Problem renew a certificate


#1

My domain is: srpeter.com

I ran this command: certbot renew

It produced this output: https://pastebin.com/XBeztiB5

My web server is: nginx

The operating system my web server runs on is (include version): Debian 9

The version of my client is: certbot 0.28.0

The other subdomains renew perfectly but my main one doesn’t :frowning:


#2

Hi @SrPeter

you have a “not so good” setting.

A lot of ip addresses:

Host T IP-Address is auth. ∑ Queries ∑ Timeout
srpeter.com A 104.28.30.106 yes 1 0
A 104.28.31.106 yes 1 0
AAAA 2606:4700:30::681c:1e6a yes
AAAA 2606:4700:30::681c:1f6a yes
www.srpeter.com A 104.28.30.106 yes 1 0
A 104.28.31.106 yes 1 0
AAAA 2606:4700:30::681c:1e6a yes
AAAA 2606:4700:30::681c:1f6a yes

You have a DNSKEY, but no DS key in the parent zone, so your DNSSEC is incomplete:

Fatal error: DNSKEY 2371 signs DNSKEY RRset, but no confirming DS RR in the parent zone found. No chain of trust created.

And checking your urls is bad - https://check-your-website.server-daten.de/?q=srpeter.com

too much to copy.

There are redirects http -> https, but your https doesn’t work, so Cloudflare throws an error and the validation can’t work.

If you’re the owner of this website:

The SSL certificate presented by the server did not pass validation. This could indicate an expired SSL certificate or a certificate that does not include the requested domain name. Please contact your hosting provider to ensure that an up-to-date and valid SSL certificate issued by a Certificate Authority is configured for this domain name on the origin server. Additional troubleshooting information here.

If you use Cloudflare you need a valide certificate so Cloudflare can load your site.

Perhaps remove the redirect http -> https, so that validation works.


#3

Hello

I havent activated DNSKEY in cloudflare or even on my domain seller…
So I have to delete some IPs? IN Cloudflare they are all poiting to my VPS IP
They only thing I see is that I have some IPs on “IP Access Rules” but nothing
more


#4

Do you know why Cloudflare considers the certificate on your origin to be invalid?

Can you provide the rest of Certbot’s output?

You’ve activated DNSSEC at Cloudflare but not at your domain registrar.


#5

Sure:
https://pastebin.com/TR95991w

Just checked on CloudFlare and domain:


From dash.cloudflare.com


#6

1.)

So Certbot is using the webroot plugin, but Nginx is redirecting HTTP requests to HTTPS, which would be fine, except HTTPS doesn’t work because Cloudflare considers your origin’s current certificate to be invalid.

You can get certificate renewal to succeed by excluding Let’s Encrypt’s requests from the HTTP to HTTPS redirect, or by fixing HTTPS.

Out of curiosity, could you provide the output of “sudo certbot certificates”?

2.)

Interesting! You really don’t have DNSSEC enabled at Cloudflare! But it is enabled.

Maybe you just turned it off recently?

Are you sure you’re looking at the correct Cloudflare account? Does the main page say the domain is “Active” without any issues?


#7

Your dns server sends DNSKEY. Same with this tool:

https://dnssec-analyzer.verisignlabs.com/srpeter.com

Analyzing DNSSEC problems for srpeter.com

. Found 3 DNSKEY records for .
DS=20326/SHA-256 verifies DNSKEY=20326/SEP
Found 2 RRSIGs over DNSKEY RRset
RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
com Found 1 DS records for com in the . zone
DS=30909/SHA-256 has algorithm RSASHA256
Found 1 RRSIGs over DS RRset
RRSIG=16749 and DNSKEY=16749 verifies the DS RRset
Found 2 DNSKEY records for com
DS=30909/SHA-256 verifies DNSKEY=30909/SEP
Found 1 RRSIGs over DNSKEY RRset
RRSIG=30909 and DNSKEY=30909/SEP verifies the DNSKEY RRset
srpeter.com No DS records found for srpeter.com in the com zone
Found 2 DNSKEY records for srpeter.com
Found 1 RRSIGs over DNSKEY RRset
RRSIG=2371 and DNSKEY=2371/SEP verifies the DNSKEY RRset
srpeter.com A RR has value 104.28.30.106
Found 1 RRSIGs over A RRset
RRSIG=34505 and DNSKEY=34505 verifies the A RRset

Remove the redirect http -> https, then try, if you can load a test file via /.well-known/acme-challenge, that should be enough to create a new certificate.

If that doesn’t work, create a new certificate manual using dns-validation.


#8

The first one sounds complicated lol
On the certificates only the “srpeter.com” appears like is expired

Checked around CloudFlare and yes, its actives and no errors :confused:


#9

I tried to check doing: cd /var/www/peter/.well-known/acme-challenge
And it appears that it doesnt even exist… Probably thats the problem? Is there a solution? :frowning:


#10

Is this

your webroot? Then create there the two subdirectories

/var/www/peter/.well-known/acme-challenge

there a file (file name 1234) and try to load it via

http://srpeter.com/.well-known/acme-challenge/1234

Then you can use

certbot run -a webroot -i apache -w /var/www/peter/ -d srpeter.com

or same with nginx, I don’t see your server, I see the cloudflare answer.


#11

Can you provide the output?

The .well-known directory would be expected to exist, but Certbot will create it if it doesn’t. The acme-challenge directory doesn’t normally exist when Certbot isn’t running.

That’s not the problem.


#12

I tried that command and still the same error :confused:


#13

Yep! Here you go https://pastebin.com/ypUz5cm9 :slight_smile:


#14
http://srpeter.com/.well-known/acme-challenge/1234

doesn’t work. So the error is ok.


#15

Thank you. :slightly_smiling_face:

It looks like you’ve turned off the HTTP to HTTPS redirect. Does “sudo certbot renew” work now?


#16

Nope, still the same :frowning:


#17

Exactly the same? The HTML hasn’t changed?


#18

Same error :confused:
https://pastebin.com/h0pj4vx5


#19

Not quite – it’s a 404 Not Found error from http://srpeter.com/. Before it was a Cloudflare 525 Origin Certificate something error from https://srpeter.com/.

It seems the web root setting in /etc/letsencrypt/renewal/srpeter.com.conf isn’t correct.

You can:

  • Update the Nginx configuration
  • Run the Certbot command to issue a certificate, with the arguments you used originally, and the new path, e.g. “sudo certbot certonly --webroot -w /new/root -d srpeter.com -d www.srpeter.com
  • Edit the Certbot .conf file in a text editor.

#20

Here is the config: https://pastebin.com/QnkVg0Xr

Where can I find the certbot .conf file?

Thanks for your time!