Internal auth handler error

I am trying to request a TLS certificate using Certbot (source: https://certbot.eff.org/instructions) with sudo certbot --nginx. It is supposed to be for a docker registry used as a pull through cache (https://docs.docker.com/registry/recipes/mirror/).

This is the log output, searched for the keyword «error» (cat /var/log/letsencrypt/letsencrypt.log | grep -I error --context=12 -in):

199-    ##
200-    # SSL Settings
201-    ##
202-
203-    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
204-    ssl_prefer_server_ciphers on;
205-
206-    ##
207-    # Logging Settings
208-    ##
209-
210-    access_log /var/log/nginx/access.log;
211:    error_log /var/log/nginx/error.log;
212-
213-    ##
214-    # Gzip Settings
215-    ##
216-
217-    gzip on;
218-
219-    # gzip_vary on;
220-    # gzip_proxied any;
221-    # gzip_comp_level 6;
222-    # gzip_buffers 16 8k;
223-    # gzip_http_version 1.1;
--
615-
616-{
617-  "identifier": {
618-    "type": "dns",
619-    "value": "my.subdomain.com"
620-  },
621-  "status": "invalid",
622-  "expires": "2022-10-28T08:43:11Z",
623-  "challenges": [
624-    {
625-      "type": "http-01",
626-      "status": "invalid",
627:      "error": {
628:        "type": "urn:ietf:params:acme:error:connection",
629-        "detail": "ser.ver.ip.add: Fetching http://my.subdomain.com/.well-known/acme-challenge/hHUWDkKoQhke4YWRQJ7P9UoXCb8DV12gZq8Yjdw3YNo: Timeout during connect (likely firewall problem)",
630-        "status": 400
631-      },
632-      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/167006252436/sNVb5g",
633-      "token": "hHUWDkKoQhke4YWRQJ7P9UoXCb8DV12gZq8Yjdw3YNo",
634-      "validationRecord": [
635-        {
636-          "url": "http://my.subdomain.com/.well-known/acme-challenge/hHUWDkKoQhke4YWRQJ7P9UoXCb8DV12gZq8Yjdw3YNo",
637-          "hostname": "my.subdomain.com",
638-          "port": "80",
639-          "addressesResolved": [
640-            "ser.ver.ip.add"
--
648-}
649-2022-10-21 08:43:23,431:DEBUG:acme.client:Storing nonce: 327C_YtRNQL-hZbLzBTyyGyExuukFDBjXHKXyNmZl0m8R70
650-2022-10-21 08:43:23,431:INFO:certbot._internal.auth_handler:Challenge failed for domain my.subdomain.com
651-2022-10-21 08:43:23,431:INFO:certbot._internal.auth_handler:http-01 challenge for my.subdomain.com
652-2022-10-21 08:43:23,431:DEBUG:certbot._internal.display.obj:Notifying user: 
653-Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
654-  Domain: my.subdomain.com
655-  Type:   connection
656-  Detail: ser.ver.ip.add: Fetching http://my.subdomain.com/.well-known/acme-challenge/hHUWDkKoQhke4YWRQJ7P9UoXCb8DV12gZq8Yjdw3YNo: Timeout during connect (likely firewall problem)
657-
658-Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
659-
660:2022-10-21 08:43:23,432:DEBUG:certbot._internal.error_handler:Encountered exception:
661-Traceback (most recent call last):
662-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 106, in handle_authorizations
663-    self._poll_authorizations(authzrs, max_retries, best_effort)
664-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 206, in _poll_authorizations
665:    raise errors.AuthorizationError('Some challenges have failed.')
666:certbot.errors.AuthorizationError: Some challenges have failed.
667-
668:2022-10-21 08:43:23,432:DEBUG:certbot._internal.error_handler:Calling registered functions
669-2022-10-21 08:43:23,432:INFO:certbot._internal.auth_handler:Cleaning up challenges
670-2022-10-21 08:43:24,507:DEBUG:certbot._internal.log:Exiting abnormally:
671-Traceback (most recent call last):
672-  File "/snap/certbot/2414/bin/certbot", line 8, in <module>
673-    sys.exit(main())
674-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/main.py", line 19, in main
675-    return internal_main.main(cli_args)
676-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/main.py", line 1744, in main
677-    return config.func(config, plugins)
678-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/main.py", line 1441, in run
679-    new_lineage = _get_and_save_cert(le_client, config, domains,
680-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/main.py", line 141, in _get_and_save_cert
681-    lineage = le_client.obtain_and_enroll_certificate(domains, certname)
682-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/client.py", line 530, in obtain_and_enroll_certificate
683-    cert, chain, key, _ = self.obtain_certificate(domains)
684-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/client.py", line 442, in obtain_certificate
685-    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
686-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/client.py", line 510, in _get_order_and_authorizations
687-    authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
688-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 106, in handle_authorizations
689-    self._poll_authorizations(authzrs, max_retries, best_effort)
690-  File "/snap/certbot/2414/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 206, in _poll_authorizations
691:    raise errors.AuthorizationError('Some challenges have failed.')
692:certbot.errors.AuthorizationError: Some challenges have failed.
693:2022-10-21 08:43:24,508:ERROR:certbot._internal.log:Some challenges have failed.

It says likely firewall problem in line 629, but the output of sudo ufw status is

Status: active

To                         Action      From
--                         ------      ----
80/tcp                     ALLOW       Anywhere                  
443/tcp                    ALLOW       Anywhere                  
443                        ALLOW       Anywhere                  
80                         ALLOW       Anywhere                  
22                         ALLOW       ser.ver.ip.add            
80/tcp (v6)                ALLOW       Anywhere (v6)             
443/tcp (v6)               ALLOW       Anywhere (v6)             
443 (v6)                   ALLOW       Anywhere (v6)             
80 (v6)                    ALLOW       Anywhere (v6)            

Lines 662 to 666 and 686 to 692 hint to some authorization issues, though I do not know whether these are related to some authentication I am supposed to provide, or some issue on the side of the certificate server.

This is the output of netstat -tulnp:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      80509/nginx: master 
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      724/systemd-resolve 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      797/sshd: /usr/sbin 
tcp6       0      0 :::80                   :::*                    LISTEN      80509/nginx: master 
tcp6       0      0 :::22                   :::*                    LISTEN      797/sshd: /usr/sbin 
udp        0      0 127.0.0.53:53           0.0.0.0:*                           724/systemd-resolve 
udp        0      0 ser.ver.ip.add:68       0.0.0.0:*                           722/systemd-network 

Do I possibly have to run the docker image registry:2 first?
Is there some nginx authentication that has to be done first?
Do I have to run certbot from within the docker container?

