Error Message After Running Let's Encrypt

johnclint · April 21, 2022, 9:03pm

Problem Description
When I attempt to obtain a certificate using Let’s Encrypt, I get a Failed to obtain certificate for domain johnclint.net message.

Steps to Reproduce

Login to FreedomBox.
Go to Let’s Encrypt page.
Select Obtain button.

Expected Results
I expected a valid certificate to be generated.

Actual results
I receive this error message:

Failed to obtain certificate for domain johnclint.net: Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator webroot, Installer None An unexpected error occurred: requests.exceptions.ConnectionError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0xb3909508>: Failed to establish a new connection: [Errno -2] Name or service not known')) Please see the logfiles in /var/log/letsencrypt for more details.

Screenshot

Information

FreedomBox version: 22.9
Hardware: Pioneer
How did you install FreedomBox?: From mini-SD card provided by Olimex.

Ports TCP 80 and 443 on my router are configured to forward to my FreedomBox. A static DNS for my FreedomBox is assigned on my router. My domain name is configured on my FreedomBox.

jvalleroy · April 22, 2022, 10:40am

If you go to your domain in your browser, are you able to access your FreedomBox?

This is the pre-requisite for Let’s Encrypt to work.

johnclint · April 22, 2022, 1:33pm

Hello, James.

Yes, I can access my FreedomBox from my domain name (www.johnclint.net).

nbenedek · April 22, 2022, 6:43pm

There’s a difference between johnclint.net and www.johnclint.net. In the DNS Records, you should point your IP to your domain without www.

johnclint · April 25, 2022, 9:12pm

Hey, Benedek.

I did as you suggested and I’m still getting an error message from Let’s Encrypt.

May I go over the steps for Let’s Encrypt outlined in the FreedoxBox Manual? Perhaps you can spot what I am doing wrong.

Thanks!

JohnClint

johnclint · April 25, 2022, 9:13pm

My FreedboxBox is behind a router. In my router admin control panel, I have forwarded ports 80 and 443 to my FreedomBox IP address.

image966×279 23.9 KB

johnclint · April 25, 2022, 9:14pm

In FreedoxBox > System > Configure, I have made the domain name known.

image986×669 68.3 KB

johnclint · April 25, 2022, 9:15pm

This is what I see in FreedoxBox > System > Name Services:

image922×600 36.8 KB

johnclint · April 25, 2022, 9:15pm

In FreedomBox > System > Let’s Encrypt, when I click Obtain, this is what I see:

image971×727 70.8 KB

nbenedek · April 25, 2022, 10:01pm

In the DNS Records, you should point your IP to your domain without www.

Can you post a screenshot of your settings at domains.google.com ?

johnclint · April 25, 2022, 10:28pm

Sure. Here it is.

nbenedek · April 25, 2022, 10:50pm

Can you reboot your box and then obtain a certificate again?

johnclint · April 27, 2022, 9:21pm

Hey, Benedek!

I rebooted by FreedomBox and tried Let’s Encrypt again. I’m still getting this error message.

Failed to obtain certificate for domain johnclint.net: Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator webroot, Installer None An unexpected error occurred: requests.exceptions.ConnectionError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0xb39924a8>: Failed to establish a new connection: [Errno -2] Name or service not known')) Please see the logfiles in /var/log/letsencrypt for more details.

ullli · April 28, 2022, 7:31am

I would recommend to delete your “internal” IP-adress “192.168.1.2” from the A-Record in Google Domains-DNS-Custom Records-www-entry

I checked the connection to your domains yesterday with no luck. Now it works. Maybe try let’s-encrypt again.

Cheers Uli

johnclint · April 28, 2022, 8:47pm

Hey, Uli!

As you suggested, I removed the internal IP address from the A record. I waited an hour. I rebooted my Freedbox box. I tried Let’s Encrypt again. Same old error message.

