Renew Certificate - Challenge failed

Help
1

My domain is: devjenkins.goeasyuat.com

I ran this command:./letsencrypt-auto --config /etc/letsencrypt/configs/devjenkins.goeasyuat.com.conf certonly

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for devjenkins.goeasyuat.com
Using the webroot path /var/www/letsencrypt for all unmatched domains.
Waiting for verification…
Challenge failed for domain devjenkins.goeasyuat.com
http-01 challenge for devjenkins.goeasyuat.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

My web server is (include version): nginx

Please help to renew the certificate.

1 Like
2

Hi @taarushj

checking your domain there is a redirect to https (that's not a problem), then followed by a redirect to the login page (that's a problem). See the output of https://check-your-website.server-daten.de/?q=devjenkins.goeasyuat.com

<html><head><meta http-equiv='refresh' content='1;url=/login?from=%2F.well-known%2Facme-challenge%2Fcheck-your-website-dot-server-daten-dot-de'/>
<script>window.location.replace('/login?from=%2F.well-known%2Facme-challenge%2Fcheck-your-website-dot-server-daten-dot-de');</script></head>
<body style='background-color:white; color:white;'> Authentication required 
<!-- You are authenticated as: anonymous Groups that you are in: Permission you need to have (but didn't): hudson.model.Hudson.Read ... which is implied by: hudson.security.Permission.GenericRead ... which is implied by: hudson.model.Hudson.Administer -->
 </body></html>

So it's impossible that Letsencrypt validates your domain (if you use http validation).

There is a nginx.

What's the configuration of that login redirect? You should remove that redirect if /.well-known/acme-challenge is the first part of the path.

1 Like
3

Thanks for replying @JuergenAuer.

I understand what you are saying but the weird thing is I had renewed the certificate twice before without making any changes. And but something happened this time.

This is the nginx config.

upstream jenkins {
server 127.0.0.1:8080 fail_timeout=0;
}

server {
if ($host = devjenkins.goeasyuat.com) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name devjenkins.goeasyuat.com;
error_page 403 /jenkins-on-azure;
location / {
return 301 https://$host$request_uri;
}
location '/.well-known/acme-challenge' {
default_type "text/plain";
root      /var/www/letsencrypt;
allow all;
try_files $uri =404;
break;

}

listen 443 ssl;
server_name devjenkins.goeasyuat.com;
ssl_certificate /etc/letsencrypt/live/devjenkins.goeasyuat.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/devjenkins.goeasyuat.com/privkey.pem; # managed by Certbot

ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_ciphers ‘ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA2
56:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SH
A384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-S
HA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SH
A:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA’;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;
location / {
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect http:// https://;
proxy_buffering off;
proxy_pass http://localhost:8080;
}

Where should I remove the redirect from?

4

Looks like that block

doesn't work, instead, there is a redirect http -> https.

Perhaps change the order of these two location definitions and restart your nginx. Or you have other definitions, so that definition isn't used.

What says

nginx -T
5

By changing, do you mean to move “listen 443 ssl” part on top and then listen 80?

nginx -T output below:
`nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

configuration file /etc/nginx/nginx.conf:

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
worker_connections 768;
# multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

server_tokens off;

     server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

}

#mail {

# See sample authentication script at:

# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript

# auth_http localhost/auth.php;

# pop3_capabilities “TOP” “USER”;

# imap_capabilities “IMAP4rev1” “UIDPLUS”;

server {

listen localhost:110;

protocol pop3;

proxy on;

}

server {

listen localhost:143;

protocol imap;

proxy on;

