Requesting a certificate - Invalid response from ... 204

My domain is: justsnoxbingo.com/

I ran this command: certbot --nginx

It produced this output:

Requesting a certificate for justsnoxbingo.com and www.justsnoxbingo.com

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: justsnoxbingo.com
  Type:   unauthorized
  Detail: 2001:8d8:100f:f000::200: Invalid response from http://justsnoxbingo.com/.well-known/acme-challenge/LVR5q7ab28z94QCEx9vlAX1gUssz4jnzsnElCdyyL3Q: 204

  Domain: www.justsnoxbingo.com
  Type:   unauthorized
  Detail: 2001:8d8:100f:f000::200: Invalid response from http://www.justsnoxbingo.com/.well-known/acme-challenge/oM0hfg_ztKc5UcVXTIwCmxJ0g1rNg6GgtHsxrPK_CUc: 204

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):
nginx version: nginx/1.18.0 (Ubuntu)

The operating system my web server runs on is (include version):
Distributor ID: Ubuntu
Description: Ubuntu 22.04.3 LTS
Release: 22.04
Codename: jammy

I can login to a root shell on my machine (yes or no, or I don't know): yes

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 2.9.0

Nginx config file:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip2.conf:
load_module modules/ngx_http_geoip2_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:
load_module modules/ngx_http_image_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:
load_module modules/ngx_http_xslt_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:
load_module modules/ngx_mail_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:
load_module modules/ngx_stream_module.so;

# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip2.conf:
load_module modules/ngx_stream_geoip2_module.so;

# configuration file /etc/nginx/mime.types:

types {
    text/html                             html htm shtml;
    text/css                              css;
    text/xml                              xml;
    image/gif                             gif;
    image/jpeg                            jpeg jpg;
    application/javascript                js;
    application/atom+xml                  atom;
    application/rss+xml                   rss;

    text/mathml                           mml;
    text/plain                            txt;
    text/vnd.sun.j2me.app-descriptor      jad;
    text/vnd.wap.wml                      wml;
    text/x-component                      htc;

    image/png                             png;
    image/tiff                            tif tiff;
    image/vnd.wap.wbmp                    wbmp;
    image/x-icon                          ico;
    image/x-jng                           jng;
    image/x-ms-bmp                        bmp;
    image/svg+xml                         svg svgz;
    image/webp                            webp;

    application/font-woff                 woff;
    application/java-archive              jar war ear;
    application/json                      json;
    application/mac-binhex40              hqx;
    application/msword                    doc;
    application/pdf                       pdf;
    application/postscript                ps eps ai;
    application/rtf                       rtf;
    application/vnd.apple.mpegurl         m3u8;
    application/vnd.ms-excel              xls;
    application/vnd.ms-fontobject         eot;
    application/vnd.ms-powerpoint         ppt;
    application/vnd.wap.wmlc              wmlc;
    application/vnd.google-earth.kml+xml  kml;
    application/vnd.google-earth.kmz      kmz;
    application/x-7z-compressed           7z;
    application/x-cocoa                   cco;
    application/x-java-archive-diff       jardiff;
    application/x-java-jnlp-file          jnlp;
    application/x-makeself                run;
    application/x-perl                    pl pm;
    application/x-pilot                   prc pdb;
    application/x-rar-compressed          rar;
    application/x-redhat-package-manager  rpm;
    application/x-sea                     sea;
    application/x-shockwave-flash         swf;
    application/x-stuffit                 sit;
    application/x-tcl                     tcl tk;
    application/x-x509-ca-cert            der pem crt;
    application/x-xpinstall               xpi;
    application/xhtml+xml                 xhtml;
    application/xspf+xml                  xspf;
    application/zip                       zip;

    application/octet-stream              bin exe dll;
    application/octet-stream              deb;
    application/octet-stream              dmg;
    application/octet-stream              iso img;
    application/octet-stream              msi msp msm;

    application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet          xlsx;
    application/vnd.openxmlformats-officedocument.presentationml.presentation  pptx;

    audio/midi                            mid midi kar;
    audio/mpeg                            mp3;
    audio/ogg                             ogg;
    audio/x-m4a                           m4a;
    audio/x-realaudio                     ra;

    video/3gpp                            3gpp 3gp;
    video/mp2t                            ts;
    video/mp4                             mp4;
    video/mpeg                            mpeg mpg;
    video/quicktime                       mov;
    video/webm                            webm;
    video/x-flv                           flv;
    video/x-m4v                           m4v;
    video/x-mng                           mng;
    video/x-ms-asf                        asx asf;
    video/x-ms-wmv                        wmv;
    video/x-msvideo                       avi;
}

