Potential Network Restrictions for Let's Encrypt Certificate Validation on Alibaba Cloud in China

[Inbeom]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
stitch-it.cn
www.stitch-it.cn
testw.stitch-it.cn

I ran this command:
sudo certbot certonly --webroot -w /var/www/certbot -d stitch-it.cn -d www.stitch-it.cn -d testw.stitch-it.cn

It produced this output:
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: testw.stitch-it.cn
Type: unauthorized
Detail: 8.138.1.22: Invalid response from http://testw.stitch-it.cn/.well-known/acme-challenge/X1-ZPIt2ST-z9iRLDxcO6ZtBG-_v0SSoZ4hz453eiww: 403

Domain: www.stitch-it.cn
Type: unauthorized
Detail: 8.138.1.22: Invalid response from http://www.stitch-it.cn/.well-known/acme-challenge/-XA35irftLsHmGITqMR39KPMNLiRafvLaM2XilQReTE: 403

Domain: stitch-it.cn
Type: unauthorized
Detail: 8.138.1.22: Invalid response from http://stitch-it.cn/.well-known/acme-challenge/d8v5-buxRqhUUU0shuGGxA7jvztuwBGaYjd9EYmkVuM: 403

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

My web server is (include version):

• Nginx (version unknown, please provide the version using nginx -v)

The operating system my web server runs on is (include version):

• Alibaba Cloud Linux

My hosting provider, if applicable, is:

• Alibaba Cloud (Aliyun) ECS

I can login to a root shell on my machine (yes or no, or I don't know):
Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

• Certbot 1.22.0

Additional Description:
The server is hosted on Alibaba Cloud in China. This location might introduce specific network restrictions or issues related to accessing external services such as Let's Encrypt's ACME server. This could potentially affect the ability to complete the certificate validation process. If there are any specific configurations or considerations for using Let's Encrypt in China, please let me know.

[9peppe]

This is what I see from Europe:

[jvanasco]

@Inbeom

If there are any specific configurations or considerations for using Let's Encrypt in China, please let me know.

It looks like your service is behind the Great Firewall and not visible to the rest of the world.

You will not be able to complete HTTP-01 or TLS-ALPN-01 challenges unless the firewall allows the full public internet access.

Your best option would be to use DNS-01 challenges, however the DNS servers must be unaffected by the firewall. A popular way to securely delegate and manage DNS-01 challenges is by operating an acme-dns instance.