☰

如何修复 let's encrypt 证书生成过程中的错误

tag-icon • tag-icon ssl ssl-certificate certificate lets-encrypt certbot
如何修复 let's encrypt 证书生成过程中的错误

我的服务器上有 A 记录：

  1. 192.0.2.4-我的外部ip（当然这只是一个例子）；
  2. master.example.org - 此 IP 地址的 A 记录

命令：

certbot certonly --webroot --agree-tos --email [email protected] -w /home/www/acme/ -d master.example.org -d www.master.example.org

master.confnginx 配置中我的配置部分（ ）：

server
{
    listen 192.0.2.4;
    listen 192.0.2.4:443 ssl;

    server_name www.master.example.org;

    expires -100;
    #ssl_certificate_key /etc/letsencrypt/live/master.example.org/privkey.pem;
    #ssl_certificate /etc/letsencrypt/live/master.example.org/fullchain.pem;

    error_page 403 @forbidden;
    error_page 404 @notfound;
    error_page 405 @notallowed;
    error_page 500 @internalerror;

    # letsencrypt
    location ~ ^/\.well-known/acme-challenge
    {
        auth_basic off;
        root /home/www/acme;
    }

错误，生成 let's encrypt 后：

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for master.example.org
http-01 challenge for www.master.example.org
Using the webroot path /home/www/acme for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. master.example.org (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://master.example.org/.well-known/acme-challenge/kCDuTttqcv1TchrOJy6HHwXtWMuWPkVfZxXMpWXAiXc: Connection refused

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: master.example.org
   Type:   connection
   Detail: Fetching
   http://master.example.org/.well-known/acme-challenge/kCDuTttqcv1TchrOJy6HHwXtWMuWPkVfZxXMpWXAiXc:
   Connection refused

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

我该怎么办？我真的很累，我搜索了很长时间却没有找到答案，但我需要生成此证书。我哪里出错了？

相关内容