Why SSL verification of my domain name failed?

Help
1

Hi,

Does anyone know why the verification of my domain name (www.friendly.cool, friendly.cool) failed?

C:\Users\Administrator>le64 -key account.key -csr mydomain.csr -csr-key mydomain.key -crt mydomain.crt -domains “www.friendly.cool,friendly.cool” -path C:\inetpub\henrywebroot.well-known\acme-chal
ge -generate-missing -live
2019/06/26 19:02:11 [ ZeroSSL Crypt::LE client v0.32 started. ]
2019/06/26 19:02:11 Loading an account key from account.key
2019/06/26 19:02:11 Loading a CSR from mydomain.csr
2019/06/26 19:02:13 Registering the account key
2019/06/26 19:02:13 The key is already registered. ID: 60072200
2019/06/26 19:02:14 Successfully saved a challenge file ‘C:\inetpub\henrywebroot.well-known\acme-challenge/JqcHkRlRRa1Bz3kEcbKOEWX-sfKbhPZo7JzlAnyoHCc’ for domain ‘www.friendly.cool’
2019/06/26 19:02:14 Successfully saved a challenge file ‘C:\inetpub\henrywebroot.well-known\acme-challenge/ApHXDTkzYZ45qaKwL3amnv02V-KJYalI4RPPeImj_6Y’ for domain ‘friendly.cool’
2019/06/26 19:02:16 Domain verification results for ‘www.friendly.cool’: error. Invalid response from http://www.friendly.cool/.well-known/acme-challenge/JqcHkRlRRa1Bz3kEcbKOEWX-sfKbhPZo7JzlAnyoHCc
08.6.59.126]: "\r\n<html xmlns=“http”
2019/06/26 19:02:16 You can now delete the ‘C:\inetpub\henrywebroot.well-known\acme-challenge/JqcHkRlRRa1Bz3kEcbKOEWX-sfKbhPZo7JzlAnyoHCc’ file.
2019/06/26 19:02:19 Domain verification results for ‘friendly.cool’: error. Invalid response from http://friendly.cool/.well-known/acme-challenge/ApHXDTkzYZ45qaKwL3amnv02V-KJYalI4RPPeImj_6Y [108.6.
126]: "\r\n<html xmlns=“http”
2019/06/26 19:02:19 You can now delete the ‘C:\inetpub\henrywebroot.well-known\acme-challenge/ApHXDTkzYZ45qaKwL3amnv02V-KJYalI4RPPeImj_6Y’ file.
2019/06/26 19:02:19 All verifications failed

2

I can see a couple of issues.

The first is that your IIS bindings don't seem quite right. Try visiting each link below - the second one gives the default IIS page. This will break the process.

The second issue seems to be the way you are calling le64.

That does not seem right. You probably mean:

-path "C:\inetpub\henry\webroot\.well-known\acme-challenge"
1 Like
3

_az,

Thank you for the reply. I fixed all the issues you have indicated, and re-executed the steps. However, the domain verification is still failing. Below is my latest execution code.
Note: The henrywebroot.well-know is actually not the error in my code. It is caused by this website letsencrypt.org’s text to html translation error. I just added the double \ to this html posting to take care of the problem.

C:\Users\Administrator>le64 -key account.key -csr mydomain.csr -csr-key mydomain.key -crt mydomain.crt -domains “www.friendly.cool,friendly.cool” -path “C:\inetpub\henrywebroot\.well-known\acme-chal
nge” -generate-missing -live
2019/06/26 21:28:55 [ ZeroSSL Crypt::LE client v0.32 started. ]
2019/06/26 21:28:55 Loading an account key from account.key
2019/06/26 21:28:55 Loading a CSR from mydomain.csr
2019/06/26 21:28:57 Registering the account key
2019/06/26 21:28:57 The key is already registered. ID: 60078796
2019/06/26 21:28:58 Successfully saved a challenge file ‘C:\inetpub\henrywebroot\.well-known\acme-challenge/iLm5OVFuH2gUy8E5bIdZEo2lv3Szgp2S7OG6nxJN0B4’ for domain ‘www.friendly.cool’
2019/06/26 21:28:58 Successfully saved a challenge file ‘C:\inetpub\henrywebroot\.well-known\acme-challenge/WYWnEfubtmyp5PactcJv2opHjjuvdDORrfM6bPpxfto’ for domain ‘friendly.cool’
2019/06/26 21:29:00 Domain verification results for ‘www.friendly.cool’: error. Invalid response from http://www.friendly.cool/.well-known/acme-challenge/iLm5OVFuH2gUy8E5bIdZEo2lv3Szgp2S7OG6nxJN0B4
08.6.59.126]: "\r\n<html xmlns=“http”
2019/06/26 21:29:00 You can now delete the ‘C:\inetpub\henrywebroot\.well-known\acme-challenge/iLm5OVFuH2gUy8E5bIdZEo2lv3Szgp2S7OG6nxJN0B4’ file.
2019/06/26 21:29:03 Domain verification results for ‘friendly.cool’: error. Invalid response from http://friendly.cool/.well-known/acme-challenge/WYWnEfubtmyp5PactcJv2opHjjuvdDORrfM6bPpxfto [108.6.5
126]: "\r\n<html xmlns=“http”
2019/06/26 21:29:03 You can now delete the ‘C:\inetpub\henrywebroot\.well-known\acme-challenge/WYWnEfubtmyp5PactcJv2opHjjuvdDORrfM6bPpxfto’ file.
2019/06/26 21:29:03 All verifications failed

4

Can you manually place a file in that directory and access it via the browser?

5

_az,

I am able to access file in the diretory.

http://www.friendly.cool/.well-known/acme-challenge/test.htm

1 Like
6

You may need to add some custom IIS configuration to allow for extension-less files to be accessible. This is a common problem that IIS users run into.

For example, by creating a web.config file inside the acme-challenge directory with these contents:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <staticContent>
            <mimeMap fileExtension="." mimeType="text/plain" />
        </staticContent>
    </system.webServer>
</configuration>
7

Hi @TonySSL

remove the .html extension.

The file Letsencrypt checks is extensionless. So a file with .htm may work, a file without not.

9

_az,

Thank you so much for your help. I was able to successfully create the mydomain.crt, mydomain.key, mydomain.csr an account.key files. However, when I tried to use openssl to generate the .pfx file, I got the error below. Yes, this is more of an openssl question, but it is also related to SSL on ISS server. I hope you have the answer for this question.

PS C:\OpenSSL-Win64\bin> openssl pkcs12 -export -out mycert.pfx -inkey mydomain.key -in mydomain.crt
No certificate matches private key
PS C:\OpenSSL-Win64\bin>

10

You don’t really need to use openssl to produce a PFX file, it is supported natively by le64 - see https://github.com/do-know/Crypt-LE#pfxp12-iis-support

As for the error you are seeing when attempting to convert with openssl, that might be due to the fact that by default the certificate file (mydomain.crt in your case) contains 2 certificates - for your domain and the intermediate one. Those can be stored separately (domain certificate to .crt file and intermediate to .ca file) if -legacy option is used. Alternatively you can just split that crt file leaving only your domain certificate in it - the answer given in ZeroSSL FAQ might apply to your case as well.

3 Likes
11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.