☰

certbot-无法获取 mail.domain.com 的 SSL 证书

tag-icon • tag-icon centos ssl apache-2.4 lets-encrypt certbot
certbot-无法获取 mail.domain.com 的 SSL 证书

我想在我的服务器上为domain.com、www.domain.com和安装 let's encrypt 证书。因此我为虚拟主机mail.domain.com创建了以下文件：domain-site.conf

<VirtualHost *:80>
ServerAdmin [email protected]
DocumentRoot "/home"
ServerName domain.com
ServerAlias www.domain.com
ErrorLog "/var/log/httpd/domain.error_log"
CustomLog "/var/log/httpd/domain.access_log" common
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.domain.com [OR]
RewriteCond %{SERVER_NAME} =domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:80>
ServerAdmin [email protected]
DocumentRoot "/home"
ServerName mail.domain.com
ErrorLog "/var/log/httpd/mail.domain.error_log"
CustomLog "/var/log/httpd/mail.domain.access_log" common
</VirtualHost>

然后，当我运行sudo certbot --apache命令并按回车键为所有 3 个名称安装证书时，它无法安装证书mail.domain.com并给出以下输出。如何解决这个问题？

You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/domain.com.conf)

It contains these names: domain.com, www.domain.com

You requested these names for the new certificate: domain.com, mail.domain.com,
www.domain.com.

Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: e
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for mail.domain.com
Waiting for verification...
Challenge failed for domain mail.domain.com
http-01 challenge for mail.domain.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
- The following errors were reported by the server:

Domain: mail.domain.com
Type:   unauthorized
Detail: Invalid response from
http://mail.domain.com/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU
[ip]: "<html>\r\n<head><title>404 Not
Found</title></head>\r\n<body>\r\n<center><h1>404 Not
Found</h1></center>\r\n<hr><center>nginx/1.18.0 (Ub"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

答案1

这个错误意味着它期望看到的 certbot 文件出现了 HTTP 404mail.domain.com/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU

您能在 中看到这个文件/home/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU吗？

您可以在那里写入自己的文件来测试它是否正在被服务吗？

echo wat > /home/.well-known/acme-challenge/wat

然后你应该能够用以下方法卷曲它：

curl mail.domain.com/.well-known/acme-challenge/wat

鉴于mail.domain.com具有与相同的文档根目录，您domain.com还www.domain.com应该能够curl domain.com/.well-known/acme-challenge/watcurl www.domain.com/.well-known/acme-challenge/wat

如果这不起作用，那么你的 Apache 配置有问题，或者可能是 的所有权/权限有问题/home，/home/.well-known或者/home/.well-known/acme-challenge

答案2

所以问题与 DNS 正向区域配置有关。我mail IN A 192.168.0.60在正向区域和60 IN PTR mail.domain.com反向区域中都进行了定义。我将正向区域中的记录更改为mail IN A <server_ip>，问题就消失了。

相关内容