0

I want to install let's encrypt certificate on my server for domain.com, www.domain.com and mail.domain.com. so I created the following domain-site.conf file for virtual hosts:

<VirtualHost *:80>
ServerAdmin [email protected]
DocumentRoot "/home"
ServerName domain.com
ServerAlias www.domain.com
ErrorLog "/var/log/httpd/domain.error_log"
CustomLog "/var/log/httpd/domain.access_log" common
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.domain.com [OR]
RewriteCond %{SERVER_NAME} =domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:80>
ServerAdmin [email protected]
DocumentRoot "/home"
ServerName mail.domain.com
ErrorLog "/var/log/httpd/mail.domain.error_log"
CustomLog "/var/log/httpd/mail.domain.access_log" common
</VirtualHost>

and then when I run sudo certbot --apache command and hit the enter to install certificate for all 3 names, it can not install certificate for mail.domain.com and gives the below output. how to solve the issue?

You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/domain.com.conf)

It contains these names: domain.com, www.domain.com

You requested these names for the new certificate: domain.com, mail.domain.com,
www.domain.com.

Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: e
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for mail.domain.com
Waiting for verification...
Challenge failed for domain mail.domain.com
http-01 challenge for mail.domain.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
- The following errors were reported by the server:

Domain: mail.domain.com
Type:   unauthorized
Detail: Invalid response from
http://mail.domain.com/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU
[ip]: "<html>\r\n<head><title>404 Not
Found</title></head>\r\n<body>\r\n<center><h1>404 Not
Found</h1></center>\r\n<hr><center>nginx/1.18.0 (Ub"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
Improve this question
4
  • 2
    certbot connected to some server which is apparently nginx. But you provided only an Apache configuration. Did you omit some important details?
    – Michael Hampton
    Sep 2, 2020 at 16:25
  • 1
    Good spot @michael-hampton - I didn't spot the nginx stanza in the 404
    – jaygooby
    Sep 3, 2020 at 10:26
  • @MichaelHampton I never installed nginx myself on the server and it was also a surprise for me where nginx has come from! I have installed postfix and devocot on my server. don't they install anything related to nginx?
    – SAndroid
    Sep 3, 2020 at 10:30
  • 1
    Check to see if nginx is actually installed and running on your server. If it is not, then check your DNS records to ensure that they are correct.
    – Michael Hampton
    Sep 3, 2020 at 14:19

2 Answers 2

Reset to default
1

That error means there's an HTTP 404 for the certbot file that it expects to see at mail.domain.com/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU

Can you see this file in /home/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU?

Can you write your own file there, to test that it's being served?

echo wat > /home/.well-known/acme-challenge/wat

Then you should be able to curl it with:

curl mail.domain.com/.well-known/acme-challenge/wat

Given that mail.domain.com has got the same docroot as domain.com and www.domain.com you should also be able to curl domain.com/.well-known/acme-challenge/wat and curl www.domain.com/.well-known/acme-challenge/wat

If that doesn't work, then there's something up with your Apache config, or possibly the ownership/permissions of /home, /home/.well-known or /home/.well-known/acme-challenge

Improve this answer
1
  • thanks for your answer. the problem was related to DNS configurations!
    – SAndroid
    Sep 3, 2020 at 10:35
0

so the problem was related to DNS forward zone configurations. I had defined mail IN A 192.168.0.60 in forward zone and 60 IN PTR mail.domain.com in reverse zone. I changed the record in forward zone to mail IN A <server_ip> and the problem got disappeared.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .