Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
I ran this command:
certbot certonly --manual --preferred-challenge dns -d siteworks.u3asite.org.uk
It produced this output:
Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Identifier: siteworks.u3asite.org.uk
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.siteworks.u3asite.org.uk - check that a DNS record exists for this domain
My web server is (include version): Apache 2.4.52
The operating system my web server runs on is (include version): Ubuntu 24.04
My hosting provider, if applicable, is: AWS Lightsail
I can login to a root shell on my machine (yes or no, or I don't know): Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): (Can't access at present)
I'm doing something that most readers of this forum will have done countless times but unsure of the best way to do what I want. I'm moving Wordpress and another service to a new server, from one Lightsail account to another. I beleive the old server uses Letsencrypt certificates but it doesn't look like they use Certbot. The file structure is quite different. I want to move to using Certbot.
Clearly oince the DNS A record has moved then that's trivial but I wanted to put a certificate in place prior to the DNS change to avoid any downtime. In theory I can create the file structure and permissions that Certbot would create but I see that as more risky than getting Certbot to do it all for me.
Lacking an A record I decided to use a DNS challenge. This is proving a problem but not, I think, due to anything to do with Letsencrypt. However previous threads on here have suggested that DNS challenge is not the best way if you have alternatives.
Is my approach absurd? How would others go about this task?
Really? This is just a simple Lightsail Ubuntu instance. When I did a quick search this morning the result was a Lightsail help page that described installing Certbot. It may, of course, have been an old page.
We are not using an Amazon load balancer and for various reaons I need to keep support requests (e.g. DNS changes) to the ISP that manages the domain to a minimum. Having already generated the certificate (using Certbot) it still seems an easy and effective route, isn't it?
Frankly, I'm not sure how to do that but will investigate. I'm unfamiliar with Lightsail and was under the impression they required a Lightsail Load balancer.
It is not ideal. The manual method you used needs repeating for every renewal. Currently that means renewing about every 60 days. Starting next year that drops to about 40 days and the year after down to 30 days. See: Decreasing Certificate Lifetimes to 45 Days - Let's Encrypt
Automating cert renewal should be your goal.
Further, the instructions about Certbot in the AWS Docs I linked suggested avoiding that method. The main reason is lack of automation. But, it also has you installing from apt. Those packages don't have the latest Certbot version and the Certbot team (the EFF) recommend other install options to keep up to date. The current Certbot version is something like 5.6. You can check that apt version using certbot --version but it is likely fairly far behind.
People generally use Lightsail for simplicity and that works best if you follow the standard AWS instructions. Perhaps a different WordPress system would be better suited to your needs and your difficult-to-work-with DNS provider. I believe Lightsail gets certs automatically when using its built-in Route53 connection.
In any case, you said you now have a cert so not sure what more we could help with.
I am going to automate certificate renewal once the DNS change is in place.
Lightsail cerificates are attached to Load Balancers. I don't want a load balancer as the charity concerned would rather do something else with the $18/month that would cost. The only alternative is to treat the instances like any other stand-alone server. Hence my use of Certbot.
I do have a cert. for this instance now but it's not my only instance so I was looking for guidance for the future.
I still don't get it: how do you get a certificate in place before you've moved the A record from the old address to the new? I was looking for something other than a manual copy because, as I said, the file structure on the old machine is very different and an attempt to replicate the file structure and permission looked likely to be a source of errors.
If you can't just copy the certificate and key from the old server to the new one, using a one-time manual-authentication method to get a new certificate is a reasonable approach that's sometimes done. It sounds from your first post that that's what you were trying to do, but from the error you must not have put the DNS record in the right place when manually adding them to your authoritative DNS servers.
Are you the sysadmin for the u3a siteworks site itself? Because that leads to different kinds of answers especially regarding Certbot. Also for DNS Challenges as it looks to be using IONOS which has automated options.
If not, why don't you just use the WordPress hosting they include with their service? I didn't even see any docs on their site on how you'd use your own server for a subdomain there.
Thank you for your help, again.
Siteworks itself is a service that provides a website for over 750 u3as. I am an admin of that. It runs under cPanel and all the certificates are managed in that. siteworks.u3a.org.uk provides information to Current and prospective users of SiteWorks. it predated the establishment of siteworks itself and has been left in a seperate domain and on different hosting so that in the event of a siteworks-wide outage we can still provide status information.
So the site is currently on a Bitnami host on Lightsail. For complicated reasons we're moving to a new lightsail account but what we want to provide is unchanged. However Bitnami is deprecated so i've set up a bog-standard LAMP server.
I've no claim to be a super Linux admin but am dissapointed by the time this is taking me. I have a cert in place and am trying to test using a hosts file. The ssl is failing because the server is always seeing the IP address, never the FQDN.
That's right. I did sort out the DNS TXT record and the certificate is installed but, as i've just said to MikeMcQ, I get a certificate error when trying to connect to the FQDN using a hosts file.
Yes. The Apache vHost is for siteworks.u3a.org.uk with an alias of 13.42.202.44 so that a colleague can work on the content before it's live. The redirect is as follows
RewriteEngine on
RewriteCond %{SERVER_NAME} =siteworks.u3a.org.uk
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
Which looks OK to me but I'm no expert.
It really looks as if the requests are arriving as the IP address rather than host name.
I've set up another server with domains I admin and all is working.
I still suspect that somehow it's because there4's no A record existing for the domain and some modern browser (or server) security feature i'm unaware of.