BTW, my FreedomBox frequently becomes unreachable. I have to reboot it before I can access it again.

Also BTW, I get error messages when I try to install ejabberd, Matrix Synapse, and Postfix/Dovecot on my FreedomBox. I haven’t tried all the apps, but ikiwiki is the only app I’ve installed successfully.

ullli · May 3, 2022, 5:28am

Hi, I would suggest to start over.

If you have a fresh sd-card use this to install the freedombox-image ans try again.

Or try the FBX-GnuDIP-DNS-Service or the DNS-service https://www.nsupdate.info/ first to eliminate problems with the google-dns-domain.

What ISP you are using? Check, if http and https are reachable from the internet:

So many options - sorry

jvalleroy · May 6, 2022, 11:47am

I am able to reproduce this issue on a new Linode VPS running Debian 11 with FreedomBox 22.10.

I was also able to solve the issue with the following steps:

I changed my hostname from “localhost” to another name.
I (again) set my domain name in Configuration.
I ran this command as root on the FreedomBox VPS:
systemctl start systemd-resolved
Then I went to the Let’s Encrypt page to obtain the certificate again.

Step 3 was the step that fixed the issue. I don’t know if steps 1 and 2 are really required, but it fixes the domain name not displayed correctly on Configuration page.

I got the idea to start systemd-resolved from this issue:

github.com/nextcloud-snap/nextcloud-snap

Trouble with enable-https, letsencrypt "Name or service not known"

