Not able to request new certificate

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: xandersalarie.com (problem is with subdomain: nas.xandersalarie.com)

I ran this command: none, i used nginx proxy manager to request a certificate and it failed

It produced this output:`CommandError: Saving debug log to /tmp/letsencrypt-log/letsencrypt.log
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.

at /app/lib/utils.js:16:13
at ChildProcess.exithandler (node:child_process:430:5)
at ChildProcess.emit (node:events:519:28)
at maybeClose (node:internal/child_process:1105:16)
at ChildProcess._handle.onexit (node:internal/child_process:305:5)`

My web server is (include version): N/A

The operating system my web server runs on is (include version): Ubuntu Linux 24.04.1

My hosting provider, if applicable, is: self-hosted

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No? but i use Nginx proxy manager

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): N/a

furthermore, i aparently cannot find the log file mentioned above..

2

Hi @Ramaihaholic, and welcome to the LE community forum :slight_smile:

What shows?:
sudo ls -lR / | grep letsencrypt | grep log | grep 'Oct 2' | grep -v 202

3 Likes
3

hi @rg305 , the command you gave showed "ls: cannot read symbolic link" to all items (i will upload a txt with the full output
output_of_code.txt (44.1 KB)
)

4

i never experienced issues with certbot, i have certificates for a few other subdomains but right now no new ones are added

5

sorry, there was more to come after all. part two shows a few logs i beleive
output_of_code 2.txt (43.1 KB)

7

So, the file does exist:
-rw-r--r-- 1 root root 21871 Oct 27 03:33 letsencrypt.log

What shows?:
sudo find / -name letsencrypt.log

5 Likes
8

hi there, i then get these two outputs:

/var/lib/docker/overlay2/10bad50aa778b4b43c7b69a2efb0610e9bf0e0cc722cca0c9195cb68e9838b82/merged/tmp/letsencrypt-log/letsencrypt.log
/var/lib/docker/overlay2/10bad50aa778b4b43c7b69a2efb0610e9bf0e0cc722cca0c9195cb68e9838b82/diff/tmp/letsencrypt-log/letsencrypt.log
9

Show the file dates.
Show the latest file.

1 Like
10

this is the output of the latest file:

