Not able to generate the certificate

[hussainmohammad]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: api.queinfotech.com

I ran this command: sudo certbot certonly -d api.queinfotech.com --server "https://acme-v02.api.letsencrypt.org/directory"

It produced this output:
root@Queinfotech:~/QueInfoTechWebsite/server# sudo certbot certonly -d api.queinfotech.com --server "https://acme-v02.api.letsencrypt.org/directory"
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?

---

1: Nginx Web Server plugin (nginx)
2: Runs an HTTP server locally which serves the necessary validation files under
the /.well-known/acme-challenge/ request path. Suitable if there is no HTTP
server already running. HTTP challenge only (wildcards not supported).
(standalone)
3: Saves the necessary validation files to a .well-known/acme-challenge/
directory within the nominated webroot path. A seperate HTTP server must be
running and serving files from the webroot path. HTTP challenge only (wildcards
not supported). (webroot)

---

Select the appropriate number [1-3] then [enter] (press 'c' to cancel): 1
Requesting a certificate for api.queinfotech.com

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: api.queinfotech.com
Type: unauthorized
Detail: 191.101.233.46: Invalid response from http://api.queinfotech.com/.well-known/acme-challenge/f2Ats3qttmeTji5JcNSGSvC-DfvNPYKr0iA4wRS94i8: 404

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
root@Queinfotech:~/QueInfoTechWebsite/server#

My web server is (include version):
root@Queinfotech:~/QueInfoTechWebsite/server# nginx -v
nginx version: nginx/1.18.0 (Ubuntu)

The operating system my web server runs on is (include version):
Current OS: Ubuntu 22.04 64bit with CyberPanel
IP address: 191.101.233.46

My hosting provider, if applicable, is:
i purchase 'queinfotech.com' domain from google domains and VPS from hostinger

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
root@Queinfotech:~/QueInfoTechWebsite/server# certbot --version
certbot 2.6.0
root@Queinfotech:~/QueInfoTechWebsite/server#

for your information:
I have LiteSpeed and nginx both are up and running on same server same time. 80 port using by LiteSpeed.
i deployed api on nginx and only 8080 port available for nginx.
API is working fine at url : http://api.queinfotech.com:8080/auth

this is my nginx server config

server {
  listen 8080;
  server_name api.queinfotech.com;
  
  location / {
        proxy_pass http://191.101.233.46:3001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        
		add_header 'Access-Control-Allow-Origin' '*';
		add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
		add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type';
  }
  location ^~ /.well-known/acme-challenge/ {
        root /root/QueInfoTechWebsite/server;
        allow all;
  }
}

guide me to generate and access the api on
https://api.queinfotech.com:8080/auth

[MikeMcQ]

@hussainmohammad

api.queinfotech.com

Thanks for nice report.

First, the domain name api.queinfotech.com no longer has an A and/or AAAA record in the DNS. Without that no one can reach it from the public internet. And, you cannot use the HTTP Challenge without that. You must have had one before because I see an IP address in your error message.

Once that is fixed you would need to setup your LiteSpeed server to proxy HTTP Challenge requests for that domain name to the nginx server. It can use port 8080 to talk to nginx. You then make the cert request like this:

sudo certbot certonly --nginx --dry-run --http-01-port 8080 -d api.queinfotech.com

The --http-01-port has certbot adding the needed changes to your nginx server block that is listening on port 8080.

Once that works remove --dry-run to get a production cert

The flow is then:
Let's Encrypt Server makes HTTP request to your api domain
Litespeed sees it on port 80 and proxies it to nginx
nginx replies with the expected challenge token
Cert issued

Your other option is to use the DNS Challenge. I have forgotten exactly how that works with googledomains but I think there is support for it somehow. Google had two different "domain" systems but there were recent changes. Let us know if you want to try this and someone will advise.

[hussainmohammad]

thank you to provide the details.

1. Created A type record in DNS.
2. sudo certbot --manual --preferred-challenges dns certonly -d <<domain name>>
   executed this command and follow the instruction. successfully generated certificate.

thank you