# configuration file /etc/nginx/sites-enabled/justsnoxbingo.com:
server {
        listen 80;
        listen [::]:80;

        server_name justsnoxbingo.com www.justsnoxbingo.com;

        root /var/www/justsnoxbingo.com;
        index index.html;

        location / {
                try_files $uri $uri/ =404;
        }
}

Welcome to the community @CoroXx3

The 204 error code means your server returned the HTTP 204 No Content result to the Let's Encrypt server. The LE server makes an HTTP request to your domain to validate your request.

I don't see anything in that nginx conf that would cause the 204. Do you have any other equipment or software in front of nginx? Like maybe a router that might be inspecting the HTTP request and rejecting it with a 204? Or a firewall that does that? Do you have a Palo Alto brand firewall by any chance?

Also oddly, requests to your "home" page get replied to from an Apache server. Can you explain how Apache and nginx interact on your system? It is technically possible to mix them but requires special care.

# IPv6 request to your home page gets a 200 from Apache
curl -I6 http://justsnoxbingo.com
HTTP/1.1 200 OK
Server: Apache

# IPv6 ACME challenge test request gets a 204 from nginx
curl -I6 http://justsnoxbingo.com/.well-known/acme-challenge/Test404
HTTP/1.1 204
Server: nginx
3 Likes

Since it is the first webhosting I try to do, I now purged nginx from the server and tried to move to Apache and still get the 204 when running the certbot --apache now.

Blockquote
Also oddly, requests to your "home" page get replied to from an Apache server. Can you explain how Apache and nginx interact on your system? It is technically possible to mix them but requires special care.

How can it be possible if i just had to install apache2 to the server

I dont think there was any software in front of nginx

I am just confused right now since its my first project in that field,hosting it on a root server rented at hetzner right now

You need to speak with Hetzner then. I see the same results for IPv4 and v6 results as I saw before. That is, an nginx system responds to the acme challenge but Apache for "home" page.

Hetzner probably has some system intercepting ACME challenge requests so they can handle it for you. Talk with them about how best to manage certs with the hosting product you purchased from them.

3 Likes

Thank you very much, i will do that!

2 Likes

If that is indeed the nginx server that responds to the ACME challenge requests, you should be able to prove/disprove it.
But placing a test text file in the expected challenge location and then accessing it from the Internet:

- mkdir -p /var/www/justsnoxbingo.com/.well-known/acme-challenge
- echo "test" /var/www/justsnoxbingo.com/.well-known/acme-challenge/Test_File-1234
- http://justsnoxbingo.com/.well-known/acme-challenge/Test_File-1234
- http://www.justsnoxbingo.com/.well-known/acme-challenge/Test_File-1234
1 Like

It shows me nginx, but still getting the 204

Let's have a look at the whole nginx config, with:

nginx -T

1 Like
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip2.conf:
load_module modules/ngx_http_geoip2_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:
load_module modules/ngx_http_image_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:
load_module modules/ngx_http_xslt_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:
load_module modules/ngx_mail_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:
load_module modules/ngx_stream_module.so;

# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip2.conf:
load_module modules/ngx_stream_geoip2_module.so;

# configuration file /etc/nginx/mime.types:

types {
    text/html                             html htm shtml;
    text/css                              css;
    text/xml                              xml;
    image/gif                             gif;
    image/jpeg                            jpeg jpg;
    application/javascript                js;
    application/atom+xml                  atom;
    application/rss+xml                   rss;

    text/mathml                           mml;
    text/plain                            txt;
    text/vnd.sun.j2me.app-descriptor      jad;
    text/vnd.wap.wml                      wml;
    text/x-component                      htc;

    image/png                             png;
    image/tiff                            tif tiff;
    image/vnd.wap.wbmp                    wbmp;
    image/x-icon                          ico;
    image/x-jng                           jng;
    image/x-ms-bmp                        bmp;
    image/svg+xml                         svg svgz;
    image/webp                            webp;

