Problem with obtaining an SSL certificate through Certbot. Detail: Invalid response from?

M

MarkelSTV2020-10-20 00:16:23

Nginx

MarkelSTV, 2020-10-20 00:16:23

Previously installed Certbot and successfully obtained a certificate for one of the domains. There was a necessity to fasten one more domain. I added a domain to the nginx config, everything works fine via http, the config looks like this:

upstream backend {
        server 127.0.0.1:8085;
}

server {
    server_name domain_name_1 domain_name_2;
    access_log  /var/log/nginx/domain_name.log;
    location / {
        proxy_set_header      Host              $host;
        proxy_set_header      X-Real-IP         $remote_addr;
        proxy_set_header      X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header      X-Forwarded-Host  $host;
        proxy_set_header      X-Forwarded-Proto $scheme;
        proxy_pass http://backend;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/domain_name/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/domain_name/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = domain_name_1) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name domain_name_1 domain_name_2;
    return 404; # managed by Certbot
}

When I try to get a certificate for the second domain domain_name_2, I get the following error:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: domain_name_1
2: domain_name_2
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/domain_name_1.conf)

It contains these names: domain_name_1

You requested these names for the new certificate: domain_name_1,
domain_name_2.

Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: E
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for domain_name_2
Waiting for verification...
Challenge failed for domain domain_name_2
http-01 challenge for domain_name_2
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: domain_name_2
   Type:   unauthorized
   Detail: Invalid response from
   http://domain_name_2/.well-known/acme-challenge/4UtNTakW9jzvq4bo68i_bLYuL7yjF8XfpJ2EiKAD2Cc
   [2001:41d0:b:a74:5:39:10:93]: "<!DOCTYPE html>\n<html
   lang=\"ru-RU\" prefix=\"og: http://ogp.me/ns#\"
   class=\"no-js\">\n<head>\n\n    <meta name=\"theme-color\"
   content=\"#"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

I would really appreciate your help and ideas!

Reply

Answer the question

In order to leave comments, you need to log in

2 answer(s)

V

Viktor Taran, 2020-10-20
@MarkelSTV

Here it seems to be written in Russian
1. I could not put the domain_name_2/.well-known/acme-challenge/4UtNTakW9 file...
I didn’t have enough rights, I couldn’t save it.
2. option You have an AAA record in your DNS records - which is not supported by letsencrypt
3. your redirects return 302 instead of 200 as we can see you have no exception.
Now, as for the directory
, you can do this

location /.well-known/acme-challenge/ {
                alias /usr/local/ispconfig/interface/acme/;
                default_type text/plain;
         }

and in my case I ask crtbot to put all these files in /usr/local/ispconfig/interface/acme/
it turns out like phpmyadmin adding to any site you get into this folder.
YES, and your domain is not secret, you even promote it in direct, so if you give it it will be easier to figure it out

K

ky0, 2020-10-20
@ky0

Something unexpected is returned instead of a letsencrypt response. Apparently, the location processing the urls is /.well-known/acme-challengedoing it wrong.