Webroot renewal timeout - works on standalone only

Help
22

Have we ruled out plain old IP based firewall yet? Sry haven't studied whole thread

23

AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using ::1. Set the 'ServerName' directive globally to suppress this message
VirtualHost configuration:
*:443 benedicte-pavageau.com (/etc/apache2/sites-enabled/wp-le-ssl.conf:2)
*:80 benedicte-pavageau.com (/etc/apache2/sites-enabled/wp.conf:1)

24

Not yet.
Most of the back and forth has been over using standalone [why/how/etc.]
Which has now been cleared up: They don't want to use --standalone anymore.

Now we have to deal with the firewall block.

25

Let's have a look at that file to confirm the DocumentRoot [a.k.a. WebRoot].

26

root@localhost:~# cat /etc/apache2/sites-enabled/wp.conf

<VirtualHost *:80>
        ServerName benedicte-pavageau.com
        ServerAlias www.benedicte-pavageau.com
        DocumentRoot /usr/share/wordpress

        ErrorLog ${APACHE_LOG_DIR}/wp-error.log
        CustomLog ${APACHE_LOG_DIR}/wp-access.log combined

        #redirect permanent "/" "https://benedicte-pavageau.com"
        RewriteEngine On
        RewriteCond %{SERVER_NAME} =www.benedicte-pavageau.com [OR]
        RewriteCond %{SERVER_NAME} =benedicte-pavageau.com
        RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
27

Ok that would redirect all the [challenge] requests.
Let's have a look at:

28

cat /etc/apache2/sites-enabled/wp-le-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>
        Servername benedicte-pavageau.com
        ServerAlias www.benedicte-pavageau.com
        ServerAdmin webmaster@example.com
        DocumentRoot /usr/share/wordpress

        Alias /wp-content /var/lib/wordpress/wp-content
        <Directory /usr/share/wordpress>
            Options FollowSymLinks
            AllowOverride Limit Options FileInfo
            DirectoryIndex index.php
            Require all granted
        </Directory>
        <Directory /var/lib/wordpress/wp-content>
            Options FollowSymLinks
            Require all granted
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/wp-error.log
        CustomLog ${APACHE_LOG_DIR}/wp-access.log combined


        SSLCertificateFile /etc/letsencrypt/live/benedicte-pavageau.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/benedicte-pavageau.com/privkey.pem
</VirtualHost>
</IfModule>
29

Ok that lines up perfectly for:
/usr/bin/certbot renew --webroot -w /usr/share/wordpress [--dry-run]

But they would fail because of the "firewall" blocking problem.
You need to review any/all firewall type policies in place that could block inbound HTTP connections.

30

nc -v benedicte-pavageau.com 80
Connection to benedicte-pavageau.com (172.105.247.238) 80 port [tcp/http] succeeded!

31

Yes, but NOT from the entire Internet.
LE can't reach your site [as shown above]:

Let's Debug also can't reach your site. See: Let's Debug (letsdebug.net)

32

how can i know where it is from ? is it the dns provider ? is it the server provider ? how do i know ?

33

You don't need to know [the specific IPs].
You need to allow the entire Internet HTTP access.

If you are concerned about security, HTTP should only be used by simple things [like: ACME] and redirect all else to HTTPS.
If you want to block, do it in HTTPS.

34

theres no firewall

35

I never said it was definitely a firewall.
I only know it is something that is NOT allowing HTTP - and HTTP should always be allowed.

36

what can it be if it's not a firewall ?

37
  • Fail2BAN
  • IPS
  • ISP
38

root@localhost:~# zgrep Ban /var/log/fail2ban.log* |grep http
root@localhost:~#

i have nothing else

39

By the way i dont know why cert would be banned

40

Are you sure your webserver is running?

--standalone not complaining about the port being occupied is a little suspect.

41

Yeah @9peppe the symptoms are odd. They are also doing two threads with similar problems but different domain names

See especially