    application/font-woff                 woff;
    application/java-archive              jar war ear;
    application/json                      json;
    application/mac-binhex40              hqx;
    application/msword                    doc;
    application/pdf                       pdf;
    application/postscript                ps eps ai;
    application/rtf                       rtf;
    application/vnd.apple.mpegurl         m3u8;
    application/vnd.ms-excel              xls;
    application/vnd.ms-fontobject         eot;
    application/vnd.ms-powerpoint         ppt;
    application/vnd.wap.wmlc              wmlc;
    application/vnd.google-earth.kml+xml  kml;
    application/vnd.google-earth.kmz      kmz;
    application/x-7z-compressed           7z;
    application/x-cocoa                   cco;
    application/x-java-archive-diff       jardiff;
    application/x-java-jnlp-file          jnlp;
    application/x-makeself                run;
    application/x-perl                    pl pm;
    application/x-pilot                   prc pdb;
    application/x-rar-compressed          rar;
    application/x-redhat-package-manager  rpm;
    application/x-sea                     sea;
    application/x-shockwave-flash         swf;
    application/x-stuffit                 sit;
    application/x-tcl                     tcl tk;
    application/x-x509-ca-cert            der pem crt;
    application/x-xpinstall               xpi;
    application/xhtml+xml                 xhtml;
    application/xspf+xml                  xspf;
    application/zip                       zip;

    application/octet-stream              bin exe dll;
    application/octet-stream              deb;
    application/octet-stream              dmg;
    application/octet-stream              iso img;
    application/octet-stream              msi msp msm;

    application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet          xlsx;
    application/vnd.openxmlformats-officedocument.presentationml.presentation  pptx;

    audio/midi                            mid midi kar;
    audio/mpeg                            mp3;
    audio/ogg                             ogg;
    audio/x-m4a                           m4a;
    audio/x-realaudio                     ra;

    video/3gpp                            3gpp 3gp;
    video/mp2t                            ts;
    video/mp4                             mp4;
    video/mpeg                            mpeg mpg;
    video/quicktime                       mov;
    video/webm                            webm;
    video/x-flv                           flv;
    video/x-m4v                           m4v;
    video/x-mng                           mng;
    video/x-ms-asf                        asx asf;
    video/x-ms-wmv                        wmv;
    video/x-msvideo                       avi;
}

# configuration file /etc/nginx/sites-enabled/justsnoxbingo.com:
server {
        listen 80;
        listen [::]:80;

        server_name justsnoxbingo.com www.justsnoxbingo.com;

        root /var/www/justsnoxbingo.com;
        index index.html;

        location / {
                try_files $uri $uri/ =404;
        }
}

Have you spoken to Hetzner yet? Your Apache responds to "home" page requests but some nginx system responds just to acme challenge requests.

Since you did not setup such a system then it is likely something Hetzner did.

Right now I still see the same thing I saw back in post #2

3 Likes

I haven't reached out to Hetzner yet, but I also switched back to NGINX, with removing all apache2 from the Webserver and I cant seem to see any entries that would show that there is apache still running or is there anymore of apache that i need to stop?

Like you said the acme-challenge replys from nginx but the normal request from Apache

Are there any commands i can run to show you more?

What shows?:
ps -ef | grep -v grep | grep -Ei 'apache|nginx|docker'

2 Likes

It shows:


root         992       1  0 Feb19 ?        00:00:28 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
root       79971       1  0 08:01 ?        00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data  108226   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108227   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108228   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108229   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108230   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108231   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108232   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108233   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108234   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108235   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108236   79971  0 12:16 ?        00:00:00 nginx: worker process
www-data  108237   79971  0 12:16 ?        00:00:00 nginx: worker process

That shows nginx and docker running.

What shows?:
netstat -pant | grep -i listen | grep 80

2 Likes

It shows:

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      79971/nginx: master
tcp        0      0 127.0.0.1:8081          0.0.0.0:*               LISTEN      1625/AMP_Linux_x86_
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      1186/AMP_Linux_x86_
tcp6       0      0 :::80                   :::*                    LISTEN      79971/nginx: master

That shows that nginx is the one listening on port 80 [that's good].

Did you do those two steps?

2 Likes

It was a problem in how the Records were set up, we used a tool from the site where the domain was registered, but it first let the traffic go through a server of theirs

But now I get the following problem:
Unsupported RSA key length: 1024

What command did you run to get that error message?

2 Likes

certbot install --cert-name justsnoxbingo.com

Please show:
certbot certificates

2 Likes