opened 02:49PM - 17 Jan 17 UTC

closed 08:57PM - 21 Apr 17 UTC

lindhe

upstream

So I can't seem to create a certificate. I installed a server a month ago to try… it out, and then it worked perfectly. Now, it doesn't. I'm running nextcloud 11.0.0snap3 on Unbuntu Server 16.10. This is what I get: ``` ~> sudo nextcloud.enable-https -d In order for Let's Encrypt to verify that you actually own the domain for which you're requesting a certificate, there are a number of requirements of which you need to be aware: 1. In order to register with the Let's Encrypt ACME server, you must agree to the currently-in-effect Subscriber Agreement located here: https://letsencrypt.org/repository/ By continuing to use this tool you agree to these terms. Please cancel now if otherwise. 2. You must have the domain name(s) for which you want certificates pointing at the external IP address of this machine. 3. Both ports 80 and 443 on the external IP address of this machine must point to this machine (e.g. port forwarding might need to be setup on your router). Have you met these requirements? (y/n) y Please enter an email address (for urgent notices or key recovery): me@example.com Please enter your domain name(s) (space-separated): example.com Attempting to obtain certificates... error running certbot: Saving debug log to /var/snap/nextcloud/current/certs/certbot/logs/letsencrypt.log An unexpected error occurred: ConnectionError: HTTPSConnectionPool(host='acme-staging.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<requests.packages.urllib3.connection.VerifiedHTTPSConnection object at 0x7f81b8bd6910>: Failed to establish a new connection: [Errno -2] Name or service not known',)) Please see the logfiles in /var/snap/nextcloud/current/certs/certbot/logs for more details. ``` (i obviously didn't use example.com when I ran it) This is what the log says: ``` 2017-01-17 14:39:50,777:DEBUG:certbot.main:Root logging level set at 20 2017-01-17 14:39:50,780:INFO:certbot.main:Saving debug log to /var/snap/nextcloud/current/certs/certbot/logs/letsencrypt.log 2017-01-17 14:39:50,781:DEBUG:certbot.main:certbot version: 0.9.3 2017-01-17 14:39:50,781:DEBUG:certbot.main:Arguments: ['--text', '--config-dir', '/var/snap/nextcloud/current/certs/certbot/config', '--work-dir', '/var/snap/nextcloud/current/certs/certbot/work', '--logs-dir', '/var/snap/nextcloud/current/certs/certbot/logs', '--dry-run', '--authenticator', 'nextcloud:webroot', '--nextcloud:webroot-path', '/var/snap/nextcloud/current/certs/certbot', '--rsa-key-size', '4096', '--email', 'me@example.com', '--non-interactive', '--agree-tos', '--force-renewal', '-d', 'example.com'] 2017-01-17 14:39:50,783:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#webroot,PluginEntryPoint#null,PluginEntryPoint#manual,PluginEntryPoint#standalone,PluginEntryPoint#nextcloud:webroot) 2017-01-17 14:39:50,784:DEBUG:certbot.plugins.selection:Requested authenticator nextcloud:webroot and installer None 2017-01-17 14:39:50,795:DEBUG:certbot.plugins.selection:Single candidate plugin: * nextcloud:webroot Description: Place files in webroot directory without running chown Interfaces: IAuthenticator, IPlugin Entry point: webroot = certbot_nextcloud_plugin.webroot:Authenticator Initialized: <certbot_nextcloud_plugin.webroot.Authenticator object at 0x7f81b8bdda90> Prep: True 2017-01-17 14:39:50,797:DEBUG:certbot.plugins.selection:Selected authenticator <certbot_nextcloud_plugin.webroot.Authenticator object at 0x7f81b8bdda90> and installer None 2017-01-17 14:39:54,419:DEBUG:root:Sending GET request to https://acme-staging.api.letsencrypt.org/directory. args: (), kwargs: {} 2017-01-17 14:39:54,580:DEBUG:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org 2017-01-17 14:39:54,585:DEBUG:certbot.main:Exiting abnormally: Traceback (most recent call last): File "/snap/nextcloud/559/bin/certbot", line 11, in <module> sys.exit(main()) File "/snap/nextcloud/559/lib/python2.7/site-packages/certbot/main.py", line 776, in main return config.func(config, plugins) File "/snap/nextcloud/559/lib/python2.7/site-packages/certbot/main.py", line 558, in obtain_cert le_client = _init_le_client(config, auth, installer) File "/snap/nextcloud/559/lib/python2.7/site-packages/certbot/main.py", line 368, in _init_le_client acc, acme = _determine_account(config) File "/snap/nextcloud/559/lib/python2.7/site-packages/certbot/main.py", line 353, in _determine_account config, account_storage, tos_cb=_tos_cb) File "/snap/nextcloud/559/lib/python2.7/site-packages/certbot/client.py", line 118, in register acme = acme_from_config_key(config, key) File "/snap/nextcloud/559/lib/python2.7/site-packages/certbot/client.py", line 42, in acme_from_config_key return acme_client.Client(config.server, key=key, net=net) File "/snap/nextcloud/559/lib/python2.7/site-packages/acme/client.py", line 63, in __init__ self.net.get(directory).json()) File "/snap/nextcloud/559/lib/python2.7/site-packages/acme/client.py", line 624, in get self._send_request('GET', url, **kwargs), content_type=content_type) File "/snap/nextcloud/559/lib/python2.7/site-packages/acme/client.py", line 606, in _send_request response = self.session.request(method, url, *args, **kwargs) File "/snap/nextcloud/559/lib/python2.7/site-packages/requests/sessions.py", line 488, in request resp = self.send(prep, **send_kwargs) File "/snap/nextcloud/559/lib/python2.7/site-packages/requests/sessions.py", line 609, in send r = adapter.send(request, **kwargs) File "/snap/nextcloud/559/lib/python2.7/site-packages/requests/adapters.py", line 487, in send raise ConnectionError(e, request=request) ConnectionError: HTTPSConnectionPool(host='acme-staging.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<requests.packages.urllib3.connection.VerifiedHTTPSConnection object at 0x7f81b8bd6910>: Failed to establish a new connection: [Errno -2] Name or service not known',)) ``` I couldn't find an issue on it, but feel free to yell at me if I'm a dummy and missed it.

But it is not exactly the same, since we are not running in a snap.