Certbot renew error. Maybe it is related with proxy

1

Hi
I have a running webserver and using certbot for ssl certification and this configuration works as expected previously but now it gives an error when doing renew. I think it might be due to proxy settings but I have no idea. The interesting thing is that no changes were made to the webserver, it was working before. The only thing that changed recently was the incus version. Does anyone have an idea?
Here some information:

architecture: x86_64
config:
  boot.autostart: "true"
  image.architecture: amd64
  image.description: Ubuntu noble amd64 (20240729_07:42)
  image.os: Ubuntu
  image.release: noble
  image.requirements.cgroup: v2
  image.serial: "20240729_07:42"
  image.type: squashfs
  image.variant: cloud
  security.protection.delete: "true"
  volatile.base_image: 071a8c91052ee456a60e69a4e9ea73031fec314f594a126f6683cbe1aad97564
  volatile.cloud-init.instance-id: 447186d5-fdac-4c8b-8395-dbb404781c6b
  volatile.eth0.host_name: vethf7176902
  volatile.eth0.hwaddr: 00:16:3e:69:44:a0
  volatile.idmap.base: "0"
  volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.last_state.idmap: '[]'
  volatile.last_state.power: RUNNING
  volatile.last_state.ready: "false"
  volatile.uuid: a1f3b2e6-5817-46eb-97d1-b497501ce9cf
  volatile.uuid.generation: 7072b995-1451-412a-baf9-7d437646fbf6
devices:
  web80:
    connect: tcp:10.103.157.226:80
    listen: tcp:192.168.1.6:80
    type: proxy
  web443:
    connect: tcp:10.103.157.226:443
    listen: tcp:192.168.1.6:443
    type: proxy
ephemeral: false
profiles:
- default
stateful: false
description: ""

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: <erased_domain_information>
  Type:   connection
  Detail: XX.YY.ZZ.TTT: Fetching http://<erased_domain_information>/.well-known/acme-challenge/FwI7MHhUQOnBC7Xi9rQsFAEMA_0asFcvw-hHwDj1Ni4: Connection refused

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Failed to renew certificate <erased_domain_information> with error: Some challenges have failed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All simulated renewals failed. The following certificates could not be renewed:
  /etc/letsencrypt/live/<erased_domain_configuration/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
2

I am looking at this line. There is an attempt from Let’s Encrypt to connect to http://... of your site and access the special .well-known URL. The connection was refused because your server does not serve port 80.

  Detail: XX.YY.ZZ.TTT: Fetching http://<erased_domain_information>/.well-known/acme-challenge/FwI7MHhUQOnBC7Xi9rQsFAEMA_0asFcvw-hHwDj1Ni4: 
                 Connection refused

I think this happens when you add for the first time a domain to Let’s Encrypt. Initially, Let’s Encrypt tries to connect to the http:// of your website. Subsequently, Let’s Encrypt can perform the update for the certificate through https://, since one such certificate has already been issued and is active.

1 Like
3

It looks like you are connecting to Let’s Encrypt.

This Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet. is what you need to look into.