2024-10-28 19:33:06,239:DEBUG:certbot._internal.main:certbot version: 2.11.0
2024-10-28 19:33:06,240:DEBUG:certbot._internal.main:Location of certbot entry point: /opt/certbot/bin/certbot
2024-10-28 19:33:06,240:DEBUG:certbot._internal.main:Arguments: ['--force-renewal', '--config', '/etc/letsencrypt.ini', '--work-dir', '/tmp/letsencrypt-lib', '--logs-dir', '/tmp/letsencrypt-log', '--cert-name', 'npm-4', '--preferred-challenges', 'dns,http', '--no-random-sleep-on-renew', '--disable-hook-validation']
2024-10-28 19:33:06,240:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2024-10-28 19:33:06,339:DEBUG:certbot._internal.log:Root logging level set at 30
2024-10-28 19:33:06,340:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/npm-4.conf
2024-10-28 19:33:06,342:DEBUG:certbot.configuration:Var pref_challs=['dns-01', 'http-01'] (set by user).
2024-10-28 19:33:06,342:DEBUG:certbot.configuration:Var config_dir=/etc/letsencrypt (set by user).
2024-10-28 19:33:06,342:DEBUG:certbot.configuration:Var logs_dir=/tmp/letsencrypt-log (set by user).
2024-10-28 19:33:06,342:DEBUG:certbot.configuration:Var work_dir=/tmp/letsencrypt-lib (set by user).
2024-10-28 19:33:06,343:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None
2024-10-28 19:33:06,343:DEBUG:certbot.configuration:Var preferred_chain=ISRG Root X1 (set by user).
2024-10-28 19:33:06,343:DEBUG:certbot.configuration:Var key_type=ecdsa (set by user).
2024-10-28 19:33:06,343:DEBUG:certbot.configuration:Var elliptic_curve=secp384r1 (set by user).
2024-10-28 19:33:06,343:DEBUG:certbot.configuration:Var webroot_path=['/data/letsencrypt-acme-challenge'] (set by user).
2024-10-28 19:33:06,343:DEBUG:certbot.configuration:Var webroot_map={'webroot_path'} (set by user).
2024-10-28 19:33:06,344:DEBUG:certbot.configuration:Var webroot_path=['/data/letsencrypt-acme-challenge'] (set by user).
2024-10-28 19:33:06,371:DEBUG:certbot._internal.renewal:Auto-renewal forced with --force-renewal...
2024-10-28 19:33:06,371:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2024-10-28 19:33:06,371:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * webroot
Description: Saves the necessary validation files to a .well-known/acme-challenge/ directory within the nominated webroot path. A seperate HTTP server must be running and serving files from the webroot path. HTTP challenge only (wildcards not supported).
Interfaces: Authenticator, Plugin
Entry point: EntryPoint(name='webroot', value='certbot._internal.plugins.webroot:Authenticator', group='certbot.plugins')
Initialized: <certbot._internal.plugins.webroot.Authenticator object at 0x72dbeca5e610>
Prep: True
2024-10-28 19:33:06,372:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot._internal.plugins.webroot.Authenticator object at 0x72dbeca5e610> and installer None
2024-10-28 19:33:06,372:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator webroot, Installer None
2024-10-28 19:33:06,506:DEBUG:certbot._internal.main:Picked account: <Account(RegistrationResource(body=Registration(key=None, contact=(), agreement=None, status=None, terms_of_service_agreed=None, only_return_existing=None, external_account_binding=None), uri='https://acme-v02.api.letsencrypt.org/acme/acct/1864680827', new_authzr_uri=None, terms_of_service=None), 9f612f4f7a73a274c288f11c91a0369b, Meta(creation_dt=datetime.datetime(2024, 7, 30, 11, 15, 54, tzinfo=<UTC>), creation_host='1cec5d35e6c6', register_to_eff=None))>
2024-10-28 19:33:06,507:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2024-10-28 19:33:06,509:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2024-10-28 19:33:06,956:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 746
2024-10-28 19:33:06,956:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Mon, 28 Oct 2024 19:33:06 GMT
Content-Type: application/json
Content-Length: 746
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "TfnNLuw_uz4": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
  "meta": {
    "caaIdentities": [
      "letsencrypt.org"
    ],
    "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf",
    "website": "https://letsencrypt.org"
  },
  "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
  "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
  "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
  "renewalInfo": "https://acme-v02.api.letsencrypt.org/draft-ietf-acme-ari-03/renewalInfo",
  "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
}
2024-10-28 19:33:06,958:DEBUG:certbot._internal.display.obj:Notifying user: Renewing an existing certificate for admin.xandersalarie.com
2024-10-28 19:33:06,963:DEBUG:acme.client:Requesting fresh nonce
2024-10-28 19:33:06,963:DEBUG:acme.client:Sending HEAD request to https://acme-v02.api.letsencrypt.org/acme/new-nonce.
2024-10-28 19:33:07,118:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "HEAD /acme/new-nonce HTTP/1.1" 200 0
2024-10-28 19:33:07,119:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Mon, 28 Oct 2024 19:33:07 GMT
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: t7QKW8Keh4eb9BaPbwiqlLwn29DHmluP_4sJKUIi89TgN1I5hNY
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800