Hi

I have setup Nginx proxy manager on docker which is running on ubuntu 20.04 server. The ubuntu server is a vm running on my esxi host.

When i try to create a lets encrypt cert for one of my proxy hosts it throws an «internal error» message.

My setup:

• Domain purchased from godaddy eg — mydomain.co.uk

• Go daddy name servers pointing to Cloudflare

• A record pointing to my external ip which is updated using the cloudflare DDNS container

• Cloudflare SSL set to Full(Strict) — created an origin cert and added this to NPM as a custom cert

• ports 80 and 443 forwarded to the ubuntu vm which runs docker

1 NUC 9 running ESXi 7.02

• 1 ubuntu vm

  • Plex

  • Docker

    • Sabnzbd

    • sonarr

    • radarr

    • cloudflareDDNS

    • Nginx proxy manager

• Windows Server 2019 Domain controller

I get the following errors in the logs on the NPM (nginx proxy manager) container

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -,
[7/5/2021] [9:15:59 AM] [Nginx    ] › ℹ  info      Reloading Nginx,
[7/5/2021] [9:19:53 AM] [Nginx    ] › ℹ  info      Reloading Nginx,
[7/5/2021] [9:21:41 AM] [Nginx    ] › ℹ  info      Reloading Nginx,
[7/5/2021] [9:21:41 AM] [SSL      ] › ℹ  info      Requesting Let'sEncrypt certificates for Cert #17: portainer.mydomain.co.uk,
[7/5/2021] [9:21:44 AM] [Nginx    ] › ℹ  info      Reloading Nginx,
[7/5/2021] [9:21:44 AM] [Express  ] › ⚠  warning   Command failed: certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-17" --agree-tos --email "myemailaddress.co.uk" --preferred-challenges "dns,http" --domains "portainer.mydomain.co.uk" ,
Saving debug log to /var/log/letsencrypt/letsencrypt.log,
Some challenges have failed.,
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.,

When i go into the /var/log/letsencrypt/letsencrypt.log on the NPM container i see these logs.

