Timeout, certonly, apache2

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: proactivetasksupports.com

I ran this command (as root):
certbot certonly --webroot -w /var/www/proactivetasksupports.com/public_html -d proactivetasksupports.com -d www.proactivetasksupports.com

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for proactivetasksupports.com
http-01 challenge for www.proactivetasksupports.com
Using the webroot path /var/www/proactivetasksupports.com/public_html for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Unable to clean up challenge directory /var/www/proactivetasksupports.com/public_html/.well-known/acme-challenge
Failed authorization procedure. www.proactivetasksupports.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://www.proactivetasksupports.com/.well-known/acme-challenge/RB5Di247kZyAEOUDG4ow-ldqnUVny7PexXW8xTW0EPE: Timeout, proactivetasksupports.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://proactivetasksupports.com/.well-known/acme-challenge/t6_mV3_jZY82gACBr70rYLypaM46HNuTZd7L-1XbYaU: Timeout

IMPORTANT NOTES:

My web server is (include version):

Server version: Apache/2.4.18 (Ubuntu)
Server built: 2017-09-18T15:09:02

The operating system my web server runs on is (include version):
Ubuntu 16.04

My hosting provider, if applicable, is:
Linode

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
No, ssh only.

I have been using Lets Encrypt/Certbot for a few years without issue. With the recent TLS-SNI-01 issue, I thought I would try and obtain the cert manually then add the config to the apache2 config files. I get a timeout every time. The site is accessible and you can read the readme.html file from anywhere on the web. DNS is via cloudflare but the service is paused right now so all communication is direct with the server.

I also tried with the --manual option and created the chalenge files, verified that I could read them from my mac at home and still received a timeout. The domail currently does not have SSL enabled as there is no certificate.

I also tried:
certbot --authenticator standalone --installer apache -d proactivetasksupports.com -d www.proactivetasksupports.com --pre-hook “systemctl stop apache2” --post-hook “systemctl start apache2”

And received the following:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer apache
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Running pre-hook command: systemctl stop apache2
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for proactivetasksupports.com
http-01 challenge for www.proactivetasksupports.com
Waiting for verification…
Cleaning up challenges
Running post-hook command: systemctl start apache2
Failed authorization procedure. www.proactivetasksupports.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://www.proactivetasksupports.com/.well-known/acme-challenge/e-FF05tbqm5tn_l168I9IfbqdJwyiz4XsZXyI2t5dIc: Timeout, proactivetasksupports.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://proactivetasksupports.com/.well-known/acme-challenge/bilMezbdt8JeTxROKDHTiICP-PbsvP-tnLVKZTPuIyk: Timeout

IMPORTANT NOTES:

Any assitance would be greatly appreciated.

Greg

2

Hello @GregM123,

Your domains are using IPv4 and IPv6 records and Let’s Encrypt prefers IPv6 over IPv4 so it is trying to validate them using your IPv6 address but your server is not responding.

Using IPv4 I’ve no problem to reach your server:

curl -Iv4kL http://www.proactivetasksupports.com/.well-known/acme-challenge/RB5Di247kZyAEOUDG4ow-ldqnUVny7PexXW8xTW0EPE
*   Trying 45.33.12.230...
* TCP_NODELAY set
* Connected to www.proactivetasksupports.com (45.33.12.230) port 80 (#0)
> HEAD /.well-known/acme-challenge/RB5Di247kZyAEOUDG4ow-ldqnUVny7PexXW8xTW0EPE HTTP/1.1
> Host: www.proactivetasksupports.com
> User-Agent: curl/7.52.1
> Accept: */*
>
< HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
< Date: Thu, 11 Jan 2018 18:45:35 GMT
Date: Thu, 11 Jan 2018 18:45:35 GMT
< Server: Apache/2.4.18 (Ubuntu)
Server: Apache/2.4.18 (Ubuntu)
< Connection: close
Connection: close
< Content-Type: text/html; charset=iso-8859-1
Content-Type: text/html; charset=iso-8859-1

<
* Curl_http_done: called premature == 0
* Closing connection 0

But using IPv6… time out :frowning::

curl -Iv6kL http://www.proactivetasksupports.com/.well-known/acme-challenge/RB5Di247kZyAEOUDG4ow-ldqnUVny7PexXW8xTW0EPE
*   Trying 2600:3c00::f03c:91ff:fea8:5256...
* TCP_NODELAY set
* connect to 2600:3c00::f03c:91ff:fea8:5256 port 80 failed: Connection timed out
* Failed to connect to www.proactivetasksupports.com port 80: Connection timed out
* Closing connection 0
curl: (7) Failed to connect to www.proactivetasksupports.com port 80: Connection timed out

You should review your IPv6 conf… or maybe the firewall… or remove the AAAA record for your domains.

Cheers,
sahsanu

1 Like
3

Thanks for the quick reply. removed the IP6 AAAA records and was able to obtain my certs.

Cheers,

Greg

1 Like
4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.