Will webroot challenge be performed over HTTPS or HTTP?

Help
1

When performing a certbot renew with --webroot I was getting the below described error, now I found out the root of the issue was LetsEncrypt performing the challenge via HTTP instead of HTTP, even though on the error is mentioned that it was fetching https://status.upstreampay.com/.well-known/acme-challenge, it was instead fetching http://status.upstreampay.com/.well-known/acme-challenge, which due to NGINX certbot generated config was redirecting with 301, which then was returning the correct value, but still the challenge would fail.

This is the NGINX config that was matching and failing:

server {
    if ($host = status.upstreampay.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    listen [::]:80  ;
    server_name status.upstreampay.com;
    return 404; # managed by Certbot
}

My domain is: status.upstreampay.com

I ran this command: certbot certonly --webroot -w /var/www

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for status.upstreampay.com
Using the webroot path /var/www for all unmatched domains.
Waiting for verification...
Challenge failed for domain status.upstreampay.com
http-01 challenge for status.upstreampay.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: status.upstreampay.com
   Type:   connection
   Detail: Fetching
   https://status.upstreampay.com/.well-known/acme-challenge/29YzYLF7PuG9_RvhgCzYRkBcdyJYza4DVNPa7ZS-ihI:
   Error getting validation data

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

My web server is (include version): nginx/1.20.1

The operating system my web server runs on is (include version): Ubuntu 20.04

My hosting provider, if applicable, is: DigitalOcean

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.0.0

3

It starts at HTTP, but the validation server follows redirects.

1 Like
4

refer to your other topic:
"Certbot renew fails even when the challenge HTTP request is working"

2 Likes