2021-07-05 09:21:42,287:DEBUG:certbot._internal.main:certbot version: 1.16.0
2021-07-05 09:21:42,287:DEBUG:certbot._internal.main:Location of certbot entry point: /opt/certbot/bin/certbot
2021-07-05 09:21:42,287:DEBUG:certbot._internal.main:Arguments: ['--non-interactive', '--config', '/etc/letsencrypt.ini', '--cert-name', 'npm-17', '--agree-tos', '--email', 'myemail.co.uk', '--preferred-challenges', 'dns,http', '--domains', 'portainer.mydomanin.co.uk']
2021-07-05 09:21:42,287:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2021-07-05 09:21:42,297:DEBUG:certbot._internal.log:Root logging level set at 30
2021-07-05 09:21:42,297:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2021-07-05 09:21:42,299:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot._internal.plugins.webroot:Authenticator
Initialized: <certbot._internal.plugins.webroot.Authenticator object at 0x7f3b3eebb3c8> Prep: True 2021-07-05 09:21:42,299:DEBUG:certbot._internal.plugins.selection:Selected authenticator
<certbot._internal.plugins.webroot.Authenticator object at 0x7f3b3eebb3c8> and installer None 2021-07-05 09:21:42,299:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator webroot, Installer None 2021-07-05 09:21:42,308:DEBUG:certbot._internal.main:Picked account:
<Account(RegistrationResource(body=Registration(key=None, contact=(), agreement=None, status=None, terms_of_service_agreed=None, only_return_existing=None, external_account_binding=None), uri='https://acme-v02.api.letsencrypt.org/acme/acct/129228927' , new_authzr_uri=None, terms_of_service=None), 13997c237baa938606b3bd8115a8a164, Meta(creation_dt=datetime.datetime(2021, 7, 3, 21, 58, 2, tzinfo=
<UTC>), creation_host='aba0e9a553e2', register_to_eff=None))>
2021-07-05 09:21:42,309:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2021-07-05 09:21:42,310:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2021-07-05 09:21:42,884:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 658
2021-07-05 09:21:42,884:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Mon, 05 Jul 2021 09:21:42 GMT
Content-Type: application/json
Content-Length: 658
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
  "lnUGLQZsPUU": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "meta": {
    "caaIdentities": [
      "letsencrypt.org"
    ],
    "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",
    "website": "https://letsencrypt.org"
  },
  "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
  "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
  "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
  "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
}
2021-07-05 09:21:42,885:DEBUG:certbot.display.util:Notifying user: Requesting a certificate for portainer.mydomain.co.uk
2021-07-05 09:21:43,037:DEBUG:certbot.crypto_util:Generating RSA key (2048 bits): /etc/letsencrypt/keys/0012_key-certbot.pem
2021-07-05 09:21:43,039:DEBUG:certbot.crypto_util:Creating CSR: /etc/letsencrypt/csr/0012_csr-certbot.pem
2021-07-05 09:21:43,039:DEBUG:acme.client:Requesting fresh nonce
2021-07-05 09:21:43,039:DEBUG:acme.client:Sending HEAD request to https://acme-v02.api.letsencrypt.org/acme/new-nonce.
2021-07-05 09:21:43,176:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "HEAD /acme/new-nonce HTTP/1.1" 200 0
2021-07-05 09:21:43,177:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Mon, 05 Jul 2021 09:21:43 GMT
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https: acme-v02.api.letsencrypt.orgdirectory>;rel="index" Replay-Nonce: 0002NfR_sdBNBEy2G2mxHgyaI5i6EjqYa-f1fjqiCaImZuU X-Frame-Options: DENY Strict-Transport-Security: max-age=604800 2021-07-05 09:21:43,177:DEBUG:acme.client:Storing nonce: 0002NfR_sdBNBEy2G2mxHgyaI5i6EjqYa-f1fjqiCaImZuU 2021-07-05 09:21:43,177:DEBUG:acme.client:JWS payload: b'{n"identifiers" : [n {n"type" :"dns" ,n"value" :"portainer.mydomain.co.uk" n }n ]n}' 2021-07-05 09:21:43,178:DEBUG:acme.client:Sending POST request to https: acme-v02.api.letsencrypt.org acme new-order: {"protected" :"eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMTI5MjI4OTI3IiwgIm5vbmNlIjogIjAwMDJOZlJfc2RCTkJFeTJHMm14SGd5YUk1aTZFanFZYS1mMWZqcWlDYUltWnVVIiwgInVybCI6ICJodHRwczovL2FjbWUtdjAyLmFwaS5sZXRzZW5jcnlwdC5vcmcvYWNtZS9uZXctb3JkZXIifQ" ,"signature" :"JXtuleY2sqKgwLQYu1xelN-NpDFebmVP_m6OFMJ2Fhb73nyr9Nd0OgmFrKltB9kddZVOBoFhk1K8wc6eyaCB847uNAakCBgPOiB8QbKQDy98KBPl6JcgnA-t0kUB5uoA6X0de-EGZnYus8qq0TgW6Shb-cNxuWykDbLeEgJFwAVURxCdZNVyJ56ZQit1pLFhj4RebvtfHYhQt3S0qXc5XIk_HohjX9mrsLeVk9Xstk8vbwPV5LvUPtz_Q_DONh8oJgRjq4ZvpdU-NU_Q7sWHG-wNwwdJ2EUDFc5eZrGF1m0WcuLzCaVKkET9BH_IRVlgHEKsw0W2p07efGF_U7IMTQ" ,"payload" :"ewogICJpZGVudGlmaWVycyI6IFsKICAgIHsKICAgICAgInR5cGUiOiAiZG5zIiwKICAgICAgInZhbHVlIjogInBvcnRhaW5lci5zYWpqYW5zb2x1dGlvbnMuY28udWsiCiAgICB9CiAgXQp9" } 2021-07-05 09:21:43,351:DEBUG:urllib3.connectionpool:https: acme-v02.api.letsencrypt.org:443"POST /acme/new-order HTTP/1.1" 201 354 2021-07-05 09:21:43,351:DEBUG:acme.client:Received response: HTTP 201 Server: nginx Date: Mon, 05 Jul 2021 09:21:43 GMT Content-Type: application json Content-Length: 354 Connection: keep-alive Boulder-Requester: 129228927 Cache-Control: public, max-age=0, no-cache Link:
