Home / server / Questions / 1093785
Accepted
LosmiNCL
Asked: 2022-02-16 11:44:06 +0800 CST

Certbot unauthorized and connection errors

  • 772

I have a spring boot application on Google Cloud, CentOS 7. I wish to install SSL certificate via Let's Encrypt and Certbot. When I use certbot --apache -d mydomain.zone command I receive an error:

enter image description here

My domain is registered on Namecheap. My A records on Google Cloud:

enter image description here

Also I provided google cloud nameservers in Namecheap like in this tutorial: https://www.wpmentor.com/setup-domain-google-cloud-platform/

enter image description here

Can you tell me where the issue is? I also wonder is there an issue with my java code in app. For example sometimes while accessing index page, error_page is called. When I have a method in my controller:

@RequestMapping(value = "/error_page", method = RequestMethod.GET)
public String homeError(Model model)
{
  return "/error_page";
}

I have a different certvbot error:

enter image description here

but when I comment/erase my controller method for error page I receive this error:

enter image description here

Can it be it's an application bug? Or issue with apache?

I tried to turn off Tomcat. Now I receive this error:

enter image description here

Note: My Apache forwards to 8080, I don't know will it make any issue?

iptables -A PREROUTING -t nat -p tcp --dport 80 -j REDIRECT --to-port  8080
certbot lets-encrypt

1 Answers

  1. Best Answer

    Let's Encrypt is attempting to verify your ownership of the server by spinning up a temporary web server and having the Let's Encrypt servers try to contact it.

    You will need to:

    1. Disable any currently running web servers

    2. Make sure port 80 is accessible from the internet

    You already took care of step 1 by stopping Apache, now you need to fix your iptables rule.

    Looks like you're forwarding traffic from port 80 to port 8080, this is most likely why you're getting the Connection refused error, since the temporary web server's traffic is getting black-holed to port 8080. Disable/fix that rule and the verification should succeed.

    • 1