Timeout during connect (likely firewall problem)

[tcreek]

My domain is: meeting.ippbxsupport.net

I ran this command: certbot certonly --standalone -d meeting.ippbxsupport.net --dry-run

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for meeting.ippbxsupport.net
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. meeting.ippbxsupport.net (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: During secondary validation: Fetching http://meeting.ippbxsupport.net/.well-known/acme-challenge/QHRJxOI3jJwYeHNN5I99RFU3JgA8w_odLSE6vxCySFk: Timeout during connect (likely firewall problem)

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: meeting.ippbxsupport.net
   Type:   connection
   Detail: During secondary validation: Fetching
   http://meeting.ippbxsupport.net/.well-known/acme-challenge/QHRJxOI3jJwYeHNN5I99RFU3JgA8w_odLSE6vxCySFk:
   Timeout during connect (likely firewall problem)

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

My web server is (include version): Apache/2.4.38

The operating system my web server runs on is (include version): Debian 10

I can login to a root shell on my machine (yes or no, or I don't know): yes

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 0.31.0

I don't think this is a firewall issue as port 80 is for sure open (IP tables [-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT]), and I see traffic coming to the server as seen by tcpdump.

14:18:55.698619 IP OpenMeeting1.localdomain.http > ec2-52-58-118-98.eu-central-1.compute.amazonaws.com.37426: Flags [S.], seq 1990738094, ack 1144139237, win 65160, options [mss 1460,sackOK,TS val 3992395219 ecr 1317580820,nop,wscale 7], length 0
14:18:55.698655 IP OpenMeeting1.localdomain.http > ec2-34-211-60-134.us-west-2.compute.amazonaws.com.59886: Flags [S.], seq 2317221856, ack 3240802948, win 65160, options [mss 1460,sackOK,TS val 1408025420 ecr 1221156813,nop,wscale 7], length 0

And I see certbot listening on port 80

certbot 13474 root 8u IPv6 129671 0t0 TCP *:80 (LISTEN)

Thanks!

[_az]

@tcreek

and I see traffic coming to the server as seen by tcpdump

You should see traffic coming from 4 hosts in total: ACME v1/v2: Validating challenges from multiple network vantage points

At the moment when I do a --dry-run, I additionally see traffic from 18.224.20.83 and 66.133.109.36, which are missing from your trace.

The latter of those is the primary staging VA and is likely the one that is reporting the firewall timeout.

Check that they're not blocked in iptables.

[tcreek]

They are open, I guess I did not copy that part;

15:01:54.832649 IP ec2-18-224-20-83.us-east-2.compute.amazonaws.com.21422 > OpenMeeting1.localdomain.http: Flags [S], seq 1612238449, win 26883, options [mss 1460,sackOK,TS val 2417099535 ecr 0,nop,wscale 7], length 0

66.133.109.36 is not arriving, and there is no block in IP tables