My domain is: sesstim4.timone.univ-amu.fr I ran this command: sudo certbot -v --apache It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Enter email address (used for urgent renewal and security notices) (En…

Using the online tool Let's Debug yields these results https://letsdebug.net/sesstim4.timone.univ-amu.fr/1676006 ANotWorking ERROR sesstim4.timone.univ-amu.fr has an A (IPv4) record (139.124.158.220) but a request to this address over port 80 did not succeed. Your web server must have at least one …

I suspect something that can block specific user agents is involved. Not sure if iptables can do that. Have you anything enabled that can block specific user agents?

Well, here are a number of checks in the attached file. ufw status and log, iptables, apache log looking for "amazonaws", search for rewrite condition ou setEnvIf,... I don't see anything that could be a problem. The only thing may be a conflict with the IfDefine and IfModule of my virtual-host..…

curl -I http://sesstim4.timone.univ-amu.fr -A "Let's Encrypt validation server" You did not include the full path, nor the full header. Try: curl -Ii http://sesstim4.timone.univ-amu.fr/.well-known/acme-challenge/sometestfile \ -A "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https:/…

Notice the difference the "NOT" makes: [you make have to scroll right to see it] curl -Ii http://sesstim4.timone.univ-amu.fr/.well-known/acme-challenge/testfile -A "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)" curl: (52) Empty reply from server curl -Ii…

Well, I'm not sure I understand what you're pointing out and how it should direct me. Whether I do it with or without "NOT" I get the same answer. jcdufour@sesstim4:~$ curl -Ii http://sesstim4.timone.univ-amu.fr/.well-known/acme-challenge/testfile -A "Mozilla/5.0 (compatible; Let's Encrypt validati…

[image] rg305: I suspect something that can block specific user agents is involved. Not sure if iptables can do that. I was thinking about that. It could STILL be Palo Alto problem! The four packets shown are probably not enough to actually make the user agent reach the webserver. It might …

Well, then it shows it is NOT the server. Back we go to the Palo Alto firewall. Please refer your IT firewall people to: [image] Palo Alto firewall users with failing HTTP-01 challenges: enable "acme-protocol" Help H…

As a temporary workaround... Have you tried getting a cert from any other CA?

Yes, I've just set up a RENATER certificate. This service is the French version of the contract signed between GÉANT Association and the commercial certification provider Sectigo, for the benefit of some thirty national Education and Research networks in Europe, including RENATER. The certificate i…

And just before, I had successfully installed a ZeroSSL certificate

Problem with certbot with ubuntu server 22.04.3 LTS

Help

rg305 November 16, 2023, 4:02pm 28

Well, then it shows it is NOT the server.
Back we go to the Palo Alto firewall.
Please refer your IT firewall people to:

Topic		Replies	Views
Cannot renew with Certbot "Connection refused by peer" Help	91	2769	April 14, 2022
Obtain first certificate: timeout Help	20	1479	July 11, 2019
DEBUG:certbot._internal.error_handler:Encountered exception: Help	2	919	July 18, 2023
Failed authorization procedure. Multiple virtualhosts apache Help	74	6104	August 21, 2018
Some challenges have failed Help	15	1929	September 7, 2022

Problem with certbot with ubuntu server 22.04.3 LTS

Related topics