	<https: acme-v02.api.letsencrypt.org directory>;rel="index" Location: https: acme-v02.api.letsencrypt.org acme order 129228927 10861843866 Replay-Nonce: 0001L0f0o8zb0-DL7eHOnEY7bdgRWM1IfycZtlsoEmZg1aQ X-Frame-Options: DENY Strict-Transport-Security: max-age=604800 {"status" :"pending" ,"expires" :"2021-07-12T09:21:43Z" ,"identifiers" : [ {"type" :"dns" ,"value" :"portainer.mydomain.co.uk" } ],"authorizations" : ["https://acme-v02.api.letsencrypt.org/acme/authz-v3/14553634828" ],"finalize" :"https://acme-v02.api.letsencrypt.org/acme/finalize/129228927/10861843866" } 2021-07-05 09:21:43,351:DEBUG:acme.client:Storing nonce: 0001L0f0o8zb0-DL7eHOnEY7bdgRWM1IfycZtlsoEmZg1aQ 2021-07-05 09:21:43,351:DEBUG:acme.client:JWS payload: b'' 2021-07-05 09:21:43,352:DEBUG:acme.client:Sending POST request to https: acme-v02.api.letsencrypt.org acme authz-v3 14553634828: {"protected" :"eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMTI5MjI4OTI3IiwgIm5vbmNlIjogIjAwMDFMMGYwbzh6YjAtREw3ZUhPbkVZN2JkZ1JXTTFJZnljWnRsc29FbVpnMWFRIiwgInVybCI6ICJodHRwczovL2FjbWUtdjAyLmFwaS5sZXRzZW5jcnlwdC5vcmcvYWNtZS9hdXRoei12My8xNDU1MzYzNDgyOCJ9" ,"signature" :"vx3V0T0-h9-XQ6ha76NVLZSA6Hl3ZKdZRjXIEo6tsura6J3SbibwPHeSKBZxXpYBdvotC-NIuCpMBwfDatz3PatyQ4xhpa7smnayRiT81CIxtk3STXR7RHz63c4P6m0EVyipgCw_Aw-tU7o4o6KPJoAeybnHjvsxCgUATkZooKCbLmI-xkz8gR4c23txhMCdGrBa01d9P4uXTSk2HKJ510JeW9SXZH2FNjMU3RIjtyRr6Cigv5gyiA3WS1O02gJfb6OloG49jLVChzXFaou8_Ja65ttjTH7N3TYV_EMFSTx4f9O3sX4rgfsIzN0yjwIKNsDtGqkxmN4MbhnxtVrErA" ,"payload" :"" } 2021-07-05 09:21:43,493:DEBUG:urllib3.connectionpool:https: acme-v02.api.letsencrypt.org:443"POST /acme/authz-v3/14553634828 HTTP/1.1" 200 812 2021-07-05 09:21:43,493:DEBUG:acme.client:Received response: HTTP 200 Server: nginx Date: Mon, 05 Jul 2021 09:21:43 GMT Content-Type: application json Content-Length: 812 Connection: keep-alive Boulder-Requester: 129228927 Cache-Control: public, max-age=0, no-cache Link:
	<https: acme-v02.api.letsencrypt.org directory>;rel="index" Replay-Nonce: 0002tHSrzFwv0NzdsxEEJw46yk7Nb_M03ccLv8MLdeHaB5U X-Frame-Options: DENY Strict-Transport-Security: max-age=604800 {"identifier" : {"type" :"dns" ,"value" :"portainer.mydomain.co.uk" },"status" :"pending" ,"expires" :"2021-07-12T09:21:43Z" ,"challenges" : [ {"type" :"http-01" ,"status" :"pending" ,"url" :"https://acme-v02.api.letsencrypt.org/acme/chall-v3/14553634828/q5agHA" ,"token" :"xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg" }, {"type" :"dns-01" ,"status" :"pending" ,"url" :"https://acme-v02.api.letsencrypt.org/acme/chall-v3/14553634828/TDLZiA" ,"token" :"xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg" }, {"type" :"tls-alpn-01" ,"status" :"pending" ,"url" :"https://acme-v02.api.letsencrypt.org/acme/chall-v3/14553634828/u7xg3Q" ,"token" :"xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg" } ] } 2021-07-05 09:21:43,494:DEBUG:acme.client:Storing nonce: 0002tHSrzFwv0NzdsxEEJw46yk7Nb_M03ccLv8MLdeHaB5U 2021-07-05 09:21:43,494:INFO:certbot._internal.auth_handler:Performing the following challenges: 2021-07-05 09:21:43,494:INFO:certbot._internal.auth_handler:http-01 challenge for portainer.mydomain.co.uk 2021-07-05 09:21:43,494:INFO:certbot._internal.plugins.webroot:Using the webroot path data letsencrypt-acme-challenge for all unmatched domains. 2021-07-05 09:21:43,494:DEBUG:certbot._internal.plugins.webroot:Creating root challenges validation dir at data letsencrypt-acme-challenge .well-known acme-challenge 2021-07-05 09:21:43,495:DEBUG:certbot._internal.plugins.webroot:Attempting to save validation to data letsencrypt-acme-challenge .well-known acme-challenge xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg 2021-07-05 09:21:43,496:DEBUG:acme.client:JWS payload: b'{}' 2021-07-05 09:21:43,497:DEBUG:acme.client:Sending POST request to https: acme-v02.api.letsencrypt.org acme chall-v3 14553634828 q5agHA: {"protected" :"eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMTI5MjI4OTI3IiwgIm5vbmNlIjogIjAwMDJ0SFNyekZ3djBOemRzeEVFSnc0NnlrN05iX00wM2NjTHY4TUxkZUhhQjVVIiwgInVybCI6ICJodHRwczovL2FjbWUtdjAyLmFwaS5sZXRzZW5jcnlwdC5vcmcvYWNtZS9jaGFsbC12My8xNDU1MzYzNDgyOC9xNWFnSEEifQ" ,"signature" :"uma6GPuPJirPOUDpaMZrR7PAgTLHhpWXoMbqCerrSXOv022dDNaUTa5bzTCSMX3Rfu-18WrIBtWAHFW7N4qxZSMfXmJbfk-EgVdZF3w42dQeo1yAJgNED09WfdeLGZd4cYUqhRYSZn9au9lQ_g_URnrWN9QKuhdRFleNJHR2dG6ViXsIdE_GGdDiOH90vaYWTJkEqblxgYoCfbSee5Wv2nVRh7ALnUBLCEBo6iPaYAtBSce0Q_yzb2SpvgTKRjxrewvY7ZJqTY87Wp0S9dbRDe09MIFmna58zr3R7iwRjBmcwC6WMZVkAdgr0aU15fn-Woocom_IF7evmfWxnWM5oA" ,"payload" :"e30" } 2021-07-05 09:21:43,641:DEBUG:urllib3.connectionpool:https: acme-v02.api.letsencrypt.org:443"POST /acme/chall-v3/14553634828/q5agHA HTTP/1.1" 200 186 2021-07-05 09:21:43,641:DEBUG:acme.client:Received response: HTTP 200 Server: nginx Date: Mon, 05 Jul 2021 09:21:43 GMT Content-Type: application json Content-Length: 186 Connection: keep-alive Boulder-Requester: 129228927 Cache-Control: public, max-age=0, no-cache Link:
