The Certificate Authority failed to download the temporary challenge files created by Certbot -- Connection refused

Help
21

OK, I think nginx does things a bit differently than one expects.
Try making the challenge path within that root path:
mkdir /var/www/certbot/.well-known
mkdir /var/www/certbot/.well-known/acme-challenge
echo another-test-file > /var/www/certbot/.well-known/acme-challenge/Test-File-4321

then we test with:
http://alsharakagroup.com/.well-known/acme-challenge/Test-File-4321

22

Perhaps it is something as simple as a permissions problem for that location.

In any case, it would be helpful to have at least the nginx error_log enabled like this:

error_log       /var/log/nginx/InfoError.log info;

I assume that log folder exists. Change path if it does not. And restart nginx (reload might be enough but at this stage why chance it)

2 Likes
23

And, yeah, the test file 1234 was placed in the root - not acme-challenge - so would not have been found. The @rg305 commands for the 4321 file are better.

But, I am now getting the 'connection refused' response from the server again for http.

I still think it is good idea to have an error_log while debugging

2 Likes
24

Asked for them ^

1 Like
25

Yeah, I saw that but his answer did not provide clarity on that matter :slight_smile:

2 Likes
26

I apologize for the time, but I was trying to reduce the burden and solve the problem myself, but it was no use

nginx_1 | /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
nginx_1 | /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
nginx_1 | /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
nginx_1 | 10-listen-on-ipv6-by-default.sh: Getting the checksum of /etc/nginx/conf.d/default.conf
nginx_1 | 10-listen-on-ipv6-by-default.sh: /etc/nginx/conf.d/default.conf differs from the packages version, exiting
nginx_1 | /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
nginx_1 | /docker-entrypoint.sh: Configuration complete; ready for start up

27

@Elabbasy00 Yeah, that is not the nginx error_log I described. It has a format like:

2014/09/10 16:55:16 [crit] 10808#0: *2 stat() "/username/test/static/index.html" failed (13: Permission denied), client:, server: localhost, request: (omitted for brevity)
2014/09/10 16:55:16 [error] 10808#0: *2 rewrite or internal redirection cycle while internally redirecting to "/index.html

When debugging tricky problems, the more info we can gather the better. Just place the error_log line I described in the nginx server section for your port 80 server. I set the level to 'info' in that line to get the most data possible

It seems like you are really close. I am again successfully seeing your server on http and getting 301 as expected and 404 (as not expected if you added the -4321 test file per @rg305). We need more info to resolve.

2 Likes
28

error.log

2021/09/09 02:11:53 [error] 29#29: *1 open() "/var/www/certbot/.well-known/acme-challenge/SAbLZaBL7m-TNvQiFcX1AAof_6hFca5LRRqzoLP9B_s" failed (2: No such file or directory), client: 18.222.145.89, server: alsharakagroup.com, request: "GET /.well-known/acme-challenge/SAbLZaBL7m-TNvQiFcX1AAof_6hFca5LRRqzoLP9B_s HTTP/1.1", host: "alsharakagroup.com"

2021/09/09 02:11:53 [error] 29#29: *2 open() "/var/www/certbot/.well-known/acme-challenge/SAbLZaBL7m-TNvQiFcX1AAof_6hFca5LRRqzoLP9B_s" failed (2: No such file or directory), client: 34.219.64.153, server: alsharakagroup.com, request: "GET /.well-known/acme-challenge/SAbLZaBL7m-TNvQiFcX1AAof_6hFca5LRRqzoLP9B_s HTTP/1.1", host: "alsharakagroup.com"

2021/09/09 02:11:53 [error] 29#29: *3 open() "/var/www/certbot/.well-known/acme-challenge/SAbLZaBL7m-TNvQiFcX1AAof_6hFca5LRRqzoLP9B_s" failed (2: No such file or directory), client: 66.133.109.36, server: alsharakagroup.com, request: "GET /.well-known/acme-challenge/SAbLZaBL7m-TNvQiFcX1AAof_6hFca5LRRqzoLP9B_s HTTP/1.1", host: "alsharakagroup.com"

