Windows installation - issue at step 5

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:btaliyun.com

I ran this command: certbot certonly --standalone

It produced this output:
C:\Users\Administrator>certbot certonly --standalone
Saving debug log to C:\Certbot\log\letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Please enter in your domain name(s) (comma and/or space separated) (Enter ā€˜cā€™
to cancel): btaliyun.com
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for btaliyun.com
Waiting for verificationā€¦
e[31mChallenge failed for domain btaliyun.come[0m
http-01 challenge for btaliyun.com
Cleaning up challenges
e[31mSome challenges have failed.e[0m
e[1m
IMPORTANT NOTES:
e[0m - The following errors were reported by the server:

Domain: btaliyun.com
Type: dns
Detail: DNS problem: NXDOMAIN looking up A for btaliyun.com - check
that a DNS record exists for this domain

My web server is (include version): IIS

The operating system my web server runs on is (include version):windows server 2019

My hosting provider, if applicable, is: alibaba cloud

I can login to a root shell on my machine (yes or no, or I donā€™t know): yes

Iā€™m using a control panel to manage my site (no, or provide the name and version of the control panel): yes

The version of my client is (e.g. output of certbot --version or certbot-auto --version if youā€™re using Certbot):
certbot --version
certbot 1.7.0

2

Hi @boteta,

It looks like this domain is not registered at all. You can only get publicly-trusted certificates for domain names that you already own.

1 Like
4

Hi, latest error below. any advise? thanks in advance

certbot certonly --webroot
Saving debug log to C:\Certbot\log\letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Please enter in your domain name(s) (comma and/or space separated) (Enter ā€˜cā€™
to cancel): btali.tk
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for btali.tk
Input the webroot for btali.tk: (Enter ā€˜cā€™ to cancel): C:\inetpub\wwwroot
Waiting for verificationā€¦
e[31mChallenge failed for domain btali.tke[0m
http-01 challenge for btali.tk
Cleaning up challenges
e[31mSome challenges have failed.e[0m
e[1m
IMPORTANT NOTES:
e[0m - The following errors were reported by the server:

Domain: btali.tk
Type: unauthorized
Detail: Invalid response from
http://btali.tk/.well-known/acme-challenge/CFIdyTZMRVCcvtFnON55HOX8timb5k4Kug2cmwKd3m4
[161.117.252.66]: "\r\n<html
xmlns=ā€œhttpā€

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

5

It looks like your hosting provider is not connected to your siteā€™s IP address. What is your hosting provider?

6

Hi, I got the free domain from my.freenom.com . i did nslookup and open btali.tk in browser, it work. thus, i am guessing it may be some config in certbot

7

Is 161.117.252.66 the IP address of your Windows server on Alibaba Cloud?

When I visit btali.tk in the browser, I donā€™t see the usual Server response header sent by IIS servers, which is unusual.

Is the ā€œHello Alibaba Cloudā€ page I see in your browser in your wwwroot?

8

Hi,

161.117.252.66 is my server load balancer that points to my windows server vm (161.117.249.237)

yes , ā€œHello Alibaba Cloudā€ page is in my wwwroot

9

Thatā€™s probably fine.

You might have to tell IIS to allow extensionless files. In C:\inetput\wwwroot\.well-known\acme-challenge\, create web.config:

<?xml version="1.0" encoding="UTF-8"?>
 <configuration>
     <system.webServer>
         <staticContent>
             <mimeMap fileExtension=".*" mimeType="text/plain" />
         </staticContent>
     </system.webServer>
 </configuration>

Try create a test file in there as well, and see whether you can access it from the browser.

10

thanks. the cert is created as shown below now. however, all the *.pem file are empty. I believe the public key cert file shall start with ā€œ-----BEGIN CERTIFICATE-----ā€ and private key cert file shall start with ā€œ-----BEGIN RSA PRIVATE KEY-----ā€. am i missing something? thanks in advance

certbot certonly --webroot
Saving debug log to C:\Certbot\log\letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Please enter in your domain name(s) (comma and/or space separated) (Enter ā€˜cā€™
to cancel): btali.tk
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for btali.tk
Input the webroot for btali.tk: (Enter ā€˜cā€™ to cancel): C:\inetpub\wwwroot
Waiting for verificationā€¦
Cleaning up challenges
e[1m
IMPORTANT NOTES:
e[0m - Congratulations! Your certificate and chain have been saved at:
C:\Certbot\live\btali.tk\fullchain.pem
Your key file has been saved at:
C:\Certbot\live\btali.tk\privkey.pem
Your cert will expire on 2020-12-07. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew all of your certificates, run
ā€œcertbot renewā€

11

That certainly should not be the case.

Have you tried making sure you are opening the files as administrator?

Iā€™m not a Windows user, but thatā€™s my guess.

12

got it. thank you very much

13

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.