Unable to get certificate - connection reset by peer

Help
1

im out of ideas

i get this error message when i try to install certificate for my nginx server.

Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for krbserver.me
tls-sni-01 challenge for www.krbserver.me
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. www.krbserver.me (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Connection reset by peer, krbserver.me (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Connection reset by peer

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: www.krbserver.me
   Type:   connection
   Detail: Connection reset by peer

   Domain: krbserver.me
   Type:   connection
   Detail: Connection reset by peer

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.

I have checked my dns as it says, and everything is good - i have 2 a records, one for www.hostname and one for hostname - and everything is good. i can access the sites via both addresses, but i cant get this certbot to work :confused:

My domain is: krbserver.me

i ran this command: sudo certbot --nginx

output shown.

webserver is nginx 1.10.3

Hope someone can help!

2

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

3

You need to differentiate protocols from addresses

a google search of tls-sni + let’s encrypt might have give you some hints

tls-sni-01 challenge for krbserver.me
tls-sni-01 challenge for www.krbserver.me

Fill out the questions and I will help you out further

image

image
image.png1357×492 14.6 KB

Andrei

4

i have edited in the answers. i will take a look at what you write here :slight_smile:
If you have more help for me, please go ahead, its very much appreciated :smile:

5

hmmmm

are you sure you are running NGINX?

Or are you proxying Tomcat via NGINX (once again useful detail to share) :smiley:

image
image.png1365×421 36.6 KB

Andrei

6

Ok it looks like NGINX is listening on 443 but is not completing handshakes

this is most likely because it hasn’t been setup with a SSL cert and key

you can possibly set one up using the snake oil certs

But check they exist on your system first and don’t forget to restart NGINX

image
image.png771×401 14.2 KB

As you have a working port 80 i suggest you use the webroot authenticator and nginx installer

The process should have set it up and found the right directives and created a self signed certificate for you

Andrei

7

right, sorry, yes, i am reverse proxying to tomcat. shouldve said that.

8

so, how do i use the webroot authenticator? i am only running webapps on the server, no static html in any of the dirs.

and the nginx installer? if you mean certbot --nginx, then that is what gave me these errors

9

In this case normally users need to create an explicit mapping so that /.well-known/acme-challenge is served as static files from some directory path.

The TLS-SNI-01 method used by --nginx, as @ahaw021 mentioned, can't work from behind a reverse proxy. The HTTP-01 method used by --webroot can work but you need to be able to make externally-visible changes to the site to prove that you control it—and unless you want to reprogram one of the web apps to add some kind of API to update the content, the easiest thing would be to create a mapping so that /.well-known/acme-challenge on the site gets served from the static files in some directory.

Because --webroot tries to create /.well-known/acme-challenge inside the location that you give it, in this case you would probably also want to run

mkdir .well-known
ln -s .well-known/acme-challenge .

inside of that directory, because otherwise the webroot plugin will try to place the verification files in what amounts to /.well-known/acme-challenge/.well-known/acme-challenge instead of just /.well-known/acme-challenge.

1 Like
10

Thank you! I finally got it to work. I swapped the domain over to a
similar, and remade my server from a backup point :slight_smile: but I did get it to
work behind a reverse proxy - check https://Breindal.me for verification :slight_smile:

2 Likes
11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.