Unable to generate certificate

[reddcar]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: www.reddcar.com

I ran this command: certbot --apache -v -d www.reddcar.com

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Requesting a certificate for www.reddcar.com
Performing the following challenges:
http-01 challenge for www.reddcar.com
Waiting for verification...
Challenge failed for domain www.reddcar.com
http-01 challenge for www.reddcar.com

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: www.reddcar.com
Type: connection
Detail: Fetching http://www.reddcar.com/.well-known/acme-challenge/sbL7CR-3RTyst97MYcavdAHanCWOAyN_-YavJMFux1w: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): Apache/2.4.51 (Unix)

The operating system my web server runs on is (include version): ArchLinux (latest updates)

My hosting provider, if applicable, is: AWS

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No, I full root access

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.21.0

[reddcar]

A few comments, I verified iptables is open and for AWS I just have port 80 and 443 open. DNS is hosted in Route 53 (AWS) and the website resolves just fine (you can test). I am trying to run this with the httpd-vhost.conf settings:

<VirtualHost *:80>
ServerAdmin support@reddcar.com
DocumentRoot "/srv/http"
ServerName www.reddcar.com
ErrorLog "/var/log/httpd/error_log_reddcar"
CustomLog "/var/log/httpd/access_log_reddcar" common
#RewriteEngine on
#RewriteCond %{SERVER_NAME} =www.reddcar.com
#RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

I commented out the Rewrites because eventually once the cert is installed I want to force 80 traffic to redirect to 443.

[Osiris]

@reddcar

I verified iptables is open and for AWS I just have port 80 and 443 open.

Even so, connections to port 80 from the world wide web are somehow filtered. It's impossible for us to see exactly what kind of setup you're running, so it's impossible to guide you with exact and concrete advice, but a generic advice would be to make sure your webserver is reachable on TCP port 80.

[MikeMcQ]

I agree with @Osiris generally.

When you say AWS ports are open do you mean your Security Group for EC2? Check that if you haven't yet.

Also, you can see that port 80 is not open to the public with this test site:

Test result for www.reddcar.com: Error

[reddcar]

I've gone ahead and disabled iptables service altogether just as an added bonus. Honestly it was set for default ALLOW on all chains so 100% in/out on the server side. For port 80/443 those were AWS security groups. I'm comfortable with firewall rules on server and AWS. This server isn't in production still dialing it in and testing.

[reddcar]

I believe I dropped the rules after I gave up testing. I have to keep re-adding them whenever I run certbot to try and generate/configure the certs. Since the server is not in production yet and fully configured I tend to close those ports when not testing. I'll give it another go today.