Hi all, I'm migrating some sites to a new server. They have all gone perfectly fine until this site. When I try to install a certificate it returns the following.
Could not issue an SSL/TLS certificate for duocloud.net.nz
Details
Could not request a Let's Encrypt SSL/TLS certificate for duocloud.net.nz.
and сheck if the authorization token is available.
If it is, try to request the certificate again. If the token is not available, there may be an issue with your DNS configuration.
Your domain in Plesk is hosted on the IP address(es): , but the DNS challenge used another IP: 103.18.56.178.
103.18.56.178 is the old server IP. How is the challenge trying to look up on the old server IP if the domain DNS records are set to the new server IP?
I'm using Plesk on Windows Server 2019 (shared hosting)
duocloud.net.nz is the main domain name and there are several domain alias that all can be secured apart from smartlivingspaces.nz. Even www.smartlivingspaces.nz will work but not the non www version. I've double checked DNS settings and everything points to the right IP address. I originally had smartlivingspaces.nz set as the main domain but got the same result. I'm pretty stumped as to where I'm going wrong as the configuration is the same as all the other sites I've migrated.
You have to start at the DNS tree root: nslookup -q=ns smartlivingspaces.nz a.root-servers.net
That output gets you closer.
Pick one of those nameservers and ask it: nslookup -q=ns smartlivingspaces.nz ns1.dns.net.nz
That output shows:
So is this something that registra needs to fix at their end? The domain is held by the client so I have to instruct them to make changes or request support. Sorry I'm not too sure what you are meaning regarding the NS records needing to be added.
The actual reason this is failing has yet to be determined.
I'm thinking/guessing that maybe the authoritative nameservers are returning different values to different requestors [globally].
That sounds odd - but possible when they are running Anycast type IPs and more than one system responds to any single IP.
Like with: 8.8.8.8 or 1.1.1.1
I'm waiting on the client to respond re the Nameservers. Interesting thought that this domain would secure fine on the previous Plesk server with the same DNS settings. Only change has been the A records to point at the new server.
DNSViz does not reveal the problem at hand.
ID 13646 is one of three set in the root zone for .nz to use. .nz is using the other two without a problem - but not that one.
Even unbound is not really showing us much of any error detail.
My guess is that the authoritative nameservers are behind some kind of IPS/FW that is blocking LE and Let's Debug [specifically by IP; OR generally - based on the networks that they currently reside in].
The Let's Debug initial test is fine it is only when it tries the staging system that it fails. So it is consistently affecting just the Let's Encrypt servers.
