Unable to activate using HTTP

Help
1

I am attempting to use win-acme to create a certificate for my SFTP server. I've forwarded port 80 through my firewall and can verify that the traffic is reaching my server by using WireShark (see below). I'm at a bit of a loss, I've verified the NAT is returning traffic on the correct IP. If I validate using DNS will I be able to auto-renew? I think I read somewhere that I can't, but want to be sure this port 80 validation is required.

image
image1356×359 19.1 KB

My domain is: sftp.bryantbank.com

I ran this command: WACS

It produced this output:
[sftp.bryantbank.com] {"type":"urn:ietf:params:acme:error:connection","detail":"During secondary validation: 74.254.235.126: Fetching http://sftp.bryantbank.com/.well-known/acme-challenge/CQYLTYf4Id0eRFUtnBeahPYFB8WWy7P-EUxyDkknYSM: Timeout during connect (likely firewall problem)","status":400,"instance":null}

My web server is (include version): N/A

The operating system my web server runs on is (include version): Windows Server 2019

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 2.2.9.1701

2

How many validation requests are you seeing? There should be at least 5.

This part of the error message indicates that the primary validation could in fact confirm your control of the domain name, but some of the other (secondary) validations could not.

You can auto-renew if the update to your DNS is automated, to satisfy the new challenge for each renewal. Some DNS providers make that easier than others. There's also a new standard in the works that will allow for setting up a DNS entry once and then just keeping it there, which may make things easier for systems that don't open port 80 worldwide and don't have an easy way to automate updating their DNS records.

3

Thanks for the quick reply. I see three requests on port 80, and the blog posts you linked explain why. Since we're a community bank our ISP geo-blocks non-US traffic, which is why the secondary verifications fail. I'll look into the DNS verification method. Thanks.

4

Are you sure you need an SSL certificate? SFTP is a file transfer protocol over SSH, which in itself, does not use traditional certificates.

5

FTPS is the more likely protocol but the names are confusingly similar.