	<https: acme-v02.api.letsencrypt.org directory>;rel="index" ,
	<https: acme-v02.api.letsencrypt.org acme authz-v3 14553634828>;rel="up" Location: https: acme-v02.api.letsencrypt.org acme chall-v3 14553634828 q5agHA Replay-Nonce: 0002uo0Af5TJgPg0e6yj-nYpzFgQBf4ZWbNBwf6h9Oh24JI X-Frame-Options: DENY Strict-Transport-Security: max-age=604800 {"type" :"http-01" ,"status" :"pending" ,"url" :"https://acme-v02.api.letsencrypt.org/acme/chall-v3/14553634828/q5agHA" ,"token" :"xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg" } 2021-07-05 09:21:43,641:DEBUG:acme.client:Storing nonce: 0002uo0Af5TJgPg0e6yj-nYpzFgQBf4ZWbNBwf6h9Oh24JI 2021-07-05 09:21:43,641:INFO:certbot._internal.auth_handler:Waiting for verification... 2021-07-05 09:21:44,643:DEBUG:acme.client:JWS payload: b'' 2021-07-05 09:21:44,644:DEBUG:acme.client:Sending POST request to https: acme-v02.api.letsencrypt.org acme authz-v3 14553634828: {"protected" :"eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMTI5MjI4OTI3IiwgIm5vbmNlIjogIjAwMDJ1bzBBZjVUSmdQZzBlNnlqLW5ZcHpGZ1FCZjRaV2JOQndmNmg5T2gyNEpJIiwgInVybCI6ICJodHRwczovL2FjbWUtdjAyLmFwaS5sZXRzZW5jcnlwdC5vcmcvYWNtZS9hdXRoei12My8xNDU1MzYzNDgyOCJ9" ,"signature" :"gLAMuWWgCYapxUWlujiigZh0fZc6yzqIgtjnFK-0UXERkt-RZCjUWyVaz0D60lJ6YWj3-QM0gdrB7OjP_zUNAZV3Iv8gPCbX-F_0dvv3V_phT3t37WPKCMZ40FLSmDTnV5vUkFm_zvlADrvhD2iD0KhcFIsx00WTEXSul9Zpmyd98M8jOAlNtVvfzoHmiH93Myj8UyW4lKxB1GVWTLoZLvce5CKVgIHPTHyS7fNkAt7i0MtJZmoRHG_Ds7fTQ7yww6Gb9chkiKHlxMiaiLOQaIYf_Wmgf4oM8r5nRLUC8cxP_pdCkDudCAJz-xx3ZZ_1sMj_BnzNrleLXoU0AkqhfQ" ,"payload" :"" } 2021-07-05 09:21:44,787:DEBUG:urllib3.connectionpool:https: acme-v02.api.letsencrypt.org:443"POST /acme/authz-v3/14553634828 HTTP/1.1" 200 1903 2021-07-05 09:21:44,787:DEBUG:acme.client:Received response: HTTP 200 Server: nginx Date: Mon, 05 Jul 2021 09:21:44 GMT Content-Type: application json Content-Length: 1903 Connection: keep-alive Boulder-Requester: 129228927 Cache-Control: public, max-age=0, no-cache Link:
	<https: acme-v02.api.letsencrypt.org directory>;rel="index" Replay-Nonce: 00028AfZ9b3nRaCndCgotkEcjfssokheQm8HhX98j7wyHbM X-Frame-Options: DENY Strict-Transport-Security: max-age=604800 {"identifier" : {"type" :"dns" ,"value" :"portainer.mydomain.co.uk" },"status" :"invalid" ,"expires" :"2021-07-12T09:21:43Z" ,"challenges" : [ {"type" :"http-01" ,"status" :"invalid" ,"error" : {"type" :"urn:ietf:params:acme:error:unauthorized" ,"detail" :"Invalid response from https://portainer.mydomain.co.uk/.well-known/acme-challenge/xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg [2606:4700:3037::6815:3efc]: " u003c!DOCTYPE htmlu003e\nu003c!--[if lt IE 7]u003e u003chtml class=\"no-js ie6 oldie\" lang=\"en-US\" u003e u003c![endif]--u003e\nu003c!--[if IE 7]u003e u003chtml class=\"no-js " ","status" : 403 },"url" :"https://acme-v02.api.letsencrypt.org/acme/chall-v3/14553634828/q5agHA" ,"token" :"xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg" ,"validationRecord" : [ {"url" :"http://portainer.mydomain.co.uk/.well-known/acme-challenge/xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg" ,"hostname" :"portainer.mydomain.co.uk" ,"port" :"80" ,"addressesResolved" : ["172.67.141.61" ,"104.21.62.252" ,"2606:4700:3035::ac43:8d3d" ,"2606:4700:3037::6815:3efc" ],"addressUsed" :"2606:4700:3035::ac43:8d3d" }, {"url" :"https://portainer.mydomain.co.uk/.well-known/acme-challenge/xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg" ,"hostname" :"portainer.mydomain.co.uk" ,"port" :"443" ,"addressesResolved" : ["172.67.141.61" ,"104.21.62.252" ,"2606:4700:3037::6815:3efc" ,"2606:4700:3035::ac43:8d3d" ],"addressUsed" :"2606:4700:3037::6815:3efc" } ],"validated" :"2021-07-05T09:21:43Z" } ] } 2021-07-05 09:21:44,787:DEBUG:acme.client:Storing nonce: 00028AfZ9b3nRaCndCgotkEcjfssokheQm8HhX98j7wyHbM 2021-07-05 09:21:44,788:INFO:certbot._internal.auth_handler:Challenge failed for domain portainer.mydomain.co.uk 2021-07-05 09:21:44,788:INFO:certbot._internal.auth_handler:http-01 challenge for portainer.mydomain.co.uk 2021-07-05 09:21:44,788:DEBUG:certbot.display.util:Notifying user: Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems: Domain: portainer.mydomain.co.uk Type: unauthorized Detail: Invalid response from https: portainer.mydomain.co.uk .well-known acme-challenge xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg [2606:4700:3037::6815:3efc]:"<!DOCTYPE html>n<!--[if lt IE 7]> <html class=" no-js ie6 oldie" lang="en-US">
		<![endif]-->n<!--[if IE 7]>    <html class="no-js "

