Почему выходит ошибка при получении сертификата от Let's Encrypt?

Question

[Хикмат Абдунабиев]

Здравствуйте!
При получении сертификата для horijdaish.uz через certbot получаю ошибку:
Timeout during connect (likely firewall problem).
Порты 80 и 443 на сервере доступные.

ufw status verbose

Status: active
Logging: off
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
80/tcp                 ALLOW IN    Anywhere                  
443/tcp               ALLOW IN    Anywhere

Создал временный файл horijdaish.uz/.well-known/acme-challenge/1 и он открывается без проблем.
В логах nginx видно что сервер отдает проверочный файл (код 200) без ошибок.

Лог NGINX

18.197.227.110 - - [26/Sep/2019:10:32:16 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
18.197.227.110 - - [26/Sep/2019:10:32:16 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
3.14.255.131 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
3.14.255.131 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
18.197.227.110 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
18.197.227.110 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
3.14.255.131 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
3.14.255.131 - - [26/Sep/2019:10:32:17 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
34.222.229.130 - - [26/Sep/2019:10:32:18 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
34.222.229.130 - - [26/Sep/2019:10:32:18 +0500] "GET /.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
34.222.229.130 - - [26/Sep/2019:10:32:18 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
34.222.229.130 - - [26/Sep/2019:10:32:18 +0500] "GET /.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw HTTP/1.1" 200 118 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"

Для получения сертификата запускаю:

certbot certonly --webroot -w /home/horijdaish/www/webroot -d horijdaish.uz,www.horijdaish.uz

Вывод в консоли

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for horijdaish.uz
http-01 challenge for www.horijdaish.uz
Using the webroot path /home/horijdaish/www/webroot for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. www.horijdaish.uz (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://www.horijdaish.uz/.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE: Timeout during connect (likely firewall problem), horijdaish.uz (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://horijdaish.uz/.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw: Timeout during connect (likely firewall problem)

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: www.horijdaish.uz
   Type:   connection
   Detail: Fetching
   http://www.horijdaish.uz/.well-known/acme-challenge/Gc_e_aq2duUJphH_I76NE_2otHyEwOJSCXdApMH1aeE:
   Timeout during connect (likely firewall problem)

   Domain: horijdaish.uz
   Type:   connection
   Detail: Fetching
   http://horijdaish.uz/.well-known/acme-challenge/pgNtFkVOeo4fkm1W8TBrMylJpseRsAGR_13PtRxXHfw:
   Timeout during connect (likely firewall problem)

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

nslookup

nslookup horijdaish.uz 8.8.8.8
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
Name:	horijdaish.uz
Address: 185.8.212.153

Nginx

server {
    listen 185.8.212.153:80;
    server_name horijdaish.uz www.horijdaish.uz;
    charset utf-8;

    access_log  /var/log/nginx/horijdaish.access.log;
    error_log   /var/log/nginx/horijdaish.error.log;

    client_max_body_size 100m;

    set $root_path /home/horijdaish/www/webroot;
    set $php_sock  unix:/var/run/php/php7.2-fpm-horijdaish.sock;

    root   $root_path;
    index  index.php index.html index.htm;
       
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~* ^/(css|font|images|img|js|uploads|test)/.+\.php$ {
        deny all;
    }

    location ~ /\. {
        deny  all;
        access_log off;
        log_not_found off;
        return 404;
    }
  
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass $php_sock;
        fastcgi_index index.php;   
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
    }

    # Let's Encrypt
    location ^~ /.well-known {
        allow all;
        default_type "text/plain";
        root $root_path;
    }
}

Как можно исправить эту ошибку? Кто нибудь сталкивался с такой проблемой?!

Answer 1

[Андрей Гаврилов]

Просто введи команду cerbot и в режиме консоли получи сертификат

Comments

[Хикмат Абдунабиев]

Та же ошибка выходит.

Domain: www.horijdaish.uz
   Type:   connection
   Detail: Fetching
   http://www.horijdaish.uz/.well-known/acme-challenge/UUNXN8muOSpv3zmz0J20ok-Q6kyba0dX5AoNsrJLgiM:
   Timeout during connect (likely firewall problem)

   Domain: horijdaish.uz
   Type:   connection
   Detail: Fetching
   http://horijdaish.uz/.well-known/acme-challenge/ix9nyLZ9n21vyxs-v6MvXtAEGfC8CABlkIFFrMqhk4c:
   Timeout during connect (likely firewall problem)

[Андрей Гаврилов]

Хикмат Абдунабиев, а ip точно правильный? Вижу что к записи для отправки писем написан другой ip, проверь a запись

[Хикмат Абдунабиев]

A запись указано верно

[Андрей Гаврилов]

Хикмат Абдунабиев, сервер в Узбекистане или в hetnzer?

[Хикмат Абдунабиев]

Андрей Гаврилов, в Узбекистане. Но он доступен по всему миру.

Answer 2

[Виктор Таран]

To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA - тут написана первая по распростроненности причина
www.horijdaish.uz/.well-known/acme-challenge/UUNXN...
Timeout during connect (likely firewall problem) - а это вторая возможно даже первая.

И того
удали ААА записи letsencrypyt не поддерживает ipv6
ну и по каой-то причине летсенкрипт не может положить файлик.

Comments

[Хикмат Абдунабиев]

В настройках DNS сервера нету ААА записи.
В файрволе 80 и 443 порты открыты всем.
Если посмотрите лог nginx там видно что letsencrypt обращается по GET и ответ 200.

[Виктор Таран]

Хикмат Абдунабиев,
ЛОГ В СТУДИЮ

[Хикмат Абдунабиев]

Виктор Таран, логи все в спойлерах наверху. Уже получил сертификат через ДНС режим.

[Виктор Таран]

# letsencrypt
         location /.well-known/acme-challenge/ {
                alias /home/horijdaish/www/webroot;
                default_type text/plain;ckquote>