2021/09/09 02:11:53 [error] 29#29: *4 open() "/var/www/certbot/.well-known/acme-challenge/mS0MFDKMBS4We7MBN2h2-Muhy_avDr9o2D74YzZPNPM" failed (2: No such file or directory), client: 3.143.223.150, server: alsharakagroup.com, request: "GET /.well-known/acme-challenge/mS0MFDKMBS4We7MBN2h2-Muhy_avDr9o2D74YzZPNPM HTTP/1.1", host: "www.alsharakagroup.com"


2021/09/09 02:11:54 [error] 29#29: *6 open() "/var/www/certbot/.well-known/acme-challenge/SAbLZaBL7m-TNvQiFcX1AAof_6hFca5LRRqzoLP9B_s" failed (2: No such file or directory), client: 18.196.102.134, server: alsharakagroup.com, request: "GET /.well-known/acme-challenge/SAbLZaBL7m-TNvQiFcX1AAof_6hFca5LRRqzoLP9B_s HTTP/1.1", host: "alsharakagroup.com"
29

I see you are having trouble pasting the error log. I saw your first paste which showed a failure opening the Test-File-4321. It is helpful to go slow - one step at a time. Did you create that file per @rg305 suggestion here:
Update: I see you did figure out the error log paste but I would still prefer to start with the test file (little steps ...)

mkdir /var/www/certbot/.well-known
mkdir /var/www/certbot/.well-known/acme-challenge
echo another-test-file > /var/www/certbot/.well-known/acme-challenge/Test-File-4321

If not, do that and also figure out how to paste the full text from the error_log or even upload the error file.

The port binding for 80 and 443 is a problem too. But given its timestamp and that we are getting later responses from nginx I do not see that as a current problem. I could be wrong but let us leave for later. You do not have a second nginx running do you? Or Apache? Or perhaps Docker is taking those ports? Anyway, on my Linux I use the below command to look at listeners - you may need a different command.

 sudo netstat -tunlp | grep LISTEN

Let us know when you have the Test-File-4321 in place

2 Likes
30

This is old, I deleted it and updated the error address

31

I just tried to look at the Test-File-4321 and got port 80: connection refused

Perhaps those port blocked messages have resurfaced? In any case, not much to look at when cannot connect to port 80.

2 Likes
32

Is this a error in folder dir
should be /var/www/certbot
or /var/www/certbot/.well-known/acme-challenge

33

i'm stuck with unauthorized
But I have a question that seems to be the problem I put staging=1
And when I set it to 0 I get

There were too many requests of a given type :: Error creating new order :: too many failed authorizations recently: see Rate Limits - Let's Encrypt

34

Please ONLY use staging until the problem has been resolved.

35

i try to make sub dir in var/www/certbot -> .well-known/acme-challenge

and put test_1234 in acme-challenge

When I try to access it from the browser, I get a 404, but I don't get the error that the file is not inside nginx

36

Please show output of:
ls -l /var/www/certbot/.well-known/acme-challenge/*

37

-rw-r--r-- 1 root root 0 Sep 9 10:00 /var/www/certbot/.well-known/acme-challenge/Test_1234

38

That file shows size zero.
Is it empty?

40

i make dir in /usr/share/nginx/html/.well-known/acme-challenge/Test_1234/index.html
and now like display hi

41

Are you sure the nginx config you showed in your first post is being used?

I ask because it had server_tokens off;

Yet, I just got a 404 for the test index file but it had the Server: nginx/1.19.0 header in the response. The server tokens config being off should suppress that header.

Much of what we are seeing would make more sense if your nginx was running with a different config than what you showed. Try running

sudo nginx -T

and make sure it is what you expect. Maybe even upload it here too. Maybe someone else can see something - I am having a hard time following the things you keep trying.

1 Like