I have set up an Letsencypt CA server and I am trying to generate a certificate from this server with the help of Certbot. all systems are running on the local network and ubuntu.
When I run the command below;
"certbot certonly --standalone --server http://localca:4000/directory -d localdomain.com
Output is;
Starting new HTTPS connection (1): supporters.eff.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for localdomain.com
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. localdomain.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://localdomain.com/.well-known/acme-challenge/rjjWqhInCrwk7UHx90Ij3DtAIyfFyyjtLQZYAuVSpK4: Connection refused
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: localdomain.com
Type: connection
Detail: Fetching
http://localdomain.com/.well-known/acme-challenge/rjjWqhInCrwk7UHx90Ij3DtAIyfFyyjtLQZYAuVSpK4:
Connection refused
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
- Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
And the letsencypt log is:
2019-06-27 15:38:40,374:DEBUG:certbot.main:certbot version: 0.31.0
2019-06-27 15:38:40,375:DEBUG:certbot.main:Arguments: ['--standalone', '--server', 'http://localca:4000/directory', '-d', 'localdomain']
2019-06-27 15:38:40,376:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2019-06-27 15:38:40,385:DEBUG:certbot.log:Root logging level set at 20
2019-06-27 15:38:40,385:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2019-06-27 15:38:40,386:DEBUG:certbot.plugins.selection:Requested authenticator standalone and installer None
2019-06-27 15:38:40,480:DEBUG:certbot.plugins.selection:Single candidate plugin: * standalone
Description: Spin up a temporary webserver
Interfaces: IAuthenticator, IPlugin
Entry point: standalone = certbot.plugins.standalone:Authenticator
Initialized: <certbot.plugins.standalone.Authenticator object at 0x7f83d868c6d8>
Prep: True
2019-06-27 15:38:40,481:DEBUG:certbot.plugins.selection:Selected authenticator <certbot.plugins.standalone.Authenticator object at 0x7f83d868c6d8> and installer None
2019-06-27 15:38:40,481:INFO:certbot.plugins.selection:Plugins selected: Authenticator standalone, Installer None
2019-06-27 15:38:40,504:DEBUG:certbot.main:Picked account: <Account(RegistrationResource(uri='http://localca:4000/acme/reg/3', terms_of_service=None, body=Registration(only_return_existing=None, extern$
2019-06-27 15:38:40,506:DEBUG:acme.client:Sending GET request to http://localca:4000/directory.
2019-06-27 15:38:40,510:INFO:requests.packages.urllib3.connectionpool:Starting new HTTP connection (1): localca
2019-06-27 15:38:40,512:DEBUG:requests.packages.urllib3.connectionpool:"GET /directory HTTP/1.1" 200 584
2019-06-27 15:38:40,513:DEBUG:acme.client:Received response:
HTTP 200
Date: Thu, 27 Jun 2019 12:38:40 GMT
Content-Type: application/json
Content-Length: 584
Cache-Control: public, max-age=0, no-cache
Replay-Nonce: S_HNTw71IYM8iWx_KipijVJgwkJxtwSs3EQGrhhJhCU
{
"key-change": "http://localca:4000/acme/key-change",
"meta": {
"caaIdentities": [
"happy-hacker-ca.invalid"
],
"terms-of-service": "http://boulder:4000/terms/v1",
"website": "https://github.com/letsencrypt/boulder"
},
"new-authz": "http://localca:4000/acme/new-authz",
"new-cert": "http://localca:4000/acme/new-cert",
"new-reg": "http://localca:4000/acme/new-reg",
"revoke-cert": "http://localca:4000/acme/revoke-cert",
"xsrsNtQOaJA": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417"
}
2019-06-27 15:38:40,514:INFO:certbot.main:Obtaining a new certificate
2019-06-27 15:38:40,663:DEBUG:certbot.crypto_util:Generating key (2048 bits): /etc/letsencrypt/keys/0115_key-certbot.pem
2019-06-27 15:38:40,667:DEBUG:certbot.crypto_util:Creating CSR: /etc/letsencrypt/csr/0115_csr-certbot.pem
2019-06-27 15:38:40,668:DEBUG:acme.client:Requesting fresh nonce
2019-06-27 15:38:40,668:DEBUG:acme.client:Sending HEAD request to http://localca:4000/acme/new-authz.
