Why do I get an error when getting a certificate from Let's Encrypt?

Question

Nginx

Hello!
When I receive a certificate for horijdaish.uz via certbot, I get an error:
Timeout during connect (likely firewall problem).
Ports 80 and 443 are available on the server.

ufw status verbose

Status: active
Logging: off
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
80/tcp                 ALLOW IN    Anywhere                  
443/tcp               ALLOW IN    Anywhere

Created a temporary file horijdaish.uz/.well-known/acme-challenge/1 and it opens without problems.
In the nginx logs, you can see that the server sends a verification file (code 200) without errors.

NGINX log

18.197.227.110 - - [26/Sep/2019:10:32:16 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
18.197.227.110 - - [26/Sep/2019:10:32:16 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
3.14.255.131 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
3.14.255.131 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
18.197.227.110 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
18.197.227.110 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
3.14.255.131 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
3.14.255.131 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
34.222.229.130 - - [26/Sep/2019:10:32:18 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
34.222.229.130 - - [26/Sep/2019:10:32:18 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
34.222.229.130 - - [26/Sep/2019:10:32:18 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
34.222.229.130 - - [26/Sep/2019:10:32:18 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"

To get the certificate I run:

certbot certonly --webroot -w /home/horijdaish/www/webroot -d horijdaish.uz,www.horijdaish.uz

Console output

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for horijdaish.uz
http-01 challenge for www.horijdaish.uz
Using the webroot path /home/horijdaish/www/webroot for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. www.horijdaish.uz (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://www.horijdaish.uz/.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE: Timeout during connect (likely firewall problem), horijdaish.uz (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://horijdaish.uz/.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw: Timeout during connect (likely firewall problem)

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: www.horijdaish.uz
   Type:   connection
   Detail: Fetching
   http://www.horijdaish.uz/.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE:
   Timeout during connect (likely firewall problem)

   Domain: horijdaish.uz
   Type:   connection
   Detail: Fetching
   http://horijdaish.uz/.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw:
   Timeout during connect (likely firewall problem)

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

nslookup

nslookup horijdaish.uz 8.8.8.8
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
Name:	horijdaish.uz
Address: 185.8.212.153

Nginx

server {
    listen 185.8.212.153:80;
    server_name horijdaish.uz www.horijdaish.uz;
    charset utf-8;

    access_log  /var/log/nginx/horijdaish.access.log;
    error_log   /var/log/nginx/horijdaish.error.log;

    client_max_body_size 100m;

    set $root_path /home/horijdaish/www/webroot;
    set $php_sock  unix:/var/run/php/php7.2-fpm-horijdaish.sock;

    root   $root_path;
    index  index.php index.html index.htm;
       
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~* ^/(css|font|images|img|js|uploads|test)/.+\.php$ {
        deny all;
    }

    location ~ /\. {
        deny  all;
        access_log off;
        log_not_found off;
        return 404;
    }
  
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass $php_sock;
        fastcgi_index index.php;   
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
    }

    # Let's Encrypt
    location ^~ /.well-known {
        allow all;
        default_type "text/plain";
        root $root_path;
    }
}

How can this error be corrected? Has anyone encountered such a problem?!

Answer 1

I recommend using DNS mode.
You don’t need to configure it for a web server, you don’t need to listen to the port yourself, you can use wildcard domains, it’s easier to automate reissue.

Answer 2

Just enter the cerbot command and get the certificate in console mode

Answer 3

To fix these errors, please make sure that your domain name was entered correctly and the DNS A
/ AAAA
(likely firewall problem) - and this is the second, perhaps even the first.
And to
remove the AAA record, letsencrypyt does not support ipv6
, and for some reason, letsencrypt cannot put the file.