2024-10-28 19:33:07,119:DEBUG:acme.client:Storing nonce: t7QKW8Keh4eb9BaPbwiqlLwn29DHmluP_4sJKUIi89TgN1I5hNY
2024-10-28 19:33:07,119:DEBUG:acme.client:JWS payload:
b'{\n  "identifiers": [\n    {\n      "type": "dns",\n      "value": "admin.xandersalarie.com"\n    }\n  ]\n}'
2024-10-28 19:33:07,125:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/new-order:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMTg2NDY4MDgyNyIsICJub25jZSI6ICJ0N1FLVzhLZWg0ZWI5QmFQYndpcWxMd24yOURIbWx1UF80c0pLVUlpODlUZ04xSTVoTlkiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL25ldy1vcmRlciJ9",
  "signature": "bauHUmpDhT9kEj2Eey1cx4FfqYmFWB4KDVQ8oM2a6H_A8QUZ70zf_ts5HQK8LFyIxW79z3aukRoukNxopYIPcSDekZkAHup_uUKqhCnSzcSzrixc0mPqII0uyy64AgeDvuXWfnrvR-Z6Ss9tv7vi1KIQ8MAndLgPoUsh-gqbqoMzHV-weG2B9lua22u5N51Ewkz9uwsJSHKFfjxngqLDnidV3w-km-lFU-48cTo6udF4-9WvkaWHQhG3i3Pvr8kQ1TWqHNNZBfMRArO3Zz334iaeAs5DvNiC0YG1JyUNrsT6zclPQSbt3pFrYV7C-358cgCqn4R8v1Zu05ex0VjJMw",
  "payload": "ewogICJpZGVudGlmaWVycyI6IFsKICAgIHsKICAgICAgInR5cGUiOiAiZG5zIiwKICAgICAgInZhbHVlIjogImFkbWluLnhhbmRlcnNhbGFyaWUuY29tIgogICAgfQogIF0KfQ"
}
2024-10-28 19:33:07,310:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/new-order HTTP/1.1" 201 349
2024-10-28 19:33:07,311:DEBUG:acme.client:Received response:
HTTP 201
Server: nginx
Date: Mon, 28 Oct 2024 19:33:07 GMT
Content-Type: application/json
Content-Length: 349
Connection: keep-alive
Boulder-Requester: 1864680827
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Location: https://acme-v02.api.letsencrypt.org/acme/order/1864680827/317900831837
Replay-Nonce: l4CEvUUqkBHx0lfESIrQTH8UXYS9KackIWRhEF1tGwLrt7uSAsY
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "status": "pending",
  "expires": "2024-11-04T19:33:07Z",
  "identifiers": [
    {
      "type": "dns",
      "value": "admin.xandersalarie.com"
    }
  ],
  "authorizations": [
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/422472275837"
  ],
  "finalize": "https://acme-v02.api.letsencrypt.org/acme/finalize/1864680827/317900831837"
}
2024-10-28 19:33:07,311:DEBUG:acme.client:Storing nonce: l4CEvUUqkBHx0lfESIrQTH8UXYS9KackIWRhEF1tGwLrt7uSAsY
2024-10-28 19:33:07,311:DEBUG:acme.client:JWS payload:
b''
2024-10-28 19:33:07,316:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/authz-v3/422472275837:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMTg2NDY4MDgyNyIsICJub25jZSI6ICJsNENFdlVVcWtCSHgwbGZFU0lyUVRIOFVYWVM5S2Fja0lXUmhFRjF0R3dMcnQ3dVNBc1kiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2F1dGh6LXYzLzQyMjQ3MjI3NTgzNyJ9",
  "signature": "gGmBi6PYeGh4suSR58-pnkS_q75HvlHPwPL3gDWPRfDhawwP723eFpoN7eKdFQ9zZE4buLN61GTUJxRD3CCKyJrWB6PExqMcstReDHfNtRNCLe00Nk8r6tydgkHNzb4WY0f0u3CvUb4OrLo8SuhSTtRrjKSLMRBrIZzA71pSCmAu3UFZ61iipuGFq_59szt4EnF1KhlysoZzIDwTpYca2dJ9gVAA6B6MSCzxjhlVTwyzYL3ufEWjuTad1i8Qe4aXmfx6mGwPB_wEpbGLlxAXzKWGMdmBrYwtXkuBPIEl9EyVAef8Ses9N6eAJgXEaGY9fAGkrm2I3fWxL36t37V1ww",
  "payload": ""
}
2024-10-28 19:33:07,472:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/422472275837 HTTP/1.1" 200 807
2024-10-28 19:33:07,473:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Mon, 28 Oct 2024 19:33:07 GMT
Content-Type: application/json
Content-Length: 807
Connection: keep-alive
Boulder-Requester: 1864680827
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: t7QKW8KeT0J3sFPitRg6oJ4wVQO4wdQy4cJ62kyUIIvj5tqn7ow
