Let's Encrypt Error after changing server domain name

Support
,
1

I changed the server name from Example myserver.xyz.com to myserver.abc.com however when I request a cert from the Nethserver admin panel I get the following error
Challenge failed for domain abc.com Challenge failed for domain mail.abc.com Challenge failed for domain www.abc.com Some challenges have failed.

When I run /usr/libexec/nethserver/letsencrypt-certs -v -t from the command line i get the following still showing the old domain how do I fix this

domain: xyz.com
Type: unauthorized
Detail: Invalid response from
http://xyz.com/.well-known/acme-challenge/h7NXNCQucPT9JI56qEU5U_ZqMj3D5xOByoQ8cyJO9Fg
[xxx.xx.xxx.xxx]: "\n<html
style=“height:100%!(MISSING)”>\n\n<meta name=“viewport”
content=“width=device-width, initial-scale=1, shrink-to-”

Domain: www.xyz.com
Type: unauthorized
Detail: Invalid response from
http://www.xyz.com/.well-known/acme-challenge/hXb_B_DPplBIaEy-ZOmjZks_X54bYSXCB4rpqZUsblc
[xxx.xx.xxx.xxx]: "\n<html
style=“height:100%!(MISSING)”>\n\n<meta name=“viewport”
content=“width=device-width, initial-scale=1, shrink-to-”

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

  • Your account credentials have been saved in your Certbot
    configuration directory at /etc/letsencrypt. You should make a
    secure backup of this folder now. This configuration directory will
    also contain certificates and private keys obtained by Certbot so
    making regular backups of this folder is ideal.
    Restoring /etc/letsencrypt/ …
2

Try certbot certonly -w /var/www/html -d abc.com -d mail.abc.com -d www.abc.com -d myserver.abc.com --deploy-hook "/sbin/e-smith/signal-event certificate-update. Once that issues, you can choose the new cert in the server manager, and you should be set.

3

Thanks for the quick reply however when I run the command provided I given a option as shown below I choose option 1 I get " Problem binding to port 80: Could not bind to IPv4 or IPv6. If I choose option 2 I get the following.

How would you like to authenticate with the ACME CA?

1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)

Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel):

** Invalid input **
Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): c
Could not choose appropriate plugin: authenticator could not be determined or is not installed
authenticator could not be determined or is not installed
[root@docu-server ~]# certbot certonly -w /var/www/html -d bellcriminallaw.com -d mail.bellcriminallaw.com -d www.bellcriminallaw.com -d docu-server.bellcriminallaw.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?

1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)

Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 1
Plugins selected: Authenticator standalone, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for bellcriminallaw.com
http-01 challenge for docu-server.bellcriminallaw.com
http-01 challenge for mail.bellcriminallaw.com
http-01 challenge for www.bellcriminallaw.com
Cleaning up challenges
Problem binding to port 80: Could not bind to IPv4 or IPv6.
[root@docu-server ~]# ss -tlnp | grep -E “:(80|443)”
LISTEN 0 128 [::]:80 [::]:* users:((“httpd”,pid=15868,fd=4),(“httpd”,pid=15867,fd=4),(“httpd”,pid=15866,fd=4),(“httpd”,pid=15864,fd=4),(“httpd”,pid=15863,fd=4),(“httpd”,pid=15861,fd=4))
LISTEN 0 128 [::]:443 [::]:* users:((“httpd”,pid=15868,fd=6),(“httpd”,pid=15867,fd=6),(“httpd”,pid=15866,fd=6),(“httpd”,pid=15864,fd=6),(“httpd”,pid=15863,fd=6),(“httpd”,pid=15861,fd=6))
[root@docu-server ~]# clear
[root@docu-server ~]# certbot certonly -w /var/www/html -d bellcriminallaw.com -d mail.bellcriminallaw.com -d www.bellcriminallaw.com -d docu-server.bellcriminallaw.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?

