Subdomain with A record on different server

Help
1

I have ServerA with CloudLinux where domain.com is served. On ServerA is the subdomain.domain.com defined with an A record pointing to ServerB with Debian 9, Nginx 1.10.3 by IP (ServerB is a different remote server).

While trying to issue a cert with Certbot 0.28.0 on ServerB for subdomain.domain.com I receive the following error: “Failed authorization procedure. subdomain.domain.com (http-01). urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from”

Tried with: certbot nginx
as well as with: certbot certonly --staging --webroot -w /var/www/domain/ -d subdomain.domain.com

The directories /.well-known/acme-challenge have both permission 755, a dummy file is accessible with curl and nginx is configured to always return content type /plain/text for this directory.

Nginx conf:

server {
listen      80;
listen      [::]:80 default_server ipv6only=on;
server_name subdomain.domain.com;

root /var/www/domain;

location ~ /\.well-known/acme-challenge {
    allow all;
    default_type text/plain;
}
}

Thanks!

2

A record of server B on server A? is server A authoritative name server for domain.com zone? (NS record fro domain.com from com zone tells server A’s IP?)

if not, A record set on server A won’t heard by anything. add proper A record for subdomain on where you bought the domain, or you use for DNS hosting

1 Like
3

The “A record” is defined on ServerA, pointing to subdomain.domain.com on ServerB by IP.

Yes, domain.com has NS entry pointing to the hoster of ServerA where domain.com is served from. Domain.com is accessible and works fine.

1 Like
4

if NS record direct to “Hoster” of server A, not A’s IP itself, then A record for subdomain must be added on hoster’s site menu.

1 Like
5

Thanks for your efforts!

Following DNS config is active:

domain.com                       A      IP ServerA
domain.com                       NS     ns1.hoster.com (different from IP ServerA)
domain.com                       NS     ns2.hoster.com (different from IP ServerA)
subdomain.domain.com             A      IP ServerB

What do you mean with “A record for subdomain must be added on hoster’s site menu.”?
The “A record” pointing to ServerB was entered in the hoster’s web panel where config is done for domain.com/ServerA

6

server A is red haring, so let’s turn it off(ignore it). would you expect your config to work if you do that?
if done right server B work even if server A is turned off.
use hoster.com’s API/web menu for DNS records for any subdomain. using IP of server B.

2 Likes
7

If global DNS can resolve that IP, then you need only look at ServerB.
Any other DNS entry is irrelevant to satisfy a challenge request for ServerB.

1 Like
8

Yes, both of these work and shows the content of the file:

2 Likes
9

So were you able to get a cert?

10

Unfortunately not. Your answers helped me to understand it better, but nothing was changed in configs so far, so the same error as in the original post still appears. I run the certbot command as root

11

Then there is some issue with the --webroot and the real root...
Try making a dedicated location for the challenges:
[something like]
sudo mkdir /ACME-challenges/
sudo chmod 777 /ACME-challenges/
then modify this location section:

to specify the challenge root:
[and slightly modified location]

location /.well-known/acme-challenge/ {
 allow all;
 default_type text/plain;
 root /ACME-challenges/;
 }#location

[restart/reload nginx]
Then place a testfle in that location and see if it is accessible from Internet and then rerun certbot.

12

Created the directory, and adopted nginx config per your suggestion. Instead of root /ACME-challenges/; I had to use the alias directive. The dummy file is accessible via browser. Ran certbot with certbot --staging --nginx.

Same error occurs: “Failed authorization procedure. subdomain.domain.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization”

13

What is your real domain and subdomain? What is the complete error message?

14

Try adding
-webroot -w /ACME-challenges/

15

Forgot to mention, also tried it before with the same error result: certbot certonly --staging --webroot -w /ACME-challenges/ -d subdomain.domain.com

Output from certbot:

Waiting for verification...
Cleaning up challenges
Failed authorization procedure. subdomain.domain.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://subdomain.domain.com/.well-known/acme-challenge/LkCaOmT0U57N8tGKQLCMd4isYX6jvDv90SA18GeutgA : "\n<html style="height:100%!(MISSING)">\n\n<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-"

IMPORTANT NOTES:

16

Does accessing that IP produce the testffile?
[maybe you are only checking IPv4 path]

17

No it doesn’t. Tested it with browser and curl -g. Should I test it in any other way?

18

Letsencrypt will always use ipv6 version first so if that can’t see file challenge will fail.

19

Hi @stabilo

checking your ipv6 there is a cPanel error message.

That’s one of the reasons your domain name is required: Too much missing informations.

If you have a cPanel, Certbot may not work. So your configuration is buggy.

20

If your test system has IPv6:
curl -6