2019-06-27 15:38:40,670:DEBUG:requests.packages.urllib3.connectionpool:"HEAD /acme/new-authz HTTP/1.1" 405 0
2019-06-27 15:38:40,671:DEBUG:acme.client:Received response:
HTTP 405
Allow: POST
Date: Thu, 27 Jun 2019 12:38:40 GMT
Content-Length: 91
Replay-Nonce: J137nXMD2y-Lg_Csa_wuyOYBbr1lLfHaKFOgqPBUCI8
Content-Type: application/problem+json
2019-06-27 15:38:40,671:DEBUG:acme.client:Storing nonce: J137nXMD2y-Lg_Csa_wuyOYBbr1lLfHaKFOgqPBUCI8
2019-06-27 15:38:40,671:DEBUG:acme.client:JWS payload:
b'{\n "resource": "new-authz",\n "identifier": {\n "type": "dns",\n "value": "localdomain"\n }\n}'
2019-06-27 15:38:40,674:DEBUG:acme.client:Sending POST request to http://localca:4000/acme/new-authz:
{
"payload": "ewogICJyZXNvdXJjZSI6ICJuZXctYXV0aHoiLAogICJpZGVudGlmaWVyIjogewogICAgInR5cGUiOiAiZG5zIiwKICAgICJ2YWx1ZSI6ICJyb2J1c3Q1Lm1xdHQuY29tIgogIH0KfQ",
"protected": "eyJqd2siOiB7Imt0eSI6ICJSU0EiLCAiZSI6ICJBUUFCIiwgIm4iOiAidGJMQUNscFR4bjBUd2t0ZXI4cXpackVhREoxNXBzV1MtbDRkV3ZJYnRRVzNyQjIyRWJOLVQtOS1oanB6eXFQd0RkbW1QVUNZdzdTbkJOM3NkeDdMNUlVMXZSdjdOTWZTRDNaRm$
"signature": "TqT0HF0eNHa_Gt4B8wcbPp5TReb4ZKGtvR0p6bcj1kU_E1_vNsApW96I1Q9IjGPNlTJu6t6YUbLW5JkDbFhKgbIVkAJAvTsk91CkzsCtzXmnc9-oiO4Yrdi_zCWGVo9N84WMPbMBQT_vhrWz4BAPFJqICJciIUasiIf24uh8nqaizi4AD0gqEhN9FEf2-p$
}
2019-06-27 15:38:40,688:DEBUG:requests.packages.urllib3.connectionpool:"POST /acme/new-authz HTTP/1.1" 201 935
2019-06-27 15:38:40,689:DEBUG:acme.client:Received response:
HTTP 201
Location: http://localca:4000/acme/authz/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs
Link: <http://localca:4000/acme/new-cert>;rel="next"
Boulder-Requester: 3
Date: Thu, 27 Jun 2019 12:38:40 GMT
Content-Length: 935
Cache-Control: public, max-age=0, no-cache
Content-Type: application/json
Replay-Nonce: C9KVfnMQggI06S_PrVUylNV2pg-PDDxpn8RzzdYjHH0
{
"identifier": {
"type": "dns",
"value": "localdomain"
},
"status": "pending",
"expires": "2019-07-04T12:38:40Z",
"challenges": [
{
"type": "tls-alpn-01",
"status": "pending",
"uri": "http://localca:4000/acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/25",
"token": "Y7ofVG_QBpHtDazmQWfxJlhw6DxFdeNYR3cRD4of2-g"
},
{
"type": "dns-01",
"status": "pending",
"uri": "http://localca:4000/acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/26",
"token": "I14ZrQyc_p19Jo5tQmQ6TOmnfkrptT0NJ6BilDQoqX0"
},
{
"type": "http-01",
"status": "pending",
"uri": "http://localca:4000/acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/27",
"token": "vbcMUeLszxvNQhsCk8wShbtha6Np_g8HUK2G04n0y1A"
}
],
"combinations": [
[
0
],
[
1
],
[
2
]
]
}
2019-06-27 15:38:40,689:DEBUG:acme.client:Storing nonce: C9KVfnMQggI06S_PrVUylNV2pg-PDDxpn8RzzdYjHH0
2019-06-27 15:38:40,690:INFO:certbot.auth_handler:Performing the following challenges:
2019-06-27 15:38:40,690:INFO:certbot.auth_handler:http-01 challenge for localdomain
2019-06-27 15:38:40,690:DEBUG:acme.standalone:Successfully bound to :80 using IPv6
2019-06-27 15:38:40,692:DEBUG:acme.standalone:Certbot wasn't able to bind to :80 using IPv4, this is often expected due to the dual stack nature of IPv6 socket implementations.