}

#}

configuration file /etc/nginx/mime.types:

types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;

text/mathml                           mml;
text/plain                            txt;
text/vnd.sun.j2me.app-descriptor      jad;
text/vnd.wap.wml                      wml;
text/x-component                      htc;

image/png                             png;
image/tiff                            tif tiff;
image/vnd.wap.wbmp                    wbmp;
image/x-icon                          ico;
image/x-jng                           jng;
image/x-ms-bmp                        bmp;
image/svg+xml                         svg svgz;
image/webp                            webp;

application/font-woff                 woff;
application/java-archive              jar war ear;
application/json                      json;
application/mac-binhex40              hqx;
application/msword                    doc;
application/pdf                       pdf;
application/postscript                ps eps ai;
application/rtf                       rtf;
application/vnd.apple.mpegurl         m3u8;
application/vnd.ms-excel              xls;
application/vnd.ms-fontobject         eot;
application/vnd.ms-powerpoint         ppt;
application/vnd.wap.wmlc              wmlc;
application/vnd.google-earth.kml+xml  kml;
application/vnd.google-earth.kmz      kmz;
application/x-7z-compressed           7z;
application/x-cocoa                   cco;
application/x-java-archive-diff       jardiff;
application/x-java-jnlp-file          jnlp;
application/x-makeself                run;
application/x-perl                    pl pm;
application/x-pilot                   prc pdb;
application/x-rar-compressed          rar;
application/x-redhat-package-manager  rpm;
application/x-sea                     sea;
application/x-shockwave-flash         swf;
application/x-stuffit                 sit;
application/x-tcl                     tcl tk;
application/x-x509-ca-cert            der pem crt;
application/x-xpinstall               xpi;
application/xhtml+xml                 xhtml;
application/xspf+xml                  xspf;
application/zip                       zip;

application/octet-stream              bin exe dll;
application/octet-stream              deb;
application/octet-stream              dmg;
application/octet-stream              iso img;
application/octet-stream              msi msp msm;

application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet          xlsx;
application/vnd.openxmlformats-officedocument.presentationml.presentation  pptx;

audio/midi                            mid midi kar;
audio/mpeg                            mp3;
audio/ogg                             ogg;
audio/x-m4a                           m4a;
audio/x-realaudio                     ra;

video/3gpp                            3gpp 3gp;
video/mp2t                            ts;
video/mp4                             mp4;
video/mpeg                            mpeg mpg;
video/quicktime                       mov;
video/webm                            webm;
video/x-flv                           flv;
video/x-m4v                           m4v;
video/x-mng                           mng;
video/x-ms-asf                        asx asf;
video/x-ms-wmv                        wmv;
video/x-msvideo                       avi;

}

configuration file /etc/nginx/sites-enabled/default:

upstream jenkins {
server 127.0.0.1:8080 fail_timeout=0;
}

server {
if ($host = devjenkins.goeasyuat.com) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name devjenkins.goeasyuat.com;
error_page 403 /jenkins-on-azure;
location / {
return 301 https://$host$request_uri;
}
location '/.well-known/acme-challenge' {
default_type "text/plain";
root      /var/www/letsencrypt;
allow all;
try_files $uri =404;
break;

}

}

server {
listen 443 ssl;
server_name devjenkins.goeasyuat.com;
ssl_certificate /etc/letsencrypt/live/devjenkins.goeasyuat.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/devjenkins.goeasyuat.com/privkey.pem; # managed by Certbot

ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_ciphers ‘ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA’;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;
location / {
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect http:// https://;
proxy_buffering off;
proxy_pass http://localhost:8080;
}

}`

6

The goal is to auto renew the certificate. And I don’t see that happening if we have changes definitions temporarily.
The link serves Jenkins. How would you suggest this be achieved?

7

As written: The order of these two location definitions, not the order of the listen or server definitions.

So the location /.well-known... is the first block.

1 Like
8

@JuergenAuer

So, when I removed the part I was able to renew. But when I put it back it’s giving the same error. Below is the configuration I put in. switched the location definition.

upstream jenkins {
server 127.0.0.1:8080 fail_timeout=0;
}

server {

listen 80;
server_name devjenkins.goeasyuat.com;
error_page 403 /jenkins-on-azure;
location ‘/.well-known/acme-challenge’ {
default_type “text/plain”;
root /var/www/letsencrypt;
allow all;
try_files $uri =404;
break;
}
if ($host = devjenkins.goeasyuat.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
location / {
return 301 https://$host$request_uri;
}
}

1 Like
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.