SSL issue with itflow

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: portal.nerdnetworkgroup.com

I ran this command: sudo certbot --apache -d portal.nerdnetworkgroup.com

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for portal.nerdnetworkgroup.com

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: portal.nerdnetworkgroup.com
Type: unauthorized
Detail: 2a02:4780:1:1245:0:3155:137:6: Invalid response from http://portal.nerdnetworkgroup.com/.well-known/acme-challenge/D2ATg-ElgAdpn3nb1yhIf1NoGDlgAbpyymVo4PHx3Mg: 404

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): Server version: Apache/2.4.58 (Ubuntu)
Server built: 2025-04-03T14:36:49

The operating system my web server runs on is (include version): Ubuntu 24.04

My hosting provider, if applicable, is: Hostinger is where my domain is hosted

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):no im using my local onsite servers console

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.9.0

2

Hello @lgice348 and welcome. :slightly_smiling_face:

Here is some supplemental information.

HTTP Request redirects to HTTPS.

$ curl -Ii http://portal.nerdnetworkgroup.com
HTTP/1.1 301 Moved Permanently
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
date: Thu, 10 Apr 2025 17:51:12 GMT
server: LiteSpeed
location: https://portal.nerdnetworkgroup.com/
platform: hostinger
panel: hpanel
content-security-policy: upgrade-insecure-requests

HTTPS Request redirects to an IPv4 Address.

$ curl -Ii https://portal.nerdnetworkgroup.com/
HTTP/2 301
date: Thu, 10 Apr 2025 17:51:19 GMT
server: LiteSpeed
location: http://173.247.19.87/dashboard.php
platform: hostinger
panel: hpanel
content-security-policy: upgrade-insecure-requests
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
1 Like
3

You need to review the DNS for your domain. You can see from Bruce's info that a LiteSpeed server is replying to requests rather than your Apache

We often see this with new Hostinger setups.

Usually we see just the IPv6 "wrong" but both your IPv4 A record and IPv6 AAAA record in your DNS are wrong.

See Hostinger article here for further info: How to manage AAAA records | Hostinger Help Center

2 Likes
4

so im a total novice when it comes to domain names and ssl certs clearly i have realize that knowledge gap :slight_smile: so the normal nerdnetworkgroup.com point to a website hosted on hostinger but i wanted to setup a subdomain ie portal.nerdnetworkgroup.com to point to my hosted webapp on my server hosted locally so im not sure exactly how those dns records would need to be setup i can share those if that would help

5

Those are good questions for Hostinger support :slight_smile: Once you can connect to your portal subdomain and your Apache server using HTTP and a browser then try to get a certificate.

2 Likes
6

you can check what the Internet visible IP Address are with:

curl -4 ifconfig.me
curl -6 ifconfig.me

and/or

curl -4 ifconfig.co
curl -6 ifconfig.co

and/or

curl -4 ifconfig.io
curl -6 ifconfig.io

And then adjust your DNS A Records and AAAA Records (if any) to match.

1 Like
7

Awesome thank you so much for the help but i got it working after looking up the DNS records and fixing them!

2 Likes