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

2021-07-05 09:21:44,789:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 93, in handle_authorizations
    self._poll_authorizations(authzrs, max_retries, best_effort)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 181, in _poll_authorizations
    raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.

2021-07-05 09:21:44,789:DEBUG:certbot._internal.error_handler:Calling registered functions
2021-07-05 09:21:44,789:INFO:certbot._internal.auth_handler:Cleaning up challenges
2021-07-05 09:21:44,789:DEBUG:certbot._internal.plugins.webroot:Removing /data/letsencrypt-acme-challenge/.well-known/acme-challenge/xjwt0sAvlZow3m0hs19hIFuogOO9o_PvCdyh6xntdpg
2021-07-05 09:21:44,789:DEBUG:certbot._internal.plugins.webroot:All challenges cleaned up
2021-07-05 09:21:44,789:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/opt/certbot/bin/certbot", line 8, in <module>
    sys.exit(main())
  File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 15, in main
    return internal_main.main(cli_args)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1552, in main
    return config.func(config, plugins)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1414, in certonly
    lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 128, in _get_and_save_cert
    lineage = le_client.obtain_and_enroll_certificate(domains, certname)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 445, in obtain_and_enroll_certificate
    cert, chain, key, _ = self.obtain_certificate(domains)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 375, in obtain_certificate
    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 425, in _get_order_and_authorizations
    authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 93, in handle_authorizations
    self._poll_authorizations(authzrs, max_retries, best_effort)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 181, in _poll_authorizations
    raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.
2021-07-05 09:21:44,791:ERROR:certbot._internal.log:Some challenges have failed.

I have changed my email and domain name to the variables — myemail.co.uk and mydomain.co.uk

i cant generate cert for any of the domain, help pls

If you’re having trouble using Certbot and aren’t sure you’ve found a bug or
request for a new feature, please first try asking for help at
https://community.letsencrypt.org/. There is a much larger community there of
people familiar with the project who will be able to more quickly answer your
questions.

My operating system is (include version): Opensuse Leap 15.2 (Before 15.1)

I installed Certbot with (certbot-auto, OS package manager, pip, etc): OS Package manager (zypper in python3-certbot) version 1.4.0

I ran this command and it produced this output: certbot —apache

`certbot —apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Could not find ssl_module; not disabling session tickets.
Plugins selected: Authenticator apache, Installer apache

Which names would you like to activate HTTPS for?

1: astian.org
2: abc.astian.org
3: www.abc.astian.org
4: example.astian.org
5: www.example
letsencrypt.log
.astian.org
6: example.astian.org
7: www.example.astian.org
8: example.astian.org
9: www.example.astian.org
10: example.astian.org
11: www.example.astian.org
12: www.astian.org

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter ‘c’ to cancel): 1
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for astian.org
Waiting for verification…
Challenge failed for domain astian.org
http-01 challenge for astian.org
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

• The following errors were reported by the server:

Domain: astian.org
Type: unauthorized
Detail: Invalid response from
http://astian.org/.well-known/acme-challenge/v_XPmYvxdCFz5PeDESmtEcnuh6bZJKTaed_hl6JIHSc
[5.9.70.7]: «n<!DOCTYPE
html PUBLIC «-//W3C//DTD XHTML 1.0 Strict//EN»n
«http://www.w3.org/TR/xhtml1/D»

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.`

Certbot’s behavior differed from what I expected because: challenge fail on each domain

Here is a Certbot log showing the issue (if available):

Logs are stored in /var/log/letsencrypt by default. Feel free to redact domains, e-mail and IP addresses as you see fit.

