kashinobi.com
  Type: dns
  Detail: DNS problem: SERVFAIL looking up A for kashinobi.com - the
  domain's nameservers may be malfunctioning; DNS problem: SERVFAIL
  looking up AAAA for kashinobi.com - the domain's nameservers may be
  malfunctioning

  Domain: www.kashinobi.com
  Type: dns
  Detail: DNS problem: SERVFAIL looking up A for www.kashinobi.com -
  the domain's nameservers may be malfunctioning; DNS problem:
  SERVFAIL looking up AAAA for www.kashinobi.com - the domain's
  nameservers may be malfunctioning

My web server is (include version):nginx/1.18.0 (Ubuntu)

The operating system my web server runs on is (include version):Ubuntu 20.04.5 LTS focal

My hosting provider, if applicable, is:Cloudflare

I can login to a root shell on my machine (yes or no, or I don't know):yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):certbot 0.40.0

Here is my nginx config:
server {
listen 80;
server_name kashinobi.com;
return 301 https://www.kashinobi.com$request_uri;
}

server {
listen 80;
server_name www.kashinobi.com;
return 301 https://www.kashinobi.com$request_uri;
}
server {

root /var/www/build;
index index.html index.htm index.nginx-debian.html;
server_name www.kashinobi.com;

location / {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_cache_bypass $http_upgrade;
}

listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/kashinobi.com/fullchain.pem; # managed by Certb>
ssl_certificate_key /etc/letsencrypt/live/kashinobi.com/privkey.pem; # managed by Cer>
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

The result of executing "sudo certbot certificates" is as follows:
Saving debug log to /var/log/letsencrypt/letsencrypt.log

---

Found the following certs:
Certificate Name: kashinobi.com
Domains: kashinobi.com www.kashinobi.com
Expiry Date: 2023-05-17 17:11:04+00:00 (VALID: 2 days)
Certificate Path: /etc/letsencrypt/live/kashinobi.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/kashinobi.com/privkey.pem

---

After conducting some search and reviewing similar articles, I have attempted some methods, but I still cannot resolve this issue. I would like to ask if anyone has any other ideas or suggestions. Thanks!

[schoen]

@Dino-W

kashinobi.com

Hi @Dino-W,

It looks like your DNS setup for this domain is in fact somewhat broken. The problem that most test services seem to identify is invalid DNSSEC records. I think the most likely thing is that you have DNSSEC enabled at the registrar (Google Domains), but don't have correct DNSSEC settings for your delegation to your DNS provider (Cloudflare).

The likeliest way to fix this would be to find Cloudflare's documentation about DNSSEC settings and then correct these settings with Google Domains.

Another alternative would be to move your DNS hosting to Google Domains, since they probably have automatic integration with their registrar services to make your DNSSEC work properly.

The worst alternative is to disable DNSSEC entirely. I don't really like suggesting this kind of thing because it is nicer to fix misconfigurations rather than disable stuff.

A somewhat detailed analysis is at

https://dnsviz.net/d/kashinobi.com/dnssec/

Similar problems were reported by other test sites that I used.

[Dino-W]

OK! I will try to resolve the DNSSEC issue. If there are any related troubleshooting matters where I might need further assistance, I will appreciate your help. Thank you.

[Dino-W]

@schoen ,thanks for your help!
Based on the assistance you provided, it appears that the issue was indeed caused by a lack of synchronization between Cloudflare and Google's DNSSEC settings. After synchronizing the algorithm settings on both sides and running "sudo certbot renew," no error messages were encountered.Thanks a lot!