Unable to renew SSL certificate

Help
1

Hi guys,

I'm fairly new to this, I've buuilt my own mail server and its been running for a couple of years now. For some reason the auto renew feature has stopped.
I went int to renew it but it didn't work.
Any help would great to get this going again and have the SSL working.

My domain is: mail.e-rec.com.au

I ran this command: Certbot -v

It produced this output:
root@emailserver:/home/erec# certbot -v
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.

1: mail.e-rec.com.au
2: www.mail.e-rec.com.au

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1

An RSA certificate named mail.e-rec.com.au already exists. Do you want to update
its key type to ECDSA?

(U)pdate key type/(K)eep existing key type: U
Renewing an existing certificate for mail.e-rec.com.au
Performing the following challenges:
http-01 challenge for mail.e-rec.com.au
Waiting for verification...
Challenge failed for domain mail.e-rec.com.au
http-01 challenge for mail.e-rec.com.au

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: mail.e-rec.com.au
Type: connection
Detail: 125.168.197.32: Fetching http://mail.e-rec.com.au/.well-known/acme-challenge/ksJyjpA3GLKPZ9VEtSiwDBeJtFLcOWhQppDuzF6ZON0: Error getting validation data

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

My web server is (include version): nginx

The operating system my web server runs on is (include version): Ubuntu 22.04 LTS

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Certbot 3.0.0

Thank you

1 Like
2

does nginx listen for mail subdomain?

1 Like
3

What's the best way to check if it does?

4

Is the IP address correct? Especially the IPv4 address, because the IPv6 address is completely not working to begin with because someone put the link-local unicast address (recognised by the fe80:: at the beginning) into the global DNS. That's not going to work on the global internet of course.

Or perhaps a firewall blocking all access to that host? Because I'm getting no response from that IPv4 address on any port, nor ping.

2 Likes
5

the IP Address is correct, I get response from the mail server in getting and sending mail. Its the SSL that I can't renew.

I can resolve mail.e-rec.com.au internally on the network from other machines on the LAN OK, but if I try and resolve from the internet it doesn't work.

I'm not sure what it is, I'm baffled?

6

From where? Local LAN?

That requires working access on TCP port 80 from the global internet if using the http-01 challenge, as you're doing now.

Well, resolving the hostname works fine from here:

mail.e-rec.com.au.	3600	IN	A	125.168.197.32
e-rec.com.au.		3600	IN	NS	ns14.domaincontrol.com.
e-rec.com.au.		3600	IN	NS	ns13.domaincontrol.com.
;; Received 333 bytes from 97.74.106.7#53(ns13.domaincontrol.com) in 10 ms

So DNS seems to be in order (if that configured IP address is correct as you say). But the host is not reachable from the global internet.

Possible reasons are:

  • incorrect IP address (but you say the IP address listed is correct);
  • a firewall blocking incoming connections;
  • missing or incorrect NAT portmap, if applicable.
1 Like
7

Review the output of:

nginx -T

3 Likes