2019-06-27 15:38:40,695:INFO:certbot.auth_handler:Waiting for verification...
2019-06-27 15:38:40,696:DEBUG:acme.client:JWS payload:
b'{\n "type": "http-01",\n "keyAuthorization": "vbcMUeLszxvNQhsCk8wShbtha6Np_g8HUK2G04n0y1A.u_bhnTNJsYuuAK1UB8hTHC_G7rDJhn-0pwslpRA1jzA",\n "resource": "challenge"\n}'
2019-06-27 15:38:40,698:DEBUG:acme.client:Sending POST request to http://localca:4000/acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/27:
{
"payload": "ewogICJ0eXBlIjogImh0dHAtMDEiLAogICJrZXlBdXRob3JpemF0aW9uIjogInZiY01VZUxzenh2TlFoc0NrOHdTaGJ0aGE2TnBfZzhIVUsyRzA0bjB5MUEudV9iaG5UTkpzWXV1QUsxVUI4aFRIQ19HN3JESmhuLTBwd3NscFJBMWp6QSIsCiAgInJlc291$
"protected": "eyJqd2siOiB7Imt0eSI6ICJSU0EiLCAiZSI6ICJBUUFCIiwgIm4iOiAidGJMQUNscFR4bjBUd2t0ZXI4cXpackVhREoxNXBzV1MtbDRkV3ZJYnRRVzNyQjIyRWJOLVQtOS1oanB6eXFQd0RkbW1QVUNZdzdTbkJOM3NkeDdMNUlVMXZSdjdOTWZTRDNaRm$
"signature": "FxJYLSt26LL51R0a290IYEMVVn5YmxmLA9I55i8A7oK1QBPeSU12iBHBOzsvsIzaJAy5SYn8esHXSF3AgpWnkCnhv4Kgw9B1NKhDNmESobHt7c_wZ6AV4VxO1gpKmt7VBM_ISDhKZDI1kilC3kJnzIo3yi3MmwfXaBWx5Q5ZTsXNI1OFMzteFKbknQ_M0c$
}
2019-06-27 15:38:40,705:DEBUG:requests.packages.urllib3.connectionpool:"POST /acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/27 HTTP/1.1" 202 316
2019-06-27 15:38:40,705:DEBUG:acme.client:Received response:
HTTP 202
Location: http://localca:4000/acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/27
Link: <http://localca:4000/acme/authz/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs>;rel="up"
Boulder-Requester: 3
Date: Thu, 27 Jun 2019 12:38:40 GMT
Content-Length: 316
Cache-Control: public, max-age=0, no-cache
Content-Type: application/json
Replay-Nonce: iyqQDjNnUsMdIqJtb50P5L7Q4iHi5oQEzCzHO4NfseU
{
"type": "http-01",
"status": "pending",
"uri": "http://localca:4000/acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/27",
"token": "vbcMUeLszxvNQhsCk8wShbtha6Np_g8HUK2G04n0y1A",
"keyAuthorization": "vbcMUeLszxvNQhsCk8wShbtha6Np_g8HUK2G04n0y1A.u_bhnTNJsYuuAK1UB8hTHC_G7rDJhn-0pwslpRA1jzA"
}
2019-06-27 15:38:40,705:DEBUG:acme.client:Storing nonce: iyqQDjNnUsMdIqJtb50P5L7Q4iHi5oQEzCzHO4NfseU
2019-06-27 15:38:43,709:DEBUG:acme.client:Sending GET request to http://localca:4000/acme/authz/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs.
