Timeout error, for clean install of apache2 running on Debian 10

I ran this on an identical build last week using the same hardware an a clean install of debian 10 running apache2 and certbot worked. There is no firewall installed and I double checked that it wasn't installed as part of the distro. I can connect to the sites using lynx and firefox. Not sure what else to check..... I would be grateful for any suggestions how to fix this.

My domain is:

chenla.org, chenla.net, chenla.la

I ran this command:

sudo certbot --apache

It produced this output:

$ sudo certbot --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: chenla.net
2: chenla.la
3: chenla.org
4: www.chenla.net
5: www.chenla.org
6: www.chenla.la
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 
Requesting a certificate for chenla.net and 5 more domains

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
  Domain: chenla.la
  Type:   connection
  Detail: Fetching http://chenla.la/.well-known/acme-challenge/dgIkVhdkoZu3dRjmc8OPYrk9GWQ-4RsXN6CS65gPdH4: Timeout during connect (likely firewall problem)

  Domain: chenla.net
  Type:   connection
  Detail: Fetching http://chenla.net/.well-known/acme-challenge/1vkwpA09GYSP8PXpNRqVd4_foTb-YRWYNiquPbAAGhI: Timeout during connect (likely firewall problem)

  Domain: chenla.org
  Type:   connection
  Detail: Fetching http://chenla.org/.well-known/acme-challenge/47UJtEAuhF96INlevx85ilzlb6E1SdH1jzjpb_NLEGw: Timeout during connect (likely firewall problem)

  Domain: www.chenla.la
  Type:   connection
  Detail: Fetching http://www.chenla.la/.well-known/acme-challenge/9W6X0Xn2fkfiklfH4SqKgouXJIFLdfvvRVtgvSsm1wI: Timeout during connect (likely firewall problem)

  Domain: www.chenla.net
  Type:   connection
  Detail: Fetching http://www.chenla.net/.well-known/acme-challenge/B0-u-5U-kLTGl1QB72SSsAAsxL5pCeDFaBFlA0EqWeE: Timeout during connect (likely firewall problem)

  Domain: www.chenla.org
  Type:   connection
  Detail: Fetching http://www.chenla.org/.well-known/acme-challenge/2LiAMONaChC13fLPzVgJypkVORUJ_gK-JkvBWt4u9Ek: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
╭ deerpig@hilarius:/etc/apache2/sites-available

My web server is (include version):

apache2 (latest version from apt-get)

The operating system my web server runs on is (include version):

Debian 10

My hosting provider, if applicable, is:

n/a -- self hosted with our own class C ip block.

I can login to a root shell on my machine (yes or no, or I don't know):

yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot 1.20.0

Port 80 (and port 443) are simply not open or not listening. Try connecting to one of your websites from an external network using http.

It could be you're not forwarding these ports to your internal server.

2 Likes

Hi @deerpig and welcome to the LE community forum :slight_smile:

You will need a working HTTP site in order to secure it (via HTTP authentication).

1 Like

I'm trying to understand what is going wrong. Running ss -tupln shows the web server is listening on ports 80 and 443. There is no firewall on the web server. I just checked to see if the problem was with the network firewall running firewalld on centos but it is already set up to allow traffic on those ports through. We've run many web servers behind this firewall over the years and never had a problem like this before.

Am I correct in assuming that if https://letsdebug.net can connect to the server, the ports are open?

For the moment the problem and answer is eluding me. When I figure it out I will report back here for others who have had the same problem. Thanks to both of you for replying so quickly.

1 Like

Yes.

And, right now chenla.org and chenla.net do not have DNS entries. Only chenla.la is showing an IP but is not reachable by Lets Debug.
Let's Debug

2 Likes

Thank you for all of your answers.

There is something weird going on with my firewall (firewalld on centos). Ports 80 and 443 were open but it wasn't letting anyone see any servers on the network. I turned on masquerade for the zone my public ip block is in and certbot worked. Problem solved.

Except I check today and everything was blocked again. Turned off and on masquerade and things worked again. Not sure what is going on.

But as far as certbot is concerned, the problem was with the firewall.

Thanks again.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.