im running a website using port 8080, because, port 80 doesnt work (for several reasons i dont wanna get into) it runs fine with http in port 8080 i just cant get it to work with certbot
It produced this output:Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: example.com
Type: connection
Detail: xxx.xxx.xxx.xxx: Fetching http://example.com: Timeout during connect (likely firewall problem)
You can run your website on whatever port you desire, but you can only perform acme validation on 80 for http-01 (it follows redirects to 443) or 443 for tls-alpn-01 (and 53 for dns-01, but that's quite different)
You could try a --manual DNS Challenge. We don't recommend that as permanent option but it would get you a cert quick and then you'd have time to work out an automated renewal method like acme-dns
When posting questions to this forum please provide the actual error and as much detail as you can. We've seen most errors and can probably help you guess the problem. It sounds like your amce-dns registration step is failing.
I did that and nginx -t gives me this error:
2024/08/01 17:09:10 [emerg] 5455#5455: SSL_CTX_load_verify_locations("/path/to/root_CA_cert_plus_intermediates") failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/path/to/root_CA_cert_plus_intermediates, r) error:10000080:BIO routines::no such file error:05880002:x509 certificate routines::system lib)
nginx: configuration file /etc/nginx/nginx.conf test failed
(Btw i set the config in /etc/nginx/sites-available
You shouldn't copy/paste the /path/to/signed_cert_plus_intermediates value verbatim, but change that value of ssl_certificate to the path to fullchain.pem as provided by Certbot. Same goes for /path/to/private_key but then the path to privkey.pem.
I have done that for both already, i dont know what root_CA_cert_plus_intermediates means and what i should put imstead of it, i only got fullchain.pem and privkey.pem
Probably chain.pem, as it's being used for OCSP stapling. Certbot didn't mention chain.pem in its output, but the file is present in the /live/ directory next to fullchain.pem and privkey.pem.
Yup.
And to my surprise, OCSP actually might not be a thing in the future (Yay!).
In my own experience, sometimes you will see a warning in nginx log. Just update your root store or upgrade to a newer, supported CA if you have chance.
It's nice to see you all, I'll go back to hibernate.