Random timeout errors

Server
#1

Hi,

I’m having a lot of trouble the last couple of weeks to generate new certificates. I use the certonly --standalone mode with a http challenge and I’m getting random timeout errors. I want generate a certificate covering 4 domain names both www and non-www. Sometimes just 1 domain fails and sometimes 3 or 4 fail. This is completely random.

My domains are:

smartbusiness.bike
smartbike.business
smartbusinessbike.com
smartbusinessbike.nl

I ran this command:

certbot certonly --standalone --preferred-challenges http --pre-hook="service nginx stop" --post-hook="service nginx start" -d smartbike.business -d www.smartbike.business -d smartbusiness.bike -d www.smartbusiness.bike -d smartbusinessbike.com -d www.smartbusinessbike.com -d smartbusinessbike.nl -d www.smartbusinessbike.nl

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Running pre-hook command: service nginx stop
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for smartbike.business
http-01 challenge for www.smartbike.business
http-01 challenge for smartbusiness.bike
http-01 challenge for www.smartbusiness.bike
http-01 challenge for smartbusinessbike.com
http-01 challenge for www.smartbusinessbike.com
http-01 challenge for smartbusinessbike.nl
http-01 challenge for www.smartbusinessbike.nl
Waiting for verification...
Cleaning up challenges
Running post-hook command: service nginx start
Failed authorization procedure. www.smartbusiness.bike (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching https://smartbusiness.bike/.well-known/acme-challenge/niORJoJuaMrayvd6uNve5Z8-xxm3Wvc3wBV7J44He1I: Connection refused, www.smartbike.business (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching https://smartbusiness.bike/.well-known/acme-challenge/XoZxXbFTXeKJsA7lE7z8mxsPo1S06Jr3yMdblOgPWqw: Connection refused

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: www.smartbusiness.bike
   Type:   connection
   Detail: Fetching
   https://smartbusiness.bike/.well-known/acme-challenge/niORJoJuaMrayvd6uNve5Z8-xxm3Wvc3wBV7J44He1I:
   Connection refused

   Domain: www.smartbike.business
   Type:   connection
   Detail: Fetching
   https://smartbusiness.bike/.well-known/acme-challenge/XoZxXbFTXeKJsA7lE7z8mxsPo1S06Jr3yMdblOgPWqw:
   Connection refused

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

My web server is (include version):

Nginx (but I’m using standalone mode).

The operating system my web server runs on is (include version):

Debian 9

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

Any ideas, I tried to find out how I can increase timeout values but I wasn’t able to find this.

Thanks!

edit:

The firewall is open on port 80 and 443 and I have websites running on Nginx with Letsencrypt certificates.

#2

Update:

I had version 0.11 of Certbot installed. I now have version 0.19 and I have to wait for the too many failed authorizations to test again but this could be the problem.

#3

Hi,

It seems you might have some DNS problem…

The following Domains are under IP ending in .59:
www.smartbusiness.bike
www.smartbike.business
www.smartbusinessbike.com
www.smartbusinessbike.nl

The following Domains are under IP ending in .11:
smartbike.business
smartbusiness.bike
smartbusinessbike.com
smartbusinessbike.nl

It shows me you are using different servers for those two ips.
(Might be the problem>?)

Thank you

#4

Ah, alright that explains a lot…

Changed the DNS and trying again in an hour, thanks!

edit:

Question in the meanwhile:

This doesn’t explain why the other 2 www domains weren’t in the error list and my error list changed at random while trying. What is going on there?

#5

Actually, I'm not sure. (kind of surprised me there are only two domains report the error.)
Just know it's different IP/Host per domain.

Just curious, is all those domains on one server just different IP or they are on completely different server?

P.S. after modifying dns settings, I personally suggest use Staging environment to test first.

Thank you

#6

Thanks! After trying again I was able to get the certificates. I will try the staging environment next time.

All domains are (or were supposed to :p) pointing to the same VPS (and the same vhost on Nginx). I was transfering the domains from another VPS and forgot the www records in the dns.

#7

Glad to see you solved it.

Good luck!

#8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.