Enable SSL with letsencrypt not working

[wouterverduin]

Hey guys!

I am running into the next issue: I get an error when enabling SSL with letsencrypt.

I got the nextcloud snap on an ubuntu VM with only plex on it aswell. Pfsense as router (VM aswell), ports 80 and 443 opened succesfully. Registered myself a domain name and forwarded it to my home adress IP.
When i attempt to enable ssl with letsencrypt i got errors, posted the log below.

When i tried a self-signed https it worked without a problem and it reachable through my domain name suggesting that all is set up well... However i would like a trusted ssl certificate and not receive errors.

Anyone know how to fix this?
---log:----

Domain: XXXXX.XX
Type: unauthorized
Detail: Invalid response from http://XXXXX.XX/.well-known/acme-challenge/n5Zvks9jITd_ubiZea4zq4y9KOEqDL6g5R0U6fTb880: "

<title>404 Not Found</title>

Not Found

To fix these errors, please make sure that your domain name was entered correctly and the DNS A record(s) for that domain contain(s) the right IP address.
2017-12-22 11:02:07,050:INFO:certbot.auth_handler:Cleaning up challenges
2017-12-22 11:02:07,050:DEBUG:certbot_nextcloud_plugin.webroot:Removing /var/snap/nextcloud/current/certs/certbot/.well-known/acme-challenge/n5Zvks9jITd_ubiZea4zq4y9KOEqDL6g5R0U6fTb880
2017-12-22 11:02:07,051:DEBUG:certbot_nextcloud_plugin.webroot:All challenges cleaned up, removing /var/snap/nextcloud/current/certs/certbot/.well-known/acme-challenge
2017-12-22 11:02:07,051:DEBUG:certbot.log:Exiting abnormally:
Traceback (most recent call last):
File "/snap/nextcloud/4371/bin/certbot", line 11, in
sys.exit(main())
File "/snap/nextcloud/4371/lib/python2.7/site-packages/certbot/main.py", line 742, in main
return config.func(config, plugins)
File "/snap/nextcloud/4371/lib/python2.7/site-packages/certbot/main.py", line 682, in certonly
lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
File "/snap/nextcloud/4371/lib/python2.7/site-packages/certbot/main.py", line 82, in _get_and_save_cert
lineage = le_client.obtain_and_enroll_certificate(domains, certname)
File "/snap/nextcloud/4371/lib/python2.7/site-packages/certbot/client.py", line 344, in obtain_and_enroll_certificate
certr, chain, key, _ = self.obtain_certificate(domains)
File "/snap/nextcloud/4371/lib/python2.7/site-packages/certbot/client.py", line 313, in obtain_certificate
self.config.allow_subset_of_names)
File "/snap/nextcloud/4371/lib/python2.7/site-packages/certbot/auth_handler.py", line 81, in get_authorizations
self._respond(resp, best_effort)
File "/snap/nextcloud/4371/lib/python2.7/site-packages/certbot/auth_handler.py", line 138, in _respond
self._poll_challenges(chall_update, best_effort)
File "/snap/nextcloud/4371/lib/python2.7/site-packages/certbot/auth_handler.py", line 202, in _poll_challenges
raise errors.FailedChallenges(all_failed_achalls)
FailedChallenges: Failed authorization procedure. XXXXX.XX (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://XXXXX.XX/.well-known/acme-challenge/n5Zvks9$

<title>404 Not Found</title>

Not Found

[kyrofa]

Are you certain that your server is accessible with port 80? Let's Encrypt says it can't find the auth file, so something network-related isn't setup correctly. Did you just recently register the domain name? It's possible it hasn't finished propagating-- give it 24 hours and try again.

[wouterverduin]

@kyrofa Thanks for the reply.

I Gave it even some more time and got 3 other domains, all of them give the same error. It works when i use an own signed certificate and i can ask the server through port 80 and 443 if i use my ip adress.

I aint got a clue on this point, anyone?

[lindhe]

I don't know much more than you do, but maybe we can figure things out. Are all your DNS records A records?

(could you btw format the log as code? I find it a bit hard to read right now. Just mark it all and press the <> icon in the Github text editor thing)

[wouterverduin]

@lindhe Thanks! Appreciate that :)

I noticed that it probably isnt the nextcloud snap since certbot gives comparable errors, as is my pfsense ACME package. I am guessing the problem is either my pfsense router settings or my domain name hoster blocking certain things (if the latter is even possible?)

Made an post on pfsene https://forum.pfsense.org/index.php?topic=142071.0 and a ticket to my hoster. Ill keep you guys update if i find a solution.

[kyrofa]

Thanks for the update, @wouterverduin, I'm glad you were able to test certbot on its own. I'll go ahead and close this here since it doesn't appear to be snap-specific, but I'm very curious what's causing it if you happen to learn more.

[wouterverduin]

@kyrofa

Thanks for your reply. I finnally figured it out and appeared to be an obvious problem:

In my registrar i didnt adjust the ipv6 registers thinking i wasnt using them. However they seemed to cause the hiccup. When i removed them it worked flawlessly as intended!

Thanks for the help :)