Authentication issue with Certbot (300 Multiple Choices) & Nginx & DNS

0
votes

I've problems creating letsencrypt certs with the certbot.

Because I don't know where the problem is, I will just write everything down which can be the root cause:

I do have a domain and one subdomain. There is a Nginx which redirects the subdomain to the domain on a specific port.

Now I run the certbot for my domain without the subdomain at first.

sudo certbot --nginx -d domain.de -d www.domain.de

This leads to the following error:

Domain: domain.de Type: unauthorized Detail: Invalid response from
http://domain.de/.well-known/acme-challenge/Y_Ka6V9JlHjBqjqanHLthoVL9F2yju_2TczRPwkBD0s: "\n\n300 Multiple Choices\n\nMultiple C"

Domain: www.domain.de Type: unauthorized Detail: Invalid response from
http://www.domain.de/.well-known/acme-challenge/Vf234FTDH7zH5TUBbBwVGfPVLK3m5rllc1s3Cu9KK3I: "\n\n300 Multiple Choices\n\nMultiple C"

I couldn't find much except this thread. Letsencrypt Community

So I guess it is realted to my DNS Settings. I rent the domain via 1&1 and created a subdomain as well. Because I was playing around with Nginx redirects and the DNS settings, I configured the subdomain to have the same IPv4 & IPv6 as the domain. Could this be the problem or do I have to look somewhere else?

Best regards from Berlin!

1
sslnginxdnscertbot
Do not obfuscate your commands... when your domain name is fully visible in the error message anyway... - Patrick Mevzek
"So I guess it is realted to my DNS Settings. " No it is not. A seen on the error message, the CA went to the URL and your webserver replied with an unexpected error code 300 instead of 200. You have a problem at the webserver level. - Patrick Mevzek
Now it even gives a 404 error code. Based on dnsviz.net/d/www.berlincodingcamp.de/W7T4Nw/dnssec your DNS configuration is fine. - Patrick