Lets Encrypt validation failed for these domain(s)

NethServer Version: NethServer release 7.9.2009 (final)
Module: Certificates

Trying to renew my Lets Encrypt cert.

Here is what I get -

or this

I know I have things in /var/log/letsencrypt/letsencrypt.log, But I am unsure of what would be helpful to show in it.

Thanks,
-SF-

Hi @Shadowfire

What about DNS records from your registrer ?

Michel-André

1 Like

For my first registrer -

For second registrer -

Give it a go:
https://letsdebug.net

1 Like

I will take a look in to letsdebug.net.

Thanks!

Hi @Shadowfire

Correct me if I am wrong but www.signetring.live is defined. I do not see signetring.live as A or CNAME but the link display a page…

Also: mycomputervisions.com ? but the link display a page…

Michel-André

1 Like

So I looked back at my registrer setup for singnetring.live…

I was using MXToolBox and getting everything on signetring.live ok. Except for the following…

So then I decided to change to the following …

Now I am seeing the following -

as well as the following -

I am unsure if it just needs to replicate and that will work itself out, or I need to fix DKIM - I copied and pasted what it told me. So it should be correct. Time will tell.

Now I have to go back to my mycomputervisions.com side and review my registrer dns for it and see if I need to clean something up on it’s side.

If any one has any suggestions I welcome them. Thanks for everyones feedback and help.

-SF-

First off, I have decided only to worry about mycomputervisions.com, cvserver.mycomputervisions.com, and mesh.mycomputervisions.com

So when I use Let’s Debug. On mycomputervisions.com the only one working was dns-01. Now dns-01, http-01, and tls-alpn-01 are all working.

but I am unable to get LetsEncrypt to renew the cert as seen below.

Hi @Shadowfire

Is the machine on the LOCAL LAN ?

Michel-André

Yes. It is.

Then you nedd to use acme.sh to get the Let’s Encrypt certificate.

Michel-André

Oh, I saw something about acme.sh, but didn’t realize I would need it for this. I take it there is no way to do acme.sh in GUI?

Is this what I need to follow to get results I am looking for? or something else?

and I am looking at this too…

and of course this…

https://wiki.nethserver.org/doku.php?id=userguide:let_s_encrypt_for_internal_servers

Is your web-server an internal server (maybe it is behind an nginx reverse proxy)?

Some options:

https://docs.nethserver.org/projects/nethserver-devel/en/latest/certificate_management.html#dns-challenge

or one of these guides depending on DNS provider:

https://wiki.nethserver.org/doku.php?id=userguide:let_s_encrypt_for_internal_servers
https://wiki.nethserver.org/doku.php?id=userguide:let_s_encrypt_acme-dns

2 Likes

3 posts were split to a new topic: LetsEncrypt Certificates for Internal Servers in NS7 vs NS8

Thanks for the reply above. I got challenged with a number of issue that had to be taken care of. I am just getting a chance to get back here and look what you are sharing. I will take a look at all that you have listed and linked above.

Thanks again
-=SF=-

I wanted to come back to this post and make sure I let others know what I did that finalized a fix for me under this issue. I had a number of items come up in my day to day work. It so happened that the LetsEncrypt Cert lapse. I tried again a this point to certify the mycomputervisions.com, cvserver.mycomputervisions, mesh.mycomputervisions.com, mail.mycomputervisions.com … and left out signetring.live. (I decided to run LetsEncrypt on the signetring.live server.)

The LetsEncrypt for mycomputervisions.com still failed.

Then I decided to take out mail.mycomputervisions.com.

So without mail.computervisions.com and signetring.live it finally allowed the LetsEncrypt Cet to complete validation and so now mycomputervisions.com and subs are validated and have a ssl cert.

Hope this in someway helps someone else.

1 Like