Unable to make certificate

Reek2750 · September 18, 2020, 11:39am

My domain is:
Easyinstallmdm.ista.dk

I ran this command:
Certbot certonly --standalone and later typed in my domain “Easyinstallmdm.ista.dk”

It produced this output:
http-01 challenge for easyinstallmdm.ista.dk
Waiting for verification…
e[31mChallenge failed for domain easyinstallmdm.ista.dke[0m
http-01 challenge for easyinstallmdm.ista.dk
Cleaning up challenges
e[31mSome challenges have failed.e[0m
e[1m
IMPORTANT NOTES:
e[0m - The following errors were reported by the server:

Domain: easyinstallmdm.ista.dk
Type: connection
Detail: Fetching
http://easyinstallmdm.ista.dk/.well-known/acme-challenge/u_X4jEuWzGs2PpzfucSYmWYtXBtZvySEMX39hV_L2A0:
Timeout during connect (likely firewall problem)

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you’re using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.

My web server is (include version):
Running some MDM solution on the server.

The operating system my web server runs on is (include version):
Windows Server 2019

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): Certbot 1.5.0

It used to work, but I was lazy / had vacation and didnt renew the certificate…
And Now I cannot get this to work again

JuergenAuer · September 18, 2020, 12:25pm

Hi @Reek2750

standalone is hard to debug because it's not possible to check your configuration. Result (see your "check-your-website" - result):

Only timeouts. But it's unknown if it is a firewall / routing / ip problem or another problem.

So first step: Is it possible to start a port 80 webserver and use that? --webroot should always work.

Reek2750 · September 20, 2020, 11:15am

Thanks for your reply, I'll try to contact our reseller of the software we're using because I can't seem to find any webroot on the server actually.

So he needs to tell me how the website is created.

Reek2750 · September 21, 2020, 10:50am

Hi again @JuergenAuer

I'm quite the rookie to certificates.
But I cannot launch my MDM soloution without a SSL certificate.
So this means I have to use LetsEncrypt and create a SSL certificate for my potential website before the website is online.

I don't know if LetsEncrypt allows this feature, so i've made a IIS with the same name.
Hint the server is behind a firewall, which only allows incoming trafics to 443 and now also 80.
Could that be the issue? If LetsEncrypt uses DNS port?

But I get the error below.

C:\PROGRA~2\Certbot>certbot certonly --webroot
Saving debug log to C:\Certbot\log\letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c'
to cancel): easyinstallmdm.ista.dk
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for easyinstallmdm.ista.dk
Input the webroot for easyinstallmdm.ista.dk: (Enter 'c' to cancel): C:\inetpub\wwwroot\easyinstallmdm
Waiting for verification...
e[31mChallenge failed for domain easyinstallmdm.ista.dke[0m
http-01 challenge for easyinstallmdm.ista.dk
Cleaning up challenges
e[31mSome challenges have failed.e[0m
e[1m
IMPORTANT NOTES:
e[0m - The following errors were reported by the server:

Domain: easyinstallmdm.ista.dk
Type: unauthorized
Detail: Invalid response from
http://easyinstallmdm.ista.dk/.well-known/acme-challenge/7AsGqlEyW_tl9VlNem01wl1YfN_joflcBxSGhu_kTrU
[213.83.173.171]: "\r\nNot
Found\r"

_az · September 21, 2020, 11:15am

That looks like an improvement!

You might also have to create a web.config file at C:\inetpub\wwwroot\easyinstallmdm\.well-known\acme-challenge\web.config to allow extensionless files in IIS:

<?xml version="1.0" encoding="UTF-8"?>
 <configuration>
     <system.webServer>
         <staticContent>
             <mimeMap fileExtension=".*" mimeType="text/plain" />
         </staticContent>
     </system.webServer>
 </configuration>

Reek2750 · September 21, 2020, 12:20pm

@_az

Doesn't work
C:\PROGRA~2\Certbot>certbot certonly --webroot
Saving debug log to C:\Certbot\log\letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c'
to cancel): easyinstallmdm.ista.dk
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for easyinstallmdm.ista.dk
Input the webroot for easyinstallmdm.ista.dk: (Enter 'c' to cancel): C:\inetpub\wwwroot\easyinstallmdm
Waiting for verification...
e[31mChallenge failed for domain easyinstallmdm.ista.dke[0m
http-01 challenge for easyinstallmdm.ista.dk
Cleaning up challenges
e[31mSome challenges have failed.e[0m
e[1m
IMPORTANT NOTES:
e[0m - The following errors were reported by the server:

Domain: easyinstallmdm.ista.dk
Type: unauthorized
Detail: Invalid response from
http://easyinstallmdm.ista.dk/.well-known/acme-challenge/D8osiPKMv0-1UgJO0N4NkbUllGSlq1JM45avXGiIWM4
[213.83.173.171]: "\r\nNot
Found\r"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

JuergenAuer · September 21, 2020, 12:24pm

Create the subdirectories

C:\inetpub\wwwroot\easyinstallmdm\.well-known\acme-challenge

there a file (file name 1234), then try to load that file via

http://easyinstallmdm.ista.dk/.well-known/acme-challenge/1234

That must work. If not, fix it.

Do you run Certbot on that ip 213.83.173.171?

Reek2750 · September 21, 2020, 12:39pm

@JuergenAuer

I've created the subdirectories

But there is no file inside.

Now I got locked out due to many failed attemps so I have to wait a few hours before I can contiune my work.

But yes the certbot runs on the same server, is that bad practice?

Reek2750 · September 21, 2020, 12:45pm

I probably have to add Anonymous user to have read to the sub directory.

JuergenAuer · September 21, 2020, 12:58pm

You have to create the second subdirectory, there a file.

Then check the directory permissions.

That's required,Certbot must be able to create the validation file there.

Running Certbot on another machine wouldn't work.

Reek2750 · September 23, 2020, 12:34pm

Hi @JuergenAuer

I've tried again, but it still doesn't work.
Any other suggestions?

I mean I can easily access www.easyinstallmdm.ista.dk from outside my local network.
But it still fails with the SSL certificate

griffin · September 23, 2020, 12:51pm

I got a clean result from letsdebug.net for easyinstallmdm.ista.dk, but www.easyinstallmdm.ista.dk seems to have no A record.

Reek2750 · September 23, 2020, 1:21pm

@griffin

Mmh it should be in place and alright.
It must be some FW I think :l, i've just enabled almost everything.

griffin · September 23, 2020, 1:23pm

You need an A (or CNAME) record for **www.**easyinstallmdm.ista.dk

Reek2750 · September 23, 2020, 1:28pm

How did I miss this
I'll do the modifcations and see if that works

griffin · September 23, 2020, 1:29pm

Before you do, let me help with your certbot command.

JuergenAuer · September 23, 2020, 1:29pm

What doesn't work? The exact command and the exact error message is required.

If you don't use the www version in your command, you don't need an A record with the www subdomain.

PS: Your older command didn't use the ww subdomain.

So that's not the problem.

Create the test file in /.well-known/acme-challenge (file name 1234).

griffin · September 23, 2020, 1:32pm

certbot certonly --cert-name easyinstallmdm.ista.dk -a webroot -w C:\inetpub\wwwroot\easyinstallmdm -d easyinstallmdm.ista.dk

If you want the www, just add -d www.easyinstallmdm.ista.dk to the end.

Reek2750 · September 23, 2020, 1:44pm

I've enabled directory browsing on easyinstallmdm folder.

You should be able to see the 1234 file, is it correct that it should be .txt?

but I still get the DNS A/AAA error.

JuergenAuer · September 23, 2020, 1:46pm

No, that's exact the problem @_az has explained - two days earlier:

Extensionless files are required, file name 1234, not 1234.txt

PS: And never, never, never allow that:

I've enabled directory browsing on easyinstallmdm folder.

That's always a critical security problem.

Topic		Replies	Views
Type: unauthorized Detail: Invalid response from Help	39	1215	March 18, 2021
Keep failing Cert registration Help	45	1342	December 28, 2020
I can not create a certificate when using --webroot plugin Help	31	983	February 19, 2023
First Install of certbot for IIS 8.5 Help	29	2090	December 30, 2021
Obtain first certificate: timeout Help	21	1440	August 10, 2019

Unable to make certificate

Related topics