Release install: reverse proxy + Let's Encrypt process
Description
The release installation's reverse proxy section has one creating a folder for Let's Encrypt's certbot HTTP-01 challenge. This failed for me. I was finally able to get it to work by using the default /var/www/html
directory.
I'm confused why the guide recommends creating a special directory or why it didn't work; while I was able to get the initial certificate request to succeed using the default directory I'm unsure if renewals will happen smoothly.
Finally, it's confusing that in the provided mobilizon.conf
file, it instructs you to get a TLS certificate first -- before editing the file -- whereas in the guide it tells you (correctly I think) to change the example.tld
entries, then get the cert, then edit it again.
Steps to Reproduce
-
Followed the steps of the release install up until the reverse proxy section without issue.
-
When I ran the certbot command (adapted with my email and domain) I got the following:
Performing the following challenges:
http-01 challenge for DOMAIN.com
http-01 challenge for www.DOMAIN.com
Using the webroot path /var/www/certbot for all unmatched domains.
Waiting for verification...
Challenge failed for domain DOMAIN.com
Challenge failed for domain www.DOMAIN.com
http-01 challenge for DOMAIN.com
http-01 challenge for www.DOMAIN.com
Cleaning up challenges
Some challenges have failed.
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: DOMAIN.com
Type: unauthorized
Detail: Invalid response from
http://DOMAIN.com/.well-known/acme-challenge/HASH
[167.71.180.52]: "<html>\r\n<head><title>404 Not
Found</title></head>\r\n<body>\r\n<center><h1>404 Not
Found</h1></center>\r\n<hr><center>nginx/1.18.0 (Ub"
Domain: www.DOMAIN.com
Type: unauthorized
Detail: Invalid response from
http://www.DOMAIN.com/.well-known/acme-challenge/HASH
[167.71.180.52]: "<html>\r\n<head><title>404 Not
Found</title></head>\r\n<body>\r\n<center><h1>404 Not
Found</h1></center>\r\n<hr><center>nginx/1.18.0 (Ub"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
- Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
-
So instead, I ran the command with
--webroot -w /var/www/html
and it succeeded. -
Because of Let's Encrypt's rate limits and trying it a few different times as specified in the guide to make sure I wasn't missing/mistyping something, I got locked out for an hour. So I'd also suggest using their
--dry-run
flag first to make sure a given configuration works.
Expected behaviour:
Following the guide wouldn't result in an error from Let's Encrypt.
Reproduces how often:
Every time, at least on my setup. I even rebuilt the server from scratch to make sure I hadn't missed an installation step.
Versions
Installing on a Digital Ocean droplet with Ubuntu 20.04 (LTS) x64, 1GB RAM.
Latest Mobilizon as of this writing, which looks like it's 1.2.3.
Additional Information
I considered that it might have something to do with Digital Ocean's firewall settings, but even after turning on both HTTP and HTTPS, I got the same errors.