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "identifier": {
    "type": "dns",
    "value": "admin.xandersalarie.com"
  },
  "status": "pending",
  "expires": "2024-11-04T19:33:07Z",
  "challenges": [
    {
      "type": "tls-alpn-01",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/422472275837/zi1BKQ",
      "status": "pending",
      "token": "kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts"
    },
    {
      "type": "http-01",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/422472275837/ABaXZw",
      "status": "pending",
      "token": "kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts"
    },
    {
      "type": "dns-01",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/422472275837/-UNG0A",
      "status": "pending",
      "token": "kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts"
    }
  ]
}
2024-10-28 19:33:07,473:DEBUG:acme.client:Storing nonce: t7QKW8KeT0J3sFPitRg6oJ4wVQO4wdQy4cJ62kyUIIvj5tqn7ow
2024-10-28 19:33:07,474:INFO:certbot._internal.auth_handler:Performing the following challenges:
2024-10-28 19:33:07,474:INFO:certbot._internal.auth_handler:http-01 challenge for admin.xandersalarie.com
2024-10-28 19:33:07,475:INFO:certbot._internal.plugins.webroot:Using the webroot path /data/letsencrypt-acme-challenge for all unmatched domains.
2024-10-28 19:33:07,475:DEBUG:certbot._internal.plugins.webroot:Creating root challenges validation dir at /data/letsencrypt-acme-challenge/.well-known/acme-challenge
2024-10-28 19:33:07,477:DEBUG:certbot._internal.plugins.webroot:Attempting to save validation to /data/letsencrypt-acme-challenge/.well-known/acme-challenge/kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts
2024-10-28 19:33:07,478:DEBUG:acme.client:JWS payload:
b'{}'
2024-10-28 19:33:07,482:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/chall-v3/422472275837/ABaXZw:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMTg2NDY4MDgyNyIsICJub25jZSI6ICJ0N1FLVzhLZVQwSjNzRlBpdFJnNm9KNHdWUU80d2RReTRjSjYya3lVSUl2ajV0cW43b3ciLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2NoYWxsLXYzLzQyMjQ3MjI3NTgzNy9BQmFYWncifQ",
  "signature": "OWh8UMXxtQpdUXGsTyY7_AAT_iVEmi-zOpmxmD4MiDt8HdzPqW0awFerEmt8pkEZJJBd2R-Lp7QWzWyaLCdjySjs089V-8SQVhyfdv371V6lJOdw8AjU1aoqQKDnp2wSREUFymCkvodCt4TCCsoo9Tewt8ZvGCIxsFjQvJlu14p14b--LVz-h2yhJEZ3lvAdX6VzAfAEsh78Y60L1anldmnz-Fvjo58RVbVJbUcNypu2euiFsLlGx6DsYReVsbfP7hcFZTA-iOr7vXnyVuqR6Qf551-DRHaEQFT6QTFIfCDZSvHHJIHhKP88Q2_OV7tCco47UuwkTJhJAuBAojOv3Q",
  "payload": "e30"
}
2024-10-28 19:33:07,646:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/chall-v3/422472275837/ABaXZw HTTP/1.1" 200 187
2024-10-28 19:33:07,647:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Mon, 28 Oct 2024 19:33:07 GMT
Content-Type: application/json
Content-Length: 187
Connection: keep-alive
Boulder-Requester: 1864680827
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index", <https://acme-v02.api.letsencrypt.org/acme/authz-v3/422472275837>;rel="up"
Location: https://acme-v02.api.letsencrypt.org/acme/chall-v3/422472275837/ABaXZw
Replay-Nonce: l4CEvUUqjMXEv82kefH5Lm31SrKwawaGS1h9G7c3-AK-LkCpkE8
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "type": "http-01",
  "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/422472275837/ABaXZw",
