Sudo certbot --nginx error

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: tifonder.net
this error log: https://tmpfiles.org/dl/22053295/letsencrypt.log
I ran this command: sudo certbot --nginx

It produced this output: Account registered.

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.

1: tifonder.net
2: www.tifonder.net
3: www1.tifonder.net

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1 2
Requesting a certificate for tifonder.net and www.tifonder.net

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: www.tifonder.net
Type: caa
Detail: During secondary validation: While processing CAA for www.tifonder.net: CAA record for tifonder.net prevents issuance

Domain: tifonder.net
Type: unauthorized
Detail: 2a02:4780:27:1567:0:388c:2fff:3: Invalid response from http://tifonder.net/.well-known/acme-challenge/QTvLRItQIPukp0Rxi37dnyZWY7e98azXU_SDAS0ovCc: 404

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version): nginx version: nginx/1.26.3

The operating system my web server runs on is (include version): Ubuntu 24.04.2 LTS

My hosting provider, if applicable, is: Hostinger

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): * [CloudPanel - v2.5.1

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 3.2.0

2

Looks like you have two problems. First, the CAA record in your DNS does not allow Let's Encrypt to issue a cert. The CAA records were possibly setup by your DNS hosting service. You need to adjust those as described here: Let's Debug

Another problem is you have IPv4 and IPv6 addresses in your DNS. That is fine but what is not good is that they point to different servers. We often see this on new Hostinger setups.

The IPv4 address points to an nginx server. But, the IPv6 address points to a Hostinger service. Hostinger creates this AAAA record automatically for new setups.

You need to update the AAAA address or remove it if you do not support IPv6.

Any client trying to use IPv6 will connect to that Hostinger service instead of your server.
Let's Encrypt favors IPv6 when an AAAA record is present.

See Hostinger article here: How to manage AAAA records | Hostinger Help Center

3 Likes
3

Hi. thank you very much for your support.
no issue Let's Debug.
and i deleted the AAAA record. DNS Checker - DNS Check Propagation Tool

  1. Is it ok these 2 records:
    |CAA|@|0|0 issue "letsencrypt.org"|14400|
    | --- | --- | --- | --- | --- | --- |
    |CAA|@|0|0 issuewild "letsencrypt.org"|14400|
  2. I tried again and getting errors https://tmpfiles.org/dl/22062708/last-letsencrypt.txt
1 Like
4

Hmm. HTTP requests using port 80 get a reply from a LiteSpeed server. Not an nginx server.

Request to: tifonder.net, Result: Address=213.130.145.63,Address Type=IPv4,Server=LiteSpeed

You should double-check the IPv4 address in your DNS.

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: tifonder.net
  Type:   unauthorized
  Detail: 213.130.145.63: Invalid response from http://tifonder.net/.well-known/acme-challenge/K31IkePt8_-SXdreFX9-Eo3tqoSP5Xihn1wsYZz3fD8: 404

  Domain: www.tifonder.net
  Type:   unauthorized
  Detail: 213.130.145.63: Invalid response from http://www.tifonder.net/.well-known/acme-challenge/zStMZGMwI8Cj1NMVMekWmudiGKmq6kwp413jLFqay3k: 404
2 Likes
5

fix the issue with dns.
now getting: NEXT STEPS:

  • The certificate was saved, but could not be installed (installer: nginx). After fixing the error shown below, try installing it again by running:
    certbot install --cert-name tifonder.net

nginx restart failed:
nginx: [emerg] no "ssl_certificate" is defined for the "listen ... quic" directive in /etc/nginx/sites-enabled/www.tifonder.net.conf:120 I tried to fix with gpt but no success: config file: https://tmpfiles.org/dl/22068934/www.tifonder.net.conf

6

Does your nginx system support quic?

Do you need quic? It is not something we see much.

You might just try commenting out the listen lines for that. I know quic needs some special care but you'll have to wait for others to comment about that. Or, visit an nginx forum to ask how to configure quic.

3 Likes
7

A post was split to a new topic: Certbot fails with DNS problem

8

Sir. I disabled the quic listen and the issue was solved.
thank you very much for your efforts

2 Likes