My domain is:
not looking to disclosure so let's call it domain-xyz.com
I ran this command:
certbot --apache
It produced this output:
# sudo certbot --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: domain-xyz.com
2: www.domain-xyz.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Requesting a certificate for domain-xyz.com and www.domain-xyz.com
Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: domain-xyz.com
Type: connection
Detail: 100.200.300.400: Fetching http://domain-xyz.com/.well-known/acme-challenge/dKUUKpTa0HO0jc8hybW8hpqc9-2JQ3tCXq8eFlE7LDo: Timeout during connect (likely firewall problem)
Domain: www.domain-xyz.com
Type: connection
Detail: 100.200.300.400: Fetching http://www.domain-xyz.com/.well-known/acme-challenge/XSvHzPbW8NScP7VUqQQMGRfiX39qY9GCAsg5z-eEV9s: Timeout during connect (likely firewall problem)
Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version):
Server version: Apache/2.4.51 (AlmaLinux)
The operating system my web server runs on is (include version):
# cat /etc/os-release
NAME="AlmaLinux"
VERSION="9.0 (Emerald Puma)"
ID="almalinux"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.0"
My hosting provider, if applicable, is:
owned corporate datacenter
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
# certbot --version
certbot 1.29.0
=== Additional Info ===
VirtualHost configuration:
<VirtualHost *:80>
# ServerName domain-xyz.com
ServerAlias domain-xyz.com www.domain-xyz.com
DocumentRoot /var/www/sites/domain-xyz/public_html
# ServerName www.domain-xyz.com domain-xyz.com
<Directory '/var/www/sites/domain-xyz/public_html'>
Options -Indexes -MultiViews +SymLinksIfOwnerMatch
AllowOverride All
Require all granted
DirectoryIndex index.php
</Directory>
# # Other directives here
</VirtualHost>
And the .htaccess file:
# redirect domains to server directories
RewriteEngine On
#RewriteCond %{REQUEST_URI} !/\.well\-known/?.*
RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge [NC]
RewriteCond %{REQUEST_URI} !^/well-known/acme-challenge [NC]
RewriteCond %{HTTP_HOST} ^(www\.)?domain-xyz\.com$ [NC]
RewriteCond %{REQUEST_FILENAME} !/v1/
RewriteRule ^(.*)$ /2022/$1 [L]
If I curl from outside:
~ % curl -L http://www.domain-xyz.com/.well-known/acme-challenge/XSvHzPbW8NScP7VUqQQMGRfiX39qY9GCAsg5z-eEV9s
* Trying 100.200.300.400:80...
* Connected to www.domain-xyz.com (100.200.300.400) port 80 (#0)
> GET /.well-known/acme-challenge/XSvHzPbW8NScP7VUqQQMGRfiX39qY9GCAsg5z-eEV9s HTTP/1.1
> Host: www.domain-xyz.com
> User-Agent: curl/7.79.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< Date: Wed, 31 Aug 2022 13:52:09 GMT
< Server: Apache/2.4.51 (AlmaLinux) OpenSSL/3.0.1 mod_fcgid/2.3.9
< Content-Length: 196
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
</body></html>
* Connection #0 to host www.domain-xyz.com left intact
however, if I
# touch .well-known/acme-challenge/XSvHzPbW8NScP7VUqQQMGRfiX39qY9GCAsg5z-eEV9s
and test again:
~ % curl -L http://www.domain-xyz.com/.well-known/acme-challenge/XSvHzPbW8NScP7VUqQQMGRfiX39qY9GCAsg5z-eEV9s
* Trying 100.200.300.400:80...
* Connected to www.domain-xyz.com (100.200.300.400) port 80 (#0)
> GET /.well-known/acme-challenge/XSvHzPbW8NScP7VUqQQMGRfiX39qY9GCAsg5z-eEV9s HTTP/1.1
> Host: www.domain-xyz.com
> User-Agent: curl/7.79.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Wed, 31 Aug 2022 14:08:46 GMT
< Server: Apache/2.4.51 (AlmaLinux) OpenSSL/3.0.1 mod_fcgid/2.3.9
< Last-Modified: Wed, 31 Aug 2022 14:08:40 GMT
< ETag: "0-5e78a08aef41e"
< Accept-Ranges: bytes
< Content-Length: 0
< Content-Type: text/plain; charset=UTF-8
<
* Connection #0 to host www.domain-xyz.com left intact
I do have SELinux enabled, but,
I'm used to auditing and applying policies to selinux, so I've done that. Nothing comes across regarding any events related. I've even disabled dontaudit policy with semodule -DB and went bananas looking for a hit that wouldn't show.
Finally I've set selinux to permissive, but fails anyway. So I've disregarded it being the issue.
What it seems to me is that it simply isn't creating the secret for validation. There's no timeout problem, and I'm stuck.
