0

I tried to install certificates for three domains on Apache running under Linux 2 at Amazon AWS. One of the domains failed. Got this message:

Performing the following challenges:
http-01 challenge for mydomain1.com
http-01 challenge for mydomain2.com
http-01 challenge for mydomain3.com
http-01 challenge for www.mydomain1.com
http-01 challenge for www.mydomain2.com
http-01 challenge for www.mydomain3.com
Waiting for verification...
Challenge failed for domain mydomain3.com
Challenge failed for domain www.mydomain3.com
http-01 challenge for mydomain3.com
http-01 challenge for www.mydomain3.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: mydomain3.com
   Type:   unauthorized
   Detail: Invalid response from
   https://mydomain3.com/.well-known/acme-challenge/8W5lCczmyaR5ZLVfQ1Am_48QhMt9y1EXZNxmjQ9y0aY
   [2600:9000:20e9:6600:14:9b04:8440:93a1]: "<!DOCTYPE HTML PUBLIC
   \"-//W3C//DTD HTML 4.01 Transitional//EN\"
   \"http://www.w3.org/TR/html4/loose.dtd\">\n<HTML><HEAD><META
   HTTP-EQ"

   Domain: www.mydomain3.com
   Type:   unauthorized
   Detail: Invalid response from
   https://www.mydomain3.com/.well-known/acme-challenge/OnWRlKfCFqWDAEtf-N1j00wqZwLtT3rPDBrcWapwVdQ
   [2600:9000:20e9:6600:14:9b04:8440:93a1]: "<!DOCTYPE HTML PUBLIC
   \"-//W3C//DTD HTML 4.01 Transitional//EN\"
   \"http://www.w3.org/TR/html4/loose.dtd\">\n<HTML><HEAD><META
   HTTP-EQ"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.

For mydomain3.com, the A and AAAA records are actually aliased to Cloudfront, so they don't contain an IP address.

So, one question I have is: If I want to use Cloudfront, should I put the server IP address in the A and AAAA records, create the certificate, and then alias the A and AAAA records to Cloudfront again? Or how do I deal with the fact that certbot doesn't want to create a certificate for mydomain3.com?

In addition, I decided to see if I could successfully create a virtual host in httpd.conf for mydomain2.com that uses SSL. Something like this:

<VirtualHost *:443>
    ServerName "mydomain2.com"
    ServerAlias "www.mydomain2.com"
    DocumentRoot "/var/www/html/mydomain2"
    SSLEngine on
    SSLCertificateFile "/etc/letsencrypt/live/server.crt"
    SSLCertificateKeyFile "/etc/letsencrypt/live/server.key"
</VirtualHost>

The location in the last two lines (/etc/letsencrypt/live/) is based on this: Let's encrypt + certbot: where is the private key

However, looking on the server, I don't see /etc/letsencrypt/live/

Under /etc/letsencrypt/, I see five directories: accounts, csr, keys, renewal, renewal-hooks

There are also two files: .updated-options-ssl-apache-conf-digest.txt and options-ssl-apache.conf

Executing this command: sudo ls /etc/letsencrypt/keys/ shows 0000_key-certbot.pem

How can I implement SSL for mydomain2.com and mydomain3.com? Thank you!

Improve this question
2
  • Does Cloudfront serve its own content from S3, or does it proxy all requests through to your server?
    – u1686_grawity
    Oct 9, 2019 at 5:13
  • At this point, S3 is not involved at all. All the files are on the Apache server, running on an Amazon EC2 instance. Cloudfront caches content in edge servers; I don't believe it's hitting the server for every request. Note that Cloudfront is only involved for mydomain3.com. The other one, mydomain2.com, is not currently using Cloudfront.
    – user1147171
    Oct 9, 2019 at 19:41

1 Answer 1

Reset to default
0

On /etc/letsencrypt/live/you should have the certs you issued with certbot. If that folder it's not on your system means you didn't issued any cert yet.

With cloudfront you will have the problem you said about you need to have full control of the domain on your apache/nginx installation and not use any CDN/cache outside your system. As you said you can change temporary the A/CNAME dns entry on your dns server to point directly to your server, but remember there are caches on the DNS system, so you should wait the number of seconds the TTL of the dns entry expires to allow the Let's Encrypt servers to contact with your real server after you changed the dns entry.

If you don't want to change each 3 months the dns entry you can change to DNS validation which will only need you add a new entry on the dns server to validate you're the owner of the domain. Check this ServerFault question: https://serverfault.com/questions/750902/how-to-use-lets-encrypt-dns-challenge-validation

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .