Node pilot - TLS failed - Certbot failed to authenticate some domains

Requesting a certificate for EXAMPLE.COM and 50 more domains Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems: Domain: EXAMPLE.COM Type: unauthorized Detail: Invalid response from http://EXAMPLE.COM/.well-known/acme-challenge/9GijX3wQNifQ3cWJrTw-zRPDKGPCi7YaaKKJq36g0d4 [2607:f1c0:100f:f000::2fc]: 204 Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet. Some challenges have failed. Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My domain is: protaxnodes.org

I ran this command: ./np check

It produced this output:
Running Node Pilot automated system checks
:heavy_check_mark: Running as non-root user
:heavy_check_mark: Docker installed - version 20.10.12, build e91ed57
:heavy_check_mark: Docker run allowed
:heavy_check_mark: Connected to internet
:heavy_check_mark: Found public IP - xxxxxxxxxx
:heavy_check_mark: Found local IP - yyyyyyyyy
:heavy_check_mark: Found Node Pilot config
:heavy_check_mark: Node Pilot config valid JSON
:heavy_check_mark: Found domain in config - xxxxxxxxxx
:heavy_check_mark: xxxxxxxxxx resolves to xxxxxxxxxx
:heavy_check_mark: *.xxxxxxxx resolves to xxxxxxxxx
:heavy_check_mark: Port 80 open
:heavy_check_mark: Port 80 open in system firewall
:heavy_check_mark: Port 80 open to public
:heavy_check_mark: Port 443 open
:heavy_check_mark: Port 443 open in system firewall
:heavy_check_mark: Port 443 open to public
:heavy_check_mark: Port 34416 open
:heavy_check_mark: Port 34416 open in system firewall
:heavy_check_mark: Port 34416 NOT open to public

it seems to be working fine but TLS fails
Type: unauthorized
Detail: Invalid response from http://xxxxxxxxxx/.well-known/acme-challenge/DoMrlu1p3el74onmWwHtiAgxY8yzQlTPvs5IiGXs5IY [2607:f1c0:100f:f000::2fc]: 204

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

LOG

info: Starting nginx {"timestamp":"2022-02-16T06:49:31.085Z"}
info: Generating nginx server config {"timestamp":"2022-02-16T06:49:31.085Z"}
info: docker run --rm -i -p 80:80 -p 443:443 -v /home/ubuntu/.node-pilot/config/nginx/sites_enabled:/etc/nginx/sites-enabled -v /home/ubuntu/.node-pilot/config/nginx/self_signed_tls:/ssl -v /home/ubuntu/.node-pilot/config/nginx/log:/var/log/nginx -v /home/ubuntu/.node-pilot/config/nginx/public:/public -v /home/ubuntu/.node-pilot/config/letsencrypt/config:/etc/letsencrypt --name node-manager-nginx --add-host host.docker.internal:host-gateway --network node-manager-network rburgett/pnm-nginx:1.0.0 {"timestamp":"2022-02-16T06:49:31.087Z"}
error: startNetdata error: undefined
undefined {"timestamp":"2022-02-16T06:49:31.112Z"}

My web server is (include version): ubuntu 20.04

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is: AWS

I can login to a root shell on my machine (yes or no, or I don't know): YES

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot

Any help would be much appreciate

Looks like the IPv6 address in your DNS AAAA record might be wrong. Let's Encrypt will favor IPv6 if AAAA is present and you can see that address in the error message.

I tried curl requests to both IPv4 and IPv6 and got different answers. That should not be. Use the following to check your server IP's match the DNS

curl -4 http://ifconfig.co
curl -6 http://ifconfig.co

DNS:
nslookup  protaxnodes.org
Address: 54.206.100.244
Address: 2607:f1c0:100f:f000::2fc
2 Likes

Thanks for the reply ..

I found out that it cannot be used in the main domain .. it need to use in the sub-subdomain.

Its working now ..

Regards

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.