Renew Letsencrypt cert failed / removed & reinstalled everything

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:app-dev.sec.usace.army.mil

I ran this command:certbot --apache

It produced this output:Waiting for verification...
Challenge failed for domain app-dev.sec.usace.army.mil
http-01 challenge for app-dev.sec.usace.army.mil
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: app-dev.sec.usace.army.mil
    Type: dns
    Detail: DNS problem: SERVFAIL looking up CAA for sec.usace.army.mil

    • the domain's nameservers may be malfunctioning

My web server is (include version): apache 2.4

The operating system my web server runs on is (include version): redhat 7

My hosting provider, if applicable, is:aws

I can login to a root shell on my machine (yes or no, or I don't know):yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):certbot 1.7.0

this was all working for the last few months now its hosed. uninstalled /removed all files /reinstalled
dns is fine nslookup app-dev.sec.usace.army.mil
Server: 172.31.0.2
Address: 172.31.0.2#53

Non-authoritative answer:
app-dev.sec.usace.army.mil canonical name = ec2-3-213-47-79.compute-1.amazonaws.com.
Name: ec2-3-213-47-79.compute-1.amazonaws.com
Address: 172.31.57.144
not sure how I hosed it..have other servers that work fine ..just renewed another .sec domain server this week

now I get the rate limit error..sigh

1 Like
2

Hi @timr1

checking your domain via https://check-your-website.server-daten.de/?q=sec.usace.army.mil there are a lot of name server errors:

Server failures:

Host Type IP-Address is auth. ∑ Queries ∑ Timeout
sec.usace.army.mil Server failure yes 3 0
www.sec.usace.army.mil Server failure yes 3

Name servers without TCP support - that's fatal, every authoritative name server must support tcp connections.

And

13. CAA - Entries

Domainname flag Name Value ∑ Queries ∑ Timeout
usace.army.mil -2 Server failure - The name server was unable to process this query due to a problem with the name server 3 0
army.mil -2 Server failure - The name server was unable to process this query due to a problem with the name server 3 1
mil 0 no CAA entry found 1 0

Server failures checking CAA entries.

If possible, create a CAA entry with your complete domain name. Then the parent checks are skipped.

Same result with unboundtest - https://unboundtest.com/m/CAA/sec.usace.army.mil/4FG2ABGF

2 Likes
3

I get a different IP:

Name:    ec2-3-213-47-79.compute-1.amazonaws.com
Address:  3.213.47.79
Aliases:  app-dev.sec.usace.army.mil

The IP you show is internal to only AWS.

I am able to reach the Internet IP via port 80.

But there may be some underlying DNS issues with that FQDN.
see: https://dnsviz.net/d/app-dev.sec.usace.army.mil/dnssec/

[&2* readers: Get involved; Be heard. It starts with: if you read something you like, then like it :heart:]

1 Like
4

I show external dns working fine [treardon@lidar ~]$ nslookup app-dev.sec.usace.army.mil
Server: 8.8.8.8
Address: 8.8.8.8#53

Non-authoritative answer:
app-dev.sec.usace.army.mil canonical name = ec2-3-213-47-79.compute-1.amazo naws.com.
Name: ec2-3-213-47-79.compute-1.amazonaws.com
Address: 3.213.47.79
& its public right now

1 Like
5

You need to test with the staging system (before using the production system).

The (little) good news, so far: There seems to be no CAA blocking issues :slight_smile:

[&2* readers: Get involved; Be heard. It starts with: if you read something you like, then like it :heart:]

1 Like
6

the ip# is correct 3.213.47.79 (the other listed is the private aws ip#)
its up here http://3.213.47.79/
just renewed another .sec.usace.army.mil this week

1 Like
7

http://3.213.47.79/ is up others are up with the domain .sec.usace.army.mil
right now I get the rate error ..so Ill wait till tha clears

2 Likes
8

@griffin, please help me here.
I want to say: Please try: certbot --apache --dry-run
But that is not an allowed combination or elements (it creates havoc) - LOL

Maybe try this until we hear from "the expert":
certbot certonly -a apache --dry-run

[&2* readers: Get involved; Be heard. It starts with: if you read something you like, then like it :heart:]

2 Likes
9

Test

sudo certbot certonly --cert-name app-dev.sec.usace.army.mil --apache --dry-run

You most likely won't get a rate limit error when testing.

Live

sudo certbot run --cert-name app-dev.sec.usace.army.mil --apache --keep-until-expiring

2 Likes
10

This has been really common lately.

@lestaff

.mil subdomain (app-dev.sec.usace.army.mil) running into CAA and general nameserver errors. Any thoughts here?

2 Likes
11

Yes, we've seen this a number of times before with certain .mil domains and their subdomains, including army.mil. I second @JuergenAuer's suggestion above:

But even with that workaround in place, the DNSSEC chain will need to validate properly and the authoritative nameservers will need to support EDNS, or there will still be SERVFAILs:

I'm afraid things are not going to work reliably without standards-compliant authoritative DNS.

4 Likes
12

Thanks for the prompt response, James. :slightly_smiling_face: Always highly appreciated.

2 Likes
13

I think you should try changing the CNAME to an A record and see if that helps.

[&2* readers: Get involved; Be heard. It starts with: if you read something you like, then like it :heart:]

1 Like
14

Absolutely, @rg305. Makes sense to me.

1 Like
15

it has to be a CNAME cause its an aws ec2 alias to it

16

for now I got the orig letsencrypt certs back in place with an exp of 11/10/20
it was issued 8/12/20...so there never was a dns issue...for now its ok again.
had been renewing fine for a year or so..will try again monday..thanks for all the input

3 Likes
17

I do understand that.
My recommendation was simply to try it as an A record - just to see if that helped obtain the cert.
Not to switch it permanently to an A record.

[&2* readers: Get involved; Be heard. It starts with: if you read something you like, then like it :heart:]

2 Likes
18

Certainly worth trying. :slightly_smiling_face:

2 Likes
19

This needs a fix before that cert expires... Nov 10th is not that far away.
It's just not anything I can control :frowning:

[&2* readers: Get involved; Be heard. It starts with: if you read something you like, then like it :heart:]

2 Likes
20

Story of my life, brother. :wink:

2 Likes