2

I have setup my server on digital ocean, and followed along with https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04

When I tried to run the command: sudo certbot --nginx --debug-challenges -v -d example.com

I get the following error;

 - The following errors were reported by the server:

   Domain: example.com
   Type:   unauthorized
   Detail: Invalid response from
   http://example.com/.well-known/acme-challenge/kwKqSzEgrvV1PqYY9dBVPY4CTnwrxtaOmslOPqoTfEM:
   "<!-- Server: P3PWPARKSTAT03 --><!DOCTYPE html><body
   style=\"padding:0; margin:0;\"><html><head><meta name=\"viewport\"
   content=\"widt"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

For testing purposes, I am just using a single server-block called default

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;

    index index.html index.htm index.nginx-debian.html;

    server_name example.com;

    location / {
        try_files $uri $uri/ =404;      
    }
    location ~ /.well-known/ {      
        allow all;
    }
}

When running certbot, it pauses after the challenge lines are added to the server-block, I can verify that they have been successfully added by loading the file: /etc/nginx/sites-available/default and everything checks out. If I restart my server and go to the url that it checks, it loads successfully. But for some reason I still get an invalid response when certbot does the challenge.

If I use curl before doing the certbot check (during the challenge pause), I get Wefk-bZlghLmz1UJBi337ScuwftpHKiza9sYhvsRCCg.-Rc1IAaUYmogSoOzgM-LhiqofLtcV63DTWuWifw2yqo which looks to be the correct result.

Is there something I am missing or must have forgotten? Because it seems like everything works when I manually validate it, but doesn't work for certbot. By the way, I swapped out my actual domain name for example.com. Not what it I actually have there.

Luple
  • 121
  • 3
  • Check the nginx error log. – Michael Hampton Feb 05 '19 at 15:58
  • Oh wow! thanks for the help. I believe you meant the letsencrypt log, not the nginx log. I found out that my domain name had two ip addresses it was pointing to. and when I tested it used the correct one, but when letsencrypt did, it was getting the wrong one! – Luple Feb 05 '19 at 16:16
  • Well actually I did mean the nginx log, but we would have gotten there eventually :) – Michael Hampton Feb 05 '19 at 16:17

0 Answers0