Requesting a certificate fails with "Some challenges have failed."

Help
1

My domain is: chrisvdw.net / www.chrisvdw.net

I ran this command: sudo certbot --nginx -d chrisvdw.net -d www.chrisvdw.net

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for chrisvdw.net and www.chrisvdw.net

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: chrisvdw.net
  Type:   unauthorized
  Detail: 2a01:4f8:d0a:27bd::2: Invalid response from http://chrisvdw.net/.well-known/acme-challenge/gvhNYjMBINqsNcRqLn34-MCk3yX8FQBMO39xiSPibyE: 404

  Domain: www.chrisvdw.net
  Type:   unauthorized
  Detail: 2a01:4f8:d0a:27bd::2: Invalid response from http://www.chrisvdw.net/.well-known/acme-challenge/2mkbrTB3ACA2ngKJp0wHm6gQnqkDIWSrI0KWGXEF5Bc: 404

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.

My web server is (include version): nginx/1.24.0 (Ubuntu)

The operating system my web server runs on is (include version): Ubuntu 24.04.1 LTS

My hosting provider, if applicable, is: Hetzner

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.9.0

Additional information:

  • https://letsdebug.net/ says that all looks good
  • My ufw settings match the ones in the this tutorial
  • For certbot, I was following this tutorial
  • ifconfig and Hetzner tell me I have and IP4 and IP6 address and I think(!) set up the DNS entries correctly (it was first off, so letsdebug showed an error)
2

Hi @vdw, and welcome to the LE community forum :slight_smile:

It seems that the IPv4 and IPv6 responses are not equal:

curl -Ii4 chrisvdw.net
HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Thu, 05 Sep 2024 13:21:20 GMT
Content-Type: text/html
Content-Length: 136       <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Last-Modified: Thu, 05 Sep 2024 12:01:48 GMT
Connection: keep-alive
ETag: "66d99dac-88"
Accept-Ranges: bytes

curl -Ii6 chrisvdw.net
HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Thu, 05 Sep 2024 13:21:26 GMT
Content-Type: text/html
Content-Length: 615       <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Last-Modified: Thu, 05 Sep 2024 11:30:48 GMT
Connection: keep-alive
ETag: "66d99668-267"
Accept-Ranges: bytes

Ensure that nginx can serve content for your site via both IPv4 and IPv6:

Name:      chrisvdw.net
Addresses: 2a01:4ff:2f0:109a::1
           5.223.43.0
4 Likes
3

Thanks a lot for your reply. Based on your suggestion, I've changed my nginx file from

listen 80;

to

listen [::]:80;

After that the certbot command ran through without a hitch and it seems to be working.

I just noticed something I'm not sure about. When I run

  • curl -Ii4 chrisvdw.net and
  • curl -Ii6 chrisvdw.net

on the VPS machine, I see the same results for Content-Length. However when running both curl commands from some other machine, only Ii4 works. Ii6 gives me a Couldn't connect to server error.

So I'm not sure if certbot just used IP4 this time. In any case, all looks good for now. So thanks again for your help!

1 Like
4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.