2019-06-27 15:38:43,716:DEBUG:requests.packages.urllib3.connectionpool:"GET /acme/authz/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs HTTP/1.1" 200 1522
2019-06-27 15:38:43,717:DEBUG:acme.client:Received response:
HTTP 200
Link: <http://localca:4000/acme/new-cert>;rel="next"
Date: Thu, 27 Jun 2019 12:38:43 GMT
Content-Length: 1522
Replay-Nonce: 94zq7jjiPDGREC-BIztCxpUqrQSVmEcZMOYp2iRJLr8
Content-Type: application/json
Cache-Control: public, max-age=0, no-cache
{
"identifier": {
"type": "dns",
"value": "localdomain"
},
"status": "invalid",
"expires": "2019-07-04T12:38:40Z",
"challenges": [
{
"type": "tls-alpn-01",
"status": "invalid",
"uri": "http://localca:4000/acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/25",
"token": "Y7ofVG_QBpHtDazmQWfxJlhw6DxFdeNYR3cRD4of2-g"
},
{
"type": "dns-01",
"status": "invalid",
"uri": "http://localca:4000/acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/26",
"token": "I14ZrQyc_p19Jo5tQmQ6TOmnfkrptT0NJ6BilDQoqX0"
},
{
"type": "http-01",
"status": "invalid",
"error": {
"type": "urn:acme:error:connection",
"detail": "Fetching http://localdomain/.well-known/acme-challenge/vbcMUeLszxvNQhsCk8wShbtha6Np_g8HUK2G04n0y1A: Connection refused",
"status": 400
},
"uri": "http://localca:4000/acme/challenge/j_YMkgogruGpmsfFDmZCxWioxkDtm8ZBLTuXMp70Bcs/27",
"token": "vbcMUeLszxvNQhsCk8wShbtha6Np_g8HUK2G04n0y1A",
"validationRecord": [
{
"url": "http://localdomain/.well-known/acme-challenge/vbcMUeLszxvNQhsCk8wShbtha6Np_g8HUK2G04n0y1A",
"hostname": "localdomain",
"port": "5002",
"addressesResolved": [
"172.17.0.1"
],
"addressUsed": "172.17.0.1"
}
]
}
],
"combinations": [
[
0
],
[
1
],
[
2
]
]
}
2019-06-27 15:38:43,718:DEBUG:certbot.reporter:Reporting to user: The following errors were reported by the server:
Domain: localdomain
Type: connection
Detail: Fetching http://localdomain/.well-known/acme-challenge/vbcMUeLszxvNQhsCk8wShbtha6Np_g8HUK2G04n0y1A: Connection refused
o fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address. Additionally, please check that your computer $
2019-06-27 15:38:43,718:DEBUG:certbot.error_handler:Encountered exception:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certbot/auth_handler.py", line 82, in handle_authorizations
self._respond(aauthzrs, resp, best_effort)
File "/usr/lib/python3/dist-packages/certbot/auth_handler.py", line 168, in _respond
self._poll_challenges(aauthzrs, chall_update, best_effort)
File "/usr/lib/python3/dist-packages/certbot/auth_handler.py", line 239, in _poll_challenges
raise errors.FailedChallenges(all_failed_achalls)
certbot.errors.FailedChallenges: Failed authorization procedure. localdomain (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://r$
2019-06-27 15:38:43,718:DEBUG:certbot.error_handler:Calling registered functions
2019-06-27 15:38:43,719:INFO:certbot.auth_handler:Cleaning up challenges
2019-06-27 15:38:43,719:DEBUG:certbot.plugins.standalone:Stopping server at :::80...
2019-06-27 15:38:44,197:DEBUG:certbot.log:Exiting abnormally:
hi