• I have a main domain chadjessen.com. I have a subdomain publicapi.chadjessen.com. Letsencrypt renewed the certificate for chadjessen.com just fine but I have been trying and pulling my hair out to try and figure out why it won’t renew for publicapi.chadjessen.com. I can ping it, I can go to dns lookup and everything goes through just fine. Below is the message that comes up after requesting the certificates. This was working before, so not sure what happened.

    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Plugins selected: Authenticator webroot, Installer None
    Renewing an existing certificate
    Performing the following challenges:
    http-01 challenge for publicapi.chadjessen.com
    http-01 challenge for www.publicapi.chadjessen.com
    Using the webroot path /home/chadjessen/domains/publicapi.chadjessen.com/public_html for all unmatched domains.
    Waiting for verification...
    Challenge failed for domain publicapi.chadjessen.com
    Challenge failed for domain www.publicapi.chadjessen.com
    http-01 challenge for publicapi.chadjessen.com
    http-01 challenge for www.publicapi.chadjessen.com
    Cleaning up challenges
    Some challenges have failed.
    IMPORTANT NOTES:
     - The following errors were reported by the server:
    
       Domain: publicapi.chadjessen.com
       Type:   unauthorized
       Detail: Invalid response from
       http://publicapi.chadjessen.com/.well-known/acme-challenge/SvIpe5TGPgHACfcYg_ezswBJJso7CAT4S2ZoW4EHLGE
       [143.244.152.107]: "<!DOCTYPE html>\n<html
       lang=\"en\">\n<head>\n<meta
       charset=\"utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>Cannot
       GET /.well-known/"
    
       Domain: www.publicapi.chadjessen.com
       Type:   unauthorized
       Detail: Invalid response from
       http://www.publicapi.chadjessen.com/.well-known/acme-challenge/_zWHJoOZf3szsMh36hmhV5O-iqQtZp60jePqgL9KH94
       [143.244.152.107]: "<!DOCTYPE html>\n<html
       lang=\"en\">\n<head>\n<meta
       charset=\"utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>Cannot
       GET /.well-known/"
    
       To fix these errors, please make sure that your domain name was
       entered correctly and the DNS A/AAAA record(s) for that domain
       contain(s) the right IP address.
    
      DNS-based validation failed :
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Plugins selected: Authenticator manual, Installer None
    Renewing an existing certificate
    Performing the following challenges:
    dns-01 challenge for publicapi.chadjessen.com
    dns-01 challenge for www.publicapi.chadjessen.com
    Running manual-auth-hook command: /etc/webmin/webmin/letsencrypt-dns.pl
    Running manual-auth-hook command: /etc/webmin/webmin/letsencrypt-dns.pl
    Waiting for verification...
    Challenge failed for domain publicapi.chadjessen.com
    Challenge failed for domain www.publicapi.chadjessen.com
    dns-01 challenge for publicapi.chadjessen.com
    dns-01 challenge for www.publicapi.chadjessen.com
    Cleaning up challenges
    Running manual-cleanup-hook command: /etc/webmin/webmin/letsencrypt-cleanup.pl
    Running manual-cleanup-hook command: /etc/webmin/webmin/letsencrypt-cleanup.pl
    Some challenges have failed.
    IMPORTANT NOTES:
     - The following errors were reported by the server:
    
       Domain: publicapi.chadjessen.com
       Type:   dns
       Detail: DNS problem: NXDOMAIN looking up TXT for
       _acme-challenge.publicapi.chadjessen.com - check that a DNS record
       exists for this domain
    
       Domain: www.publicapi.chadjessen.com
       Type:   dns
       Detail: DNS problem: NXDOMAIN looking up TXT for
       _acme-challenge.www.publicapi.chadjessen.com - check that a DNS
       record exists for this domain
    
  • Global Moderator Guru

    @madchatthew that’s odd. Let’s Encrypt is complaining about the lack of .well-known which is required for activation. Seeing as you created this as a sub domain it should work without issue.

    Do you have certbot installed at all ? If not, have a look at this and go from step 4

  • Global Moderator Guru

    @madchatthew do you have a sub domain setup for publicapi.chadjessen.com setup n VirtualMin ?


  • @phenomlab I do. It is in the domains folder under chadjessen.com. I set it up as a subdomain through virtualwin.

  • Global Moderator Guru

    @madchatthew that’s odd. Let’s Encrypt is complaining about the lack of .well-known which is required for activation. Seeing as you created this as a sub domain it should work without issue.

    Do you have certbot installed at all ? If not, have a look at this and go from step 4


  • @phenomlab I thought the same thing. I will try these steps a little later today and let you know the results. Thanks


  • So I installed certbot and went through the steps. It was successful. My publicapi.chadjessen.com is now secured again. I made sure that the auto renewal was set and did a dry run to make sure that everything would go through. I didn’t have to add the ppa like it said in the instructions. I am running Ubuntu 20.04. I just had to run the install part of the program.

    It is weird that Virtualmin wouldn’t renew it. I will make sure just to use certbot if I have any other issues with it.

    Thanks for your help Mark, I really appreciate it.

  • Topic has been marked as solved  Madchatthew Madchatthew 
  • Topic has been marked as unsolved  Madchatthew Madchatthew 
  • Topic has been marked as solved  Madchatthew Madchatthew 
  • Global Moderator Guru

    @madchatthew no problems Chad. Always happy to help out. I’ve come across this before myself hence the suggestion as it worked for me previously as it did for you. The only gotcha here is that you won’t be able to manage that particular cert through WebMin or VirtualMin in terms of renewal etc - it needs to be done from CLI.

  • Unlocked by  phenomlab phenomlab 
  • Global Moderator Guru

    A quick update for anyone reading this thread, and attempting to follow the links. It seems that the PPA has been deprecated, meaning that

    sudo add-apt-repository ppa:certbot/certbot will NOT work.

    You’ll need to download the .deb files manually from here, then use sudoi dkpg -i <deb> to install

    Additionally, if you’re a Webmin user and are looking for a way to install Certbot there, details for that are here.


  • @phenomlab Else ye’ can also always opt for some Dehydrated Boulders and be done with it, eh? 👍

  • Global Moderator Guru

    @gotwf Yes, you could… 🙂


  • @phenomlab Indubitably. I have been using dehydrated since early days of Let’s Encrypt. I favor KISS engineering and Dehydrated is a “simple” shell script. And in so being, also easy to automate via cron jobs. No big mussin’ or fussin’ about with the evil systemd. 🤡

    Dehydrated has been under +/- continual incremental development since those early days (who’d of thunk it?) and scratches my itches.

    My $0.02. Caveat emptor.

  • Global Moderator Guru

    @gotwf KISS - now there’s a phrase I’ve not heard for a while… I have a blog article about that I’ll out up soon.

  • Global Moderator Guru

    @gotwf said in Virtualmin Letsencrypt Renewal:

    I favor KISS engineering

    Then I think you’ll be able to appreciate this
    https://sudonix.com/topic/74/keep-it-simple-stupid


Suggested Topics