No valid A records found

[jfwerner]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: nextcloud.johanneswerner.me

I ran this command: sudo certbot --nginx

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Please enter the domain name(s) you would like on your certificate (comma and/or
space separated) (Enter 'c' to cancel): johanneswerner.me
Requesting a certificate for johanneswerner.me

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: johanneswerner.me
Type: dns
Detail: no valid A records found for johanneswerner.me; no valid AAAA records found for johanneswerner.me
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.

My web server is (include version): nginx 1.14.2

The operating system my web server runs on is (include version): Debian 10.11

My hosting provider, if applicable, is: XXXXXXXX

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): uh sort of, my Nextcloud container was created with the linuxserver.io image and i manage that stuff using Portainer

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.25.0

I have put an A record to both nextcloud.johanneswerner.me and johanneswerner.me in the host records on the namecheap advanced DNS page. Not sure why certbot can't seem to find it, since both sites redirect fine. My 80 is open, I tried letsdebug, I waited a few hours to try again in case the DNS records weren't up to date. Unsure of what my problem is.

[Osiris]

The IP address 10.221.11.14 currently for the hostname johanneswerner.me is from a private, non-publicly routable IP address range. See IANA IPv4 Special-Purpose Address Registry

If your site doesn't have a publicly routable IP address, you cannot use the nginx authenticator, as that uses the http-01 challenge. The only method of acquiring a certificate for hostnames resolving in a private IP address is using the dns-01 challenge. See Challenge Types - Let's Encrypt for the different challenge types.

[jfwerner]

Thanks for the tip, that did the trick! I really feel like they could add that as one of the "To use Certbot, you'll need..." checks.

So in case anyone else is wondering, I used the command
sudo certbot certonly --manual --preferred-challenges dns
This then gives you a name and value to create a TXT with, which I tried using namecheap. Turns out namecheap really sucks, and it somehow never really registered or published the TXT record, so I switched to cloudflare, it instanty did the TXT thing and now I have SSL!

[Osiris]

If you're using Cloudflare now, note that Certbot has a Cloudflare DNS plugin, so you can automate everything.

[petercooperjr]

@jfwerner

I really feel like they could add that as one of the "To use Certbot, you'll need..." checks.

It's definitely been a challenge mentioned around here, that the documentation of a lot of things assumes that one already has a working publicly-available site before starting the process of adding HTTPS, but as many topics on this community can attest to, that assumption is not always true. (Of course, the many cases where it is true and the whole process just works usually ends up with nobody posting anything, as we only see the cases here where it isn't working.)