The server could not connect to the client to verify the domain :: Error getting validation data

[yetangye]

I have a CentOS 7.4 and newly installed nginx,
I first install certbot as installation instructions on the letsencrypt official website , but some pip package installation had errors and when execute certbot --nginx, the error below showed:

# certbot --nginx
Traceback (most recent call last):
  File "/usr/bin/certbot", line 9, in <module>
    load_entry_point('certbot==0.18.1', 'console_scripts', 'certbot')()
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 561, in load_entry_point
    return get_distribution(dist).load_entry_point(group, name)
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2649, in load_entry_point
    return ep.load()
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2303, in load
    return self.resolve()
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2309, in resolve
    module = __import__(self.module_name, fromlist=['__name__'], level=0)
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 14, in <module>
    from certbot import account
  File "/usr/lib/python2.7/site-packages/certbot/account.py", line 17, in <module>
    from acme import messages
  File "/usr/lib/python2.7/site-packages/acme/messages.py", line 5, in <module>
    from acme import challenges
  File "/usr/lib/python2.7/site-packages/acme/challenges.py", line 10, in <module>
    import requests
  File "/usr/lib/python2.7/site-packages/requests/__init__.py", line 58, in <module>
    from . import utils
  File "/usr/lib/python2.7/site-packages/requests/utils.py", line 32, in <module>
    from .exceptions import InvalidURL
  File "/usr/lib/python2.7/site-packages/requests/exceptions.py", line 10, in <module>
    from .packages.urllib3.exceptions import HTTPError as BaseHTTPError
  File "/usr/lib/python2.7/site-packages/requests/packages/__init__.py", line 95, in load_module
    raise ImportError("No module named '%s'" % (name,))
ImportError: No module named 'requests.packages.urllib3'

Then I installed certbot-auto and execute ./certbot-auto --nginx, error occured too.
below is error message:

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for corp.xxx.com.cn
tls-sni-01 challenge for www.corp.xxx.com.cn
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. corp.xxx.com.cn (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Connection reset by peer, www.corp.xxx.com.cn (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Error getting validation data

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: corp.xxx.com.cn
   Type:   connection
   Detail: Connection reset by peer

   Domain: www.corp.xxx.com.cn
   Type:   connection
   Detail: Error getting validation data

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

Can anyone tell where is the problem? Thanks very much.

[rg305]

It seems that your system may be unable to get packages/updates form the Internet.
And may be missing some packages/updates to work properly.

What version of certbot-auto is that?
sudo ./certbot-auto --version

[yetangye]

Version info is:

# sudo ./certbot-auto --version
certbot 0.19.0

[yetangye]

I think the important part of the error message is below:

urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Connection reset by peer

What situations will cause “The server could not connect to the client to verify the domain”?

[schoen]

This error is caused by a host or network firewall that blocks or drops incoming connections.

[yetangye]

Thanks.

The domains I pasted here is real, Can you tell me which protocol and port the Let’s Encrypt server want to connect but failed?
Is it https://corp.xxx.com.cn:443?

[schoen]

That is correct. I see the same problem when I try to connect to that server using a web browser.

[yetangye]

Yes, but I newly installed nginx, and I did not open the port 443 in nginx.conf file,
You mean I should add listen 443 first?

server {
    listen       80 default_server;
    listen       443 ssl http2;

[yetangye]

Following this post : http://equinox.one/blog/2016/11/03/set-https-in-nginx-running-in-docker-container-and-update-certs-from-jenkins/

First, I stopped the nginx service
Then, Created /usr/share/nginx/html//.well-known/acme-challenge
And Then add the lines below into nginx.conf server section.
location ‘/.well-known/acme-challenge’ {
default_type “text/plain”;
allow all;
}

This time I execute certbot-auto --nginx, it worked

[yetangye]

Post has been modified for hide real domains.

[schoen]

By the way, this had the effect of using port 80 instead of port 443 to validate your server. Therefore, we still don’t know the underlying reason why your solution worked (because it doesn’t reveal what was wrong with the connection to port 443).

I’m glad you managed to get your certificate successfully.