Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
maksikoms.lv
I ran this command:
I use Virtualmin Letsencrypt option
It produced this output:
Traceback (most recent call last):
File “/usr/share/webmin/webmin/acme_tiny.py”, line 198, in
main(sys.argv[1:])
File “/usr/share/webmin/webmin/acme_tiny.py”, line 194, in main
signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact)
File “/usr/share/webmin/webmin/acme_tiny.py”, line 143, in get_crt
raise ValueError(“Wrote file to {0}, but couldn’t download {1}: {2}”.format(wellknown_path, wellknown_url, e))
ValueError: Wrote file to /home/maksikoms/public_html/.well-known/acme-challenge/wCti7e45pkQVyN5aKbFQuyjQU3uxUDaICFZW7adhJ4U, but couldn’t download http://maksikoms.lv/.well-known/acme-challenge/wCti7e45pkQVyN5aKbFQuyjQU3uxUDaICFZW7adhJ4U: Error:
Url: http://maksikoms.lv/.well-known/acme-challenge/wCti7e45pkQVyN5aKbFQuyjQU3uxUDaICFZW7adhJ4U
Data: None
Response Code: None
Response: <urlopen error [Errno 110] Connection timed out>
My web server is (include version):
Apache 2 on Debian 10 iwth Virtualmin
The operating system my web server runs on is (include version):
Debian 10 wth Virtualmin
My hosting provider, if applicable, is:
Own server
I can login to a root shell on my machine (yes or no, or I don’t know):
Yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
Virtualmin
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
In addition I can confirm that using link http://maksikoms.lv/.well-known/acme-challenge/wCti7e45pkQVyN5aKbFQuyjQU3uxUDaICFZW7adhJ4U
in browser from remote location I actually get file displayed.
I thought the problem was with SSL redirect for this folder, but after disabling redirect nothing changed.
I actually don’t see any requests from Letsencrypt servers to my site in firewall (I see all requests I do manually from external IPs). Does it mean that lestencrypt in fact do not check link?
I see that there is limitation of number od requests. As I found that renewal failed only after certificate expiration, it was probably enough requests to be over limit of 20. How can I check this?
Can I validate certificate manually to get it working for now?
If can’t make it working, the onlt way is disable letsencrypt and get some static certificate…
Thnaks in advance for any ideas,
[Mon Jun 22 13:31:11.611016 2020] [so:warn] [pid 8720] AH01574: module dav_module is already loaded, skipping
VirtualHost configuration:
10.0.2.109:443 is a NameVirtualHost
default server maxicom.lv (/etc/apache2/sites-enabled/0-maxicom.lv.conf:56)
port 443 namevhost maxicom.lv (/etc/apache2/sites-enabled/0-maxicom.lv.conf:56)
alias www.maxicom.lv
alias webmail.maxicom.lv
alias admin.maxicom.lv
port 443 namevhost e-meter.eu (/etc/apache2/sites-enabled/e-meter.eu.conf:69)
alias www.e-meter.eu
alias webmail.e-meter.eu
alias admin.e-meter.eu
port 443 namevhost maksikoms.lv (/etc/apache2/sites-enabled/maksikoms.lv.conf:58)
alias www.maksikoms.lv
wild alias *.maksikoms.lv
*:80 is a NameVirtualHost
default server maxicom.lv (/etc/apache2/sites-enabled/0-maxicom.lv.conf:1)
port 80 namevhost maxicom.lv (/etc/apache2/sites-enabled/0-maxicom.lv.conf:1)
alias www.maxicom.lv
alias webmail.maxicom.lv
alias admin.maxicom.lv
port 80 namevhost e-meter.eu (/etc/apache2/sites-enabled/e-meter.eu.conf:1)
alias www.e-meter.eu
alias webmail.e-meter.eu
alias admin.e-meter.eu
port 80 namevhost maksikoms.lv (/etc/apache2/sites-enabled/maksikoms.lv.conf:1)
alias www.maksikoms.lv
wild alias *.maksikoms.lv
ServerRoot: “/etc/apache2”
Main DocumentRoot: “/var/www/html”
Main ErrorLog: “/var/log/apache2/error.log”
Mutex authdigest-opaque: using_defaults
Mutex watchdog-callback: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex authdigest-client: using_defaults
Mutex fcgid-proctbl: using_defaults
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/run/apache2/" mechanism=default
Mutex mpm-accept: using_defaults
Mutex fcgid-pipe: using_defaults
PidFile: “/var/run/apache2/apache2.pid”
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
Define: ENABLE_USR_LIB_CGI_BIN
User: name=“www-data” id=33
Group: name=“www-data” id=33
What I can’t really understand – if I can download challenge file manually, than there must be no problem with validation, and the problem isn’t with apache config? But than I have nowhere to look…
I looked on issued certificates and for a moment thought that certificates are issued. But looking on date I see that it all worked for 2 years perfectly and stopped after 12th of march 2020, when last cert was issued.
I think, I installed some updates to server than.
Thanks in advance!
My mistake, I added it when started to troubleshoot today. There was redirect to SSL set in .htaccess file, and before I found it, I added this directory statement. But now redirect is disabled.
Before, when redirect was enabled, entering test link in browser still provided file, but as cert was expired, it worked only if browser was accepting this site. Now it works without redirect, and I can get file in http:
I'll correct path now.
[Mon Jun 22 13:43:33.001580 2020] [fcgid:warn] [pid 9825] [client 46.229.168.138:5598] mod_fcgid: stderr: PHP Notice: Undefined variable: tooltip in /home/maksikoms/public_html/templates/maxicom/html/com_attachments/attachments/default.php on line 119
[Mon Jun 22 13:50:38.605647 2020] [fcgid:warn] [pid 9833] [client 208.73.255.133:49750] mod_fcgid: stderr: PHP Notice: Array to string conversion in /home/maksikoms/public_html/components/com_content/views/featured/tmpl/default.php on line 96
Only see lines for “AppleNewsBot” , no letsencrypt related anything. But it shows that it is possible to download file. Can’t imagine, why bot needs it, probably downloads everything what it can download.
Then there may be a DNS problem form their end or access to your IP is blocked form their IP.
Geolocation blocking perhaps…
Do you have an IPS or other firewall inline that might block?
By letsencrypt or by my firewall? I don’t have any GEO limitations on my FW. I even removed blacklists, in case letsencrypt got blocked by it.
Any ideas what else to do?