Timeout when certbot --standalone on fetching .well-known/acme-challenge

Help
1

My domain is: dev-o13.security-warehouse.com

I ran this command: certbot certonly --standalone -d dev-o13.security-warehouse.com

It produced this output:

Performing the following challenges:
http-01 challenge for dev-o13.security-warehouse.com
Waiting for verification...
Challenge failed for domain dev-o13.security-warehouse.com
http-01 challenge for dev-o13.security-warehouse.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

My web server is (include version): standalone should not require webserver, but i am using nginx and i have stop nginx to release port 80.

The operating system my web server runs on is (include version): ubuntu 20

My hosting provider, if applicable, is: Linode

I can login to a root shell on my machine (yes or no, or I don't know): yes, i ran the command from shell.

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot 0.40.0

2

I'm getting a timeout too and not just for the challenge, but for that hostname altogether. As the error suggests, is there any firewall blocking port 80? I can see the host is up, as it replies to pings, but no common port seems to be open.

Also: if you have an instance of nginx running, why are you using the standalone plugin? Not that it's related to your firewall issue though, but more in general..

3

thanks for your reply. i have it fixed.

yes, you're right. i have a firewall ufw allow port 80 ( as i thought, i have done that many times ), but i review using ufw status as below,

Anywhere ALLOW 433
Anywhere ALLOW 80

i disable the ufw and certbot command succeed immediately then i realize my rule is wrongly defined and as you said port 80 not open.

so i add another one ufw allow 'Nginx Full', then it works.

why i use standalone because i just want it as simple as possible and edit the nginx.conf myself to add the ssl_certificates and related definitions.

the certbot error message has pointed out the suspicious firewall issue but just i was unable to find the exact issue as i thought my firewall didn't block.

4

Shouldn't that be 443?

5

You could use certbot certonly with --nginx authenticator or --webroot authenticator.
And you would NOT have to stop the web service.

6

I concur with Rudy here. If you don't want Certbot to mess with your nginx configuration in any way, which I can understand, I'd recommend using the certonly subcommand with the --webroot plugin. I'd only use standalone if it was a webserver-less host, such as a standalone mailserver or something similar.