2020-07-02 14:22:54,364:DEBUG:certbot._internal.main:certbot version: 1.4.0
2020-07-02 14:22:54,365:DEBUG:certbot._internal.main:Arguments: ['--apache']
2020-07-02 14:22:54,365:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2020-07-02 14:22:54,377:DEBUG:certbot._internal.log:Root logging level set at 20
2020-07-02 14:22:54,378:INFO:certbot._internal.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2020-07-02 14:22:54,378:DEBUG:certbot._internal.plugins.selection:Requested authenticator apache and installer apache
2020-07-02 14:22:54,446:DEBUG:certbot_apache._internal.configurator:Apache version is 2.4.43
2020-07-02 14:22:54,770:WARNING:certbot_apache._internal.configurator:Could not find ssl_module; not disabling session tickets.
2020-07-02 14:22:54,771:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * apache
Description: Apache Web Server plugin
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: apache = certbot_apache._internal.entrypoint:ENTRYPOINT
Initialized: <certbot_apache._internal.override_suse.OpenSUSEConfigurator object at 0x7f44d8cdc320>
Prep: True
2020-07-02 14:22:54,772:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot_apache._internal.override_suse.OpenSUSEConfigurator object at 0x7f44d8cdc320> and installer <certbot_apache._internal.override_suse.OpenSUSEConfigurator object at 0x7f44d8cdc320>
2020-07-02 14:22:54,772:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator apache, Installer apache
2020-07-02 14:22:54,776:DEBUG:certbot._internal.main:Picked account: <Account(RegistrationResource(body=Registration(key=None, contact=(), agreement=None, status=None, terms_of_service_agreed=None, only_return_existing=None, external_account_binding=None), uri='https://acme-v02.api.letsencrypt.org/acme/acct/90342359', new_authzr_uri=None, terms_of_service=None), e548ecb21e7fe034383606c1aa947a22, Meta(creation_dt=datetime.datetime(2020, 7, 2, 18, 6, 3, tzinfo=<UTC>), creation_host='server00.astian.org'))>
2020-07-02 14:22:54,777:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2020-07-02 14:22:54,778:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2020-07-02 14:22:55,369:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 658
2020-07-02 14:22:55,370:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 02 Jul 2020 18:22:55 GMT
Content-Type: application/json
Content-Length: 658
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "TIKXg6-S5vE": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
  "meta": {
    "caaIdentities": [
      "letsencrypt.org"
    ],
    "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",
    "website": "https://letsencrypt.org"
  },
  "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
  "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
  "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
  "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
}
2020-07-02 14:22:56,528:INFO:certbot._internal.main:Obtaining a new certificate
2020-07-02 14:22:56,765:DEBUG:certbot.crypto_util:Generating key (2048 bits): /etc/letsencrypt/keys/0002_key-certbot.pem
2020-07-02 14:22:56,767:DEBUG:certbot.crypto_util:Creating CSR: /etc/letsencrypt/csr/0002_csr-certbot.pem
2020-07-02 14:22:56,767:DEBUG:acme.client:Requesting fresh nonce
2020-07-02 14:22:56,767:DEBUG:acme.client:Sending HEAD request to https://acme-v02.api.letsencrypt.org/acme/new-nonce.
2020-07-02 14:22:56,914:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "HEAD /acme/new-nonce HTTP/1.1" 200 0
2020-07-02 14:22:56,915:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 02 Jul 2020 18:22:56 GMT
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0002A5Wkyry59GJ4TmXkHFkAznMJA8Tgz-KNO7RPbQriQcI
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800


2020-07-02 14:22:56,915:DEBUG:acme.client:Storing nonce: 0002A5Wkyry59GJ4TmXkHFkAznMJA8Tgz-KNO7RPbQriQcI
2020-07-02 14:22:56,915:DEBUG:acme.client:JWS payload:
b'{n  "identifiers": [n    {n      "type": "dns",n      "value": "astian.org"n    }n  ]n}'
2020-07-02 14:22:56,918:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/new-order:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvOTAzNDIzNTkiLCAibm9uY2UiOiAiMDAwMkE1V2t5cnk1OUdKNFRtWGtIRmtBem5NSkE4VGd6LUtOTzdSUGJRcmlRY0kiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL25ldy1vcmRlciJ9",
  "signature": "Fqnfm3h-__LfKHYJ9uSO0nKtfAJ6btiycRkL0JqEc93sJnIu8HpiCV2V3rVqeOlNRFuxwaqCLIgUb5f-Q8YIzPaQubhfng1jSTbqV9tylGo22MhC8wDY6r4D3gQZ2jbOdU2B14ECV2Xv72M22e9fY8S3NfK6jgD_G7hHRaopCxs2JmL15ZdG8NLlDLoTVuRnsXIFnubyU6EHSNohWf2qa6j8zfYRmJS21p4g8LzhhSl672j1dSnouZh3J-i8MfWA8U58h-eieX7AUKqTntbp_qve2x2_JS6HedWgU4fNCrVQJgPU9X1FLhnwhDpVamVKWo7DwnXEpxcr30BUJnnogw",
  "payload": "ewogICJpZGVudGlmaWVycyI6IFsKICAgIHsKICAgICAgInR5cGUiOiAiZG5zIiwKICAgICAgInZhbHVlIjogImFzdGlhbi5vcmciCiAgICB9CiAgXQp9"
}
2020-07-02 14:22:57,091:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/new-order HTTP/1.1" 201 340
2020-07-02 14:22:57,092:DEBUG:acme.client:Received response:
HTTP 201
Server: nginx
Date: Thu, 02 Jul 2020 18:22:56 GMT
Content-Type: application/json
Content-Length: 340
Connection: keep-alive
Boulder-Requester: 90342359
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Location: https://acme-v02.api.letsencrypt.org/acme/order/90342359/4024868774
Replay-Nonce: 0002VN11kkymhY1zoISk2jEBM4OCdPX6syfjlVjxWxGpH3M
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "status": "pending",
  "expires": "2020-07-09T18:22:56.970471359Z",
  "identifiers": [
    {
      "type": "dns",
      "value": "astian.org"
    }
  ],
  "authorizations": [
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/5624377239"
  ],
  "finalize": "https://acme-v02.api.letsencrypt.org/acme/finalize/90342359/4024868774"
}
2020-07-02 14:22:57,092:DEBUG:acme.client:Storing nonce: 0002VN11kkymhY1zoISk2jEBM4OCdPX6syfjlVjxWxGpH3M
2020-07-02 14:22:57,093:DEBUG:acme.client:JWS payload:
b''
2020-07-02 14:22:57,096:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/authz-v3/5624377239:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvOTAzNDIzNTkiLCAibm9uY2UiOiAiMDAwMlZOMTFra3ltaFkxem9JU2syakVCTTRPQ2RQWDZzeWZqbFZqeFd4R3BIM00iLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2F1dGh6LXYzLzU2MjQzNzcyMzkifQ",
  "signature": "C6qNLsR_H53KkgRbV8s08X17TupjdQQqgQb_XWLHl4KXuVnSOCZr7EVUv0kMvdxjwo68vdkDRRWHBfLGhwYYo_-Y6Rl6pphzNAMjQwfMwiyCoWQ1gvklpiJzipbUm5vbpl4o2bY2SdDhEl7WKzxHKADcBf3nXnqNhTH799ohgFUfXc1_m3g5lbxEBRx9OEvESGRBmE-jOruJ3eJ-1Un0-wQ840aDcRZCiA8xwpZC38VzzO2nNe3qMBw-W4Jz2gOv8lfq3Bg4wCiQKLmasOpwdEk7x1itSc1fW_SC1SKjygkwY4bXFpomK5t7b9Sqn68sk35rgJ3UeknZGzXeP9zoTQ",
  "payload": ""
}
2020-07-02 14:22:57,247:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/5624377239 HTTP/1.1" 200 788
2020-07-02 14:22:57,248:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 02 Jul 2020 18:22:57 GMT
Content-Type: application/json
Content-Length: 788
Connection: keep-alive
Boulder-Requester: 90342359
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0002dOrSZPlXwlog61DhpGe04V7b212Xz4Wps3yBVlnauO8
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "identifier": {
    "type": "dns",
    "value": "astian.org"
  },
  "status": "pending",
  "expires": "2020-07-09T18:22:56Z",
  "challenges": [
    {
      "type": "http-01",
      "status": "pending",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/5624377239/Hw856w",
      "token": "H_XesKzQuknLboCs342tJHxFqcS7nVoAODZovNS6y3g"
    },
    {
      "type": "dns-01",
      "status": "pending",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/5624377239/OoHKmg",
      "token": "H_XesKzQuknLboCs342tJHxFqcS7nVoAODZovNS6y3g"
    },
    {
      "type": "tls-alpn-01",
      "status": "pending",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/5624377239/xcqWJA",
      "token": "H_XesKzQuknLboCs342tJHxFqcS7nVoAODZovNS6y3g"
    }
  ]
}
2020-07-02 14:22:57,249:DEBUG:acme.client:Storing nonce: 0002dOrSZPlXwlog61DhpGe04V7b212Xz4Wps3yBVlnauO8
2020-07-02 14:22:57,249:INFO:certbot._internal.auth_handler:Performing the following challenges:
2020-07-02 14:22:57,250:INFO:certbot._internal.auth_handler:http-01 challenge for astian.org
2020-07-02 14:22:57,291:DEBUG:certbot_apache._internal.http_01:Adding a temporary challenge validation Include for name: www.astian.org in: /etc/apache2/vhosts.d/astian.org.conf
2020-07-02 14:22:57,291:DEBUG:certbot_apache._internal.http_01:writing a pre config file with text:
         RewriteEngine on
        RewriteRule ^/.well-known/acme-challenge/([A-Za-z0-9-_=]+)$ /var/lib/letsencrypt/http_challenges/$1 [END]
    
