Centos – certbot-can’t get SSL certificate for mail.domain.com

apache-2.4centoscertbotlets-encryptssl

I want to install let's encrypt certificate on my server for domain.com, www.domain.com and mail.domain.com. so I created the following domain-site.conf file for virtual hosts:

<VirtualHost *:80>
ServerAdmin admin@domain.com
DocumentRoot "/home"
ServerName domain.com
ServerAlias www.domain.com
ErrorLog "/var/log/httpd/domain.error_log"
CustomLog "/var/log/httpd/domain.access_log" common
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.domain.com [OR]
RewriteCond %{SERVER_NAME} =domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:80>
ServerAdmin admin@domain.com
DocumentRoot "/home"
ServerName mail.domain.com
ErrorLog "/var/log/httpd/mail.domain.error_log"
CustomLog "/var/log/httpd/mail.domain.access_log" common
</VirtualHost>

and then when I run sudo certbot --apache command and hit the enter to install certificate for all 3 names, it can not install certificate for mail.domain.com and gives the below output. how to solve the issue?

You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/domain.com.conf)

It contains these names: domain.com, www.domain.com

You requested these names for the new certificate: domain.com, mail.domain.com,
www.domain.com.

Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: e
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for mail.domain.com
Waiting for verification...
Challenge failed for domain mail.domain.com
http-01 challenge for mail.domain.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
- The following errors were reported by the server:

Domain: mail.domain.com
Type:   unauthorized
Detail: Invalid response from
http://mail.domain.com/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU
[ip]: "<html>\r\n<head><title>404 Not
Found</title></head>\r\n<body>\r\n<center><h1>404 Not
Found</h1></center>\r\n<hr><center>nginx/1.18.0 (Ub"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

Best Answer

That error means there's an HTTP 404 for the certbot file that it expects to see at mail.domain.com/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU

Can you see this file in /home/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU?

Can you write your own file there, to test that it's being served?

echo wat > /home/.well-known/acme-challenge/wat

Then you should be able to curl it with:

curl mail.domain.com/.well-known/acme-challenge/wat

Given that mail.domain.com has got the same docroot as domain.com and www.domain.com you should also be able to curl domain.com/.well-known/acme-challenge/wat and curl www.domain.com/.well-known/acme-challenge/wat

If that doesn't work, then there's something up with your Apache config, or possibly the ownership/permissions of /home, /home/.well-known or /home/.well-known/acme-challenge

Related Topic