  "status": "pending",
  "token": "kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts"
}
2024-10-28 19:33:07,647:DEBUG:acme.client:Storing nonce: l4CEvUUqjMXEv82kefH5Lm31SrKwawaGS1h9G7c3-AK-LkCpkE8
2024-10-28 19:33:07,648:INFO:certbot._internal.auth_handler:Waiting for verification...
2024-10-28 19:33:08,649:DEBUG:acme.client:JWS payload:
b''
2024-10-28 19:33:08,653:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/authz-v3/422472275837:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMTg2NDY4MDgyNyIsICJub25jZSI6ICJsNENFdlVVcWpNWEV2ODJrZWZINUxtMzFTckt3YXdhR1MxaDlHN2MzLUFLLUxrQ3BrRTgiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2F1dGh6LXYzLzQyMjQ3MjI3NTgzNyJ9",
  "signature": "fUjZU7-sWcTfJiW9Nq5Iqr-BcIxh5STAu9bLuj0JV7T1YSrkg32tiQrkNds4y7Gac2u5w4e4pmKIRMqCCsLvrP30B_yn2rFO2Zjt-v6qpd-Ec3K-m4IyNTLXb3AckF2e_ElAV7YVgWCDSDCqmDS9_5FkJ_JMWyhIfP-xGYiCJiBzpBGfIYQBYFAJwdkFs5-Ideqev2kxRVLCwhyKbnrg7NISL39JN--D9rCHfQnKWw8rdI0LlhpON50-Ep72NFDCQHttiIpQWwBPM26svvti0TnFLOVTO8Yg0FJw5jvldRWWioVzzXoL1-wSc4MxHjRlVs7Qx4Yu1QxwQLK94opJOA",
  "payload": ""
}
2024-10-28 19:33:08,816:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/422472275837 HTTP/1.1" 200 1057
2024-10-28 19:33:08,817:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Mon, 28 Oct 2024 19:33:08 GMT
Content-Type: application/json
Content-Length: 1057
Connection: keep-alive
Boulder-Requester: 1864680827
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: l4CEvUUqy1ZGw0s5R93np3SMBnUMFYp_DhnlNSiFDO3Fwbv5RMI
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "identifier": {
    "type": "dns",
    "value": "admin.xandersalarie.com"
  },
  "status": "invalid",
  "expires": "2024-11-04T19:33:07Z",
  "challenges": [
    {
      "type": "http-01",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/422472275837/ABaXZw",
      "status": "invalid",
      "validated": "2024-10-28T19:33:07Z",
      "error": {
        "type": "urn:ietf:params:acme:error:connection",
        "detail": "84.24.88.254: Fetching http://admin.xandersalarie.com/.well-known/acme-challenge/kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts: Connection refused",
        "status": 400
      },
      "token": "kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts",
      "validationRecord": [
        {
          "url": "http://admin.xandersalarie.com/.well-known/acme-challenge/kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts",
          "hostname": "admin.xandersalarie.com",
          "port": "80",
          "addressesResolved": [
            "84.24.88.254"
          ],
          "addressUsed": "84.24.88.254"
        }
      ]
    }
  ]
}
2024-10-28 19:33:08,817:DEBUG:acme.client:Storing nonce: l4CEvUUqy1ZGw0s5R93np3SMBnUMFYp_DhnlNSiFDO3Fwbv5RMI
2024-10-28 19:33:08,818:INFO:certbot._internal.auth_handler:Challenge failed for domain admin.xandersalarie.com
2024-10-28 19:33:08,818:INFO:certbot._internal.auth_handler:http-01 challenge for admin.xandersalarie.com
2024-10-28 19:33:08,819:DEBUG:certbot._internal.display.obj:Notifying user:
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: admin.xandersalarie.com
  Type:   connection
  Detail: 84.24.88.254: Fetching http://admin.xandersalarie.com/.well-known/acme-challenge/kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts: Connection refused