2020-07-02 14:22:57,292:DEBUG:certbot_apache._internal.http_01:writing a post config file with text:
         <Directory /var/lib/letsencrypt/http_challenges>
            Require all granted
        </Directory>
        <Location /.well-known/acme-challenge>
            Require all granted
        </Location>
    
2020-07-02 14:22:57,341:DEBUG:certbot.reverter:Creating backup of /etc/apache2/vhosts.d/astian.org.conf
2020-07-02 14:23:00,466:INFO:certbot._internal.auth_handler:Waiting for verification...
2020-07-02 14:23:00,466:DEBUG:acme.client:JWS payload:
b'{}'
2020-07-02 14:23:00,468:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/chall-v3/5624377239/Hw856w:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvOTAzNDIzNTkiLCAibm9uY2UiOiAiMDAwMmRPclNaUGxYd2xvZzYxRGhwR2UwNFY3YjIxMlh6NFdwczN5QlZsbmF1TzgiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2NoYWxsLXYzLzU2MjQzNzcyMzkvSHc4NTZ3In0",
  "signature": "CGwoTTOO6rCjp_y38EBe1iNsveLQhHkbi3JBTUEU6PQWWF5CANH-R-sy8O3hcvEMOUuO9a_QEUUCQ7M28ev5ar1scYliHssROrTr7BFVpBgaaaHAvvCZanMhFjMFaGILrz82o084BFat4fSuLdDjRzMqEM77udmdq7Wq3YVpbLBu2V97UrSS_EHWqj1E7eacmRoFWevA2wil2IHhqPEa_M6aSEccA8okItNTbgscx-1q1q1Zlik_r2oY1KA-xRaeAqW5-tvO7WZaDxRq8XI0xPAHFsDcDZs1CN2Y8JpUIAwKqjuDf91EXvmcYjVHIERnpCpLQUYmQZ6oVotPZ0gThQ",
  "payload": "e30"
}
2020-07-02 14:23:00,629:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/chall-v3/5624377239/Hw856w HTTP/1.1" 200 185
2020-07-02 14:23:00,630:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 02 Jul 2020 18:23:00 GMT
Content-Type: application/json
Content-Length: 185
Connection: keep-alive
Boulder-Requester: 90342359
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index", <https://acme-v02.api.letsencrypt.org/acme/authz-v3/5624377239>;rel="up"
Location: https://acme-v02.api.letsencrypt.org/acme/chall-v3/5624377239/Hw856w
Replay-Nonce: 0001YMGLgIcbLXwM_46bFTRMT5AAOpmtkiFgzc0e9docEM8
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "type": "http-01",
  "status": "pending",
  "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/5624377239/Hw856w",
  "token": "H_XesKzQuknLboCs342tJHxFqcS7nVoAODZovNS6y3g"
}
2020-07-02 14:23:00,630:DEBUG:acme.client:Storing nonce: 0001YMGLgIcbLXwM_46bFTRMT5AAOpmtkiFgzc0e9docEM8
2020-07-02 14:23:01,632:DEBUG:acme.client:JWS payload:
b''
2020-07-02 14:23:01,635:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/authz-v3/5624377239:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvOTAzNDIzNTkiLCAibm9uY2UiOiAiMDAwMVlNR0xnSWNiTFh3TV80NmJGVFJNVDVBQU9wbXRraUZnemMwZTlkb2NFTTgiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2F1dGh6LXYzLzU2MjQzNzcyMzkifQ",
  "signature": "M5dVzctk6GYaYBC2U52Ic4fM1HIct_dOayvAaIE2lmXDDTJ6K1lU2y1hO6g6nS09xYPtksYyaxiXZFceBuIfz3xn2DbIIdSVRu_Y_ENh2_uXisWH3_4vQ-XczR6ylMSJk6hKlDLXWOmhVdexIDpNGe5kxrN-4kMAJEDP6_cUE16eQ1E4VtkP1d5xJbr16YxXO0JCfC_HtowQuRgBaxXpKuo3q1C0WUEHEbjH3F1uL5az8jVPGOQ2O1JCks6yfusufUtIglQ2SJcDJgh44vfdCHqWr1rFbtdOq7fVZ1uiXUBjhY3T4olRP8NaYtKMxOSeKATrqJ5-GSocEVf8KRM4nQ",
  "payload": ""
}
2020-07-02 14:23:01,798:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/5624377239 HTTP/1.1" 200 1118
2020-07-02 14:23:01,798:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 02 Jul 2020 18:23:01 GMT
Content-Type: application/json
Content-Length: 1118
Connection: keep-alive
Boulder-Requester: 90342359
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0001gI0c8VhuGnibAVNZxoa0s-k2INqeAwDvkn7YHT_tcv0
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "identifier": {
    "type": "dns",
    "value": "astian.org"
  },
  "status": "invalid",
  "expires": "2020-07-09T18:22:56Z",
  "challenges": [
    {
      "type": "http-01",
      "status": "invalid",
      "error": {
        "type": "urn:ietf:params:acme:error:unauthorized",
        "detail": "Invalid response from http://astian.org/.well-known/acme-challenge/H_XesKzQuknLboCs342tJHxFqcS7nVoAODZovNS6y3g [5.9.70.7]: "u003c?xml version=\"1.0\" encoding=\"UTF-8\"?u003e\nu003c!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n  \"http://www.w3.org/TR/xhtml1/D"",
        "status": 403
      },
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/5624377239/Hw856w",
      "token": "H_XesKzQuknLboCs342tJHxFqcS7nVoAODZovNS6y3g",
      "validationRecord": [
        {
          "url": "http://astian.org/.well-known/acme-challenge/H_XesKzQuknLboCs342tJHxFqcS7nVoAODZovNS6y3g",
          "hostname": "astian.org",
          "port": "80",
          "addressesResolved": [
            "5.9.70.7"
          ],
          "addressUsed": "5.9.70.7"
        }
      ]
    }
  ]
}
2020-07-02 14:23:01,798:DEBUG:acme.client:Storing nonce: 0001gI0c8VhuGnibAVNZxoa0s-k2INqeAwDvkn7YHT_tcv0
2020-07-02 14:23:01,799:WARNING:certbot._internal.auth_handler:Challenge failed for domain astian.org
2020-07-02 14:23:01,799:INFO:certbot._internal.auth_handler:http-01 challenge for astian.org
2020-07-02 14:23:01,799:DEBUG:certbot._internal.reporter:Reporting to user: The following errors were reported by the server:

Domain: astian.org
Type:   unauthorized
Detail: Invalid response from http://astian.org/.well-known/acme-challenge/H_XesKzQuknLboCs342tJHxFqcS7nVoAODZovNS6y3g [5.9.70.7]: "<?xml version="1.0" encoding="UTF-8"?>n<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"n  "http://www.w3.org/TR/xhtml1/D"

To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address.
2020-07-02 14:23:01,799:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/certbot/_internal/auth_handler.py", line 91, in handle_authorizations
    self._poll_authorizations(authzrs, max_retries, best_effort)
  File "/usr/lib/python3.6/site-packages/certbot/_internal/auth_handler.py", line 180, in _poll_authorizations
    raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.

2020-07-02 14:23:01,800:DEBUG:certbot._internal.error_handler:Calling registered functions
2020-07-02 14:23:01,800:INFO:certbot._internal.auth_handler:Cleaning up challenges
2020-07-02 14:23:01,956:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/certbot", line 11, in <module>
    load_entry_point('certbot==1.4.0', 'console_scripts', 'certbot')()
  File "/usr/lib/python3.6/site-packages/certbot/main.py", line 15, in main
    return internal_main.main(cli_args)
  File "/usr/lib/python3.6/site-packages/certbot/_internal/main.py", line 1347, in main
    return config.func(config, plugins)
  File "/usr/lib/python3.6/site-packages/certbot/_internal/main.py", line 1101, in run
    certname, lineage)
  File "/usr/lib/python3.6/site-packages/certbot/_internal/main.py", line 121, in _get_and_save_cert
    lineage = le_client.obtain_and_enroll_certificate(domains, certname)
  File "/usr/lib/python3.6/site-packages/certbot/_internal/client.py", line 409, in obtain_and_enroll_certificate
    cert, chain, key, _ = self.obtain_certificate(domains)
  File "/usr/lib/python3.6/site-packages/certbot/_internal/client.py", line 343, in obtain_certificate
    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
  File "/usr/lib/python3.6/site-packages/certbot/_internal/client.py", line 390, in _get_order_and_authorizations
    authzr = self.auth_handler.handle_authorizations(orderr, best_effort)
  File "/usr/lib/python3.6/site-packages/certbot/_internal/auth_handler.py", line 91, in handle_authorizations
    self._poll_authorizations(authzrs, max_retries, best_effort)
  File "/usr/lib/python3.6/site-packages/certbot/_internal/auth_handler.py", line 180, in _poll_authorizations
    raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.

Here is the relevant nginx server block or Apache virtualhost for the domain I am configuring:

<VirtualHost *:80>

#ServerAdmin webmaster@dummy-host.example.com
ServerName www.astian.org
ServerAlias astian.org

DocumentRoot /location/

# if not specified, the global error log is used
ErrorLog /location/error_log
CustomLog /location/access_log combined

# don't loose time with IP address lookups
HostnameLookups Off
# needed for named virtual hosts
UseCanonicalName Off
# configures the footer on server-generated documents
ServerSignature On

# Include /etc/apache2/conf.d/php5.conf
# Include /etc/apache2/conf.d/*.conf

<Directory "/location/">

Options Indexes FollowSymLinks MultiViews
AllowOverride All

<IfModule !mod_access_compat.c>
Require all granted
</IfModule>
<IfModule mod_access_compat.c>
Order allow,deny
Allow from all
</IfModule>

</Directory>

</VirtualHost>