I tried to install certificates for three domains on Apache running under Linux 2 at Amazon AWS. One of the domains failed. Got this message:
Performing the following challenges: http-01 challenge for mydomain1.com http-01 challenge for mydomain2.com http-01 challenge for mydomain3.com http-01 challenge for www.mydomain1.com http-01 challenge for www.mydomain2.com http-01 challenge for www.mydomain3.com Waiting for verification... Challenge failed for domain mydomain3.com Challenge failed for domain www.mydomain3.com http-01 challenge for mydomain3.com http-01 challenge for www.mydomain3.com Cleaning up challenges Some challenges have failed. IMPORTANT NOTES: - The following errors were reported by the server: Domain: mydomain3.com Type: unauthorized Detail: Invalid response from https://mydomain3.com/.well-known/acme-challenge/8W5lCczmyaR5ZLVfQ1Am_48QhMt9y1EXZNxmjQ9y0aY [2600:9000:20e9:6600:14:9b04:8440:93a1]: "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n<HTML><HEAD><META HTTP-EQ" Domain: www.mydomain3.com Type: unauthorized Detail: Invalid response from https://www.mydomain3.com/.well-known/acme-challenge/OnWRlKfCFqWDAEtf-N1j00wqZwLtT3rPDBrcWapwVdQ [2600:9000:20e9:6600:14:9b04:8440:93a1]: "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n<HTML><HEAD><META HTTP-EQ" To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address. - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal.
For mydomain3.com, the A and AAAA records are actually aliased to Cloudfront, so they don't contain an IP address.
So, one question I have is: If I want to use Cloudfront, should I put the server IP address in the A and AAAA records, create the certificate, and then alias the A and AAAA records to Cloudfront again? Or how do I deal with the fact that certbot doesn't want to create a certificate for mydomain3.com?
In addition, I decided to see if I could successfully create a virtual host in httpd.conf for mydomain2.com that uses SSL. Something like this:
<VirtualHost *:443> ServerName "mydomain2.com" ServerAlias "www.mydomain2.com" DocumentRoot "/var/www/html/mydomain2" SSLEngine on SSLCertificateFile "/etc/letsencrypt/live/server.crt" SSLCertificateKeyFile "/etc/letsencrypt/live/server.key" </VirtualHost>
The location in the last two lines (
/etc/letsencrypt/live/) is based on this:
Let's encrypt + certbot: where is the private key
However, looking on the server, I don't see
Under /etc/letsencrypt/, I see five directories: accounts, csr, keys, renewal, renewal-hooks
There are also two files:
Executing this command:
sudo ls /etc/letsencrypt/keys/
How can I implement SSL for mydomain2.com and mydomain3.com? Thank you!