Let's Encrypt renewing failed

Roadmax

Hi all,

I have some issues with the renewing of the certs.

I used the following command to renew the certs:
certbot certonly --dry-run -n --standalone --agree-tos \ --preferred-challenges http \ --cert-name="autodiscover.buero.de" \ -d "autodiscover.buero.de" \ -m "cert@buero.de" \ --pre-hook "service nginx stop" --deploy-hook /usr/share/grommunio-setup/grommunio-certbot-renew-hook --post-hook "service nginx start"

I get the result:
` - The following errors were reported by the server:

Domain: autodiscover.buero.de
Type: unauthorized
Detail: 185.254.127.19: Invalid response from
http://autodiscover.buero.de/.well-known/acme-challenge/TcPhOG7rzlhCTONp1yCCi0yahBhZa5BpJc-OYtwZlUI:
404

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address`

Any hints?

Have a nice day,
Roadmax

crpb

Hey Roadmax,

sadly i have no Grommunio-Machine which uses certbot. (my opnsense's do that for me).

I guess port 80 is open to WAN?
Maybe first shutdown the nginx-daemon with systemctl stop nginx.service and try again.

Roadmax

Hey,

at first I shutdown Nginx and then I get the error from certbot I mentioned.

When I use curl to check the autodiscover subdomain I get:
301 Moved Permanently
Because Port 80 is redirected to 443. When I remove the redirect I get a 404 error because / is redirected to /web.
All settings were generated bei the installer of Grommunio.

mwilliams

Roadmax

Shutting down nginx will help, if not, you are redirecting somewhere in front of grommunio. See also https://community.grommunio.com/d/98-solved-letsencrypt-certificate-multidomain/12

crpb

You can only check with curl while certbot is running. Otherwise you will get a return of the normal nginx-service which does the redirect.

Maybe try running certbot with -vvv for a bit more info.