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

2024-10-28 19:33:08,821:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/auth_handler.py", line 108, in handle_authorizations
    self._poll_authorizations(authzrs, max_retries, max_time_mins, best_effort)
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/auth_handler.py", line 212, in _poll_authorizations
    raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.

2024-10-28 19:33:08,821:DEBUG:certbot._internal.error_handler:Calling registered functions
2024-10-28 19:33:08,821:INFO:certbot._internal.auth_handler:Cleaning up challenges
2024-10-28 19:33:08,821:DEBUG:certbot._internal.plugins.webroot:Removing /data/letsencrypt-acme-challenge/.well-known/acme-challenge/kDEn_KKxRt0aztLr6YmlbKZBnJoOXqZ7NgQaiaHvtts
2024-10-28 19:33:08,822:DEBUG:certbot._internal.plugins.webroot:All challenges cleaned up
2024-10-28 19:33:08,822:ERROR:certbot._internal.renewal:Failed to renew certificate npm-4 with error: Some challenges have failed.
2024-10-28 19:33:08,827:DEBUG:certbot._internal.renewal:Traceback was:
Traceback (most recent call last):
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/renewal.py", line 540, in handle_renewal_request
    main.renew_cert(lineage_config, plugins, renewal_candidate)
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/main.py", line 1550, in renew_cert
    renewed_lineage = _get_and_save_cert(le_client, config, lineage=lineage)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/main.py", line 131, in _get_and_save_cert
    renewal.renew_cert(config, domains, le_client, lineage)
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/renewal.py", line 399, in renew_cert
    new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)
                                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/client.py", line 428, in obtain_certificate
    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/client.py", line 496, in _get_order_and_authorizations
    authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/auth_handler.py", line 108, in handle_authorizations
    self._poll_authorizations(authzrs, max_retries, max_time_mins, best_effort)
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/auth_handler.py", line 212, in _poll_authorizations
    raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.

2024-10-28 19:33:08,831:DEBUG:certbot._internal.display.obj:Notifying user:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2024-10-28 19:33:08,832:ERROR:certbot._internal.renewal:All renewals failed. The following certificates could not be renewed:
2024-10-28 19:33:08,832:ERROR:certbot._internal.renewal:  /etc/letsencrypt/live/npm-4/fullchain.pem (failure)
2024-10-28 19:33:08,833:DEBUG:certbot._internal.display.obj:Notifying user: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2024-10-28 19:33:08,833:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/opt/certbot/bin/certbot", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/main.py", line 19, in main
    return internal_main.main(cli_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/main.py", line 1894, in main
    return config.func(config, plugins)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/main.py", line 1642, in renew
    renewed_domains, failed_domains = renewal.handle_renewal_request(config)
                                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/renewal.py", line 568, in handle_renewal_request
    raise errors.Error(
certbot.errors.Error: 1 renew failure(s), 0 parse failure(s)
2024-10-28 19:33:08,835:ERROR:certbot._internal.log:1 renew failure(s), 0 parse failure(s)
11

This is the key part of the log. Sadly, the NPM product you use hides the most important part of the error messages.

Your domain is not accepting HTTP requests on port 80. It gives "Connection Refused".

You should review your firewalls and any NAT or port routing (routers, containers, ...) and make sure that domain replies to HTTP.

The Let's Debug test site is helpful to debug new setups. Or, ask the NPM support forum for configuration assistance.

4 Likes
12

that's weird because i have had it working with all domains (even admin.xandersalarie.com has worked with certbot).

port 80 is also open and the container is also using port 80 for letsencrypt by default.

what i now did was remove the container in it's entirity and check the docker-compose.yml file.

i made some edits and turned off the ipv6 to test and somehow it works now. the debug tester also turned out green now

13

Good. It looks like you got a fresh cert and your domain openresty server is using it

Do you need any more help?

3 Likes