1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)

Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 2
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for bellcriminallaw.com
http-01 challenge for docu-server.bellcriminallaw.com
http-01 challenge for mail.bellcriminallaw.com
http-01 challenge for www.bellcriminallaw.com
Using the webroot path /var/www/html for all unmatched domains.
Waiting for verification…
Challenge failed for domain bellcriminallaw.com
Challenge failed for domain docu-server.bellcriminallaw.com
Challenge failed for domain mail.bellcriminallaw.com
Challenge failed for domain www.bellcriminallaw.com
http-01 challenge for bellcriminallaw.com
http-01 challenge for docu-server.bellcriminallaw.com
http-01 challenge for mail.bellcriminallaw.com
http-01 challenge for www.bellcriminallaw.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

4

AFAIK Lets Encrypt checks DNS records. So you either need an A or CNAME record for the domain, servername and subdomains pointing to the IP address of your server.

5

He’s got those–at least they’re pointing somewhere, and that responds with a 403 error. But that shouldn’t happen on Neth; /.well-known should be accessible to the world.

6

All the domains are resolving could it be a permission error? I can navigate to the /var/www/html/.well-known/acme-challenge folder

7

Are they resolving correctly? Is the public IP address of your Neth server 173.164.10.173?

What are the permissions for that directory?

8

Ip address is 173.164.10.173 folder permissions are as follows
[root@docu-server ~]# ls -l /var/www/html/.well-known/acme-challenge/
total 20
-rwxr-xr-x 1 root root 87 Dec 12 18:32 MDWCRtcA7Mxw3wdXLSPI_4cRjWgxT45LWdUlDFAU1SY
-rwxr-xr-x 1 root root 87 Dec 12 18:32 RwgmWql2kamr-U0OGnT2WRbkI7q3lEQVP_eUjVyI7ek
-rwxr-xr-x 1 root root 87 Dec 12 18:32 wO2IiFQcP4kuqH5Zz9O5jYd-jT-QpfDodyVacCUaSkE
-rwxr-xr-x 1 root root 87 Dec 12 18:32 ZZXvH7Vxq7shuhqc9on3RuIEjQfvc3zmpkPAW867paM
-rwxr-xr-x 1 root root 87 Dec 12 18:32 ZZXvH7Vxq7shuhqc9on3RuIEjQfvc3zmpkPAW867paM (1)

9

Do you use reverse proxy?

Maybe there’s an error in the httpd configs so let’s check them for relevant entries:

grep -iR 'acme-challenge\|abc.com\|xyz.com' /etc/httpd/conf.d/ | sort

10

Below is the output

grep -iR ‘acme-challenge|jamesahbell.com|bellcriminallaw.com’ /etc/httpd/conf.d/ | sort

/etc/httpd/conf.d/letsencrypt.conf:Alias “/.well-known/acme-challenge/” “/var/www/html/.well-known/acme-challenge/”
/etc/httpd/conf.d/letsencrypt.conf:<Directory “/var/www/html/.well-known/acme-challenge/”>
[root@docu-server ~]#

11

Please check the permissions of the acme-challenge directory:

[root@nethserver ~]# ls -l /var/www/html/.well-known
total 4
drwxr-xr-x 2 root root 4096 Nov 25 07:13 acme-challenge
12

[root@docu-server ~]# ls -l /var/www/html/.well-known
total 0
drwxr-xr-x 2 root root 10 Dec 16 08:39 acme-challenge
[root@docu-server ~]# ls -l /var/www/html/.well-known
total 0
drwxr-xr-x 2 root root 10 Dec 16 08:39 acme-challenge
[root@docu-server ~]# total 4
-bash: total: command not found
[root@docu-server ~]# ls -l /var/www/html/.well-known
total 0
drwxr-xr-x 2 root root 10 Dec 16 08:39 acme-challenge
[root@docu-server ~]# ls -l /var/www/html/.well-known
total 0
drwxr-xr-x 2 root root 10 Dec 16 08:39 acme-challenge
[root@docu-server ~]# ls -l /var/www/html/.well-known
total 0
drwxr-xr-x 2 root root 10 Dec 16 08:39 acme-challenge
[root@docu-server ~]# [root@docu-server ~]# ls -l /var/www/html/.well-known
total 0
drwxr-xr-x 2 root root 10 Dec 16 08:39 acme-challenge

13

Hm, permissions look good.

Did you check the following?

1 Like
14

Yep your a genius…I deleted the .htaccess file and it worked…Thank you very much…

15

Thanks to @danb35, I just found his solution in another thread.

If the topic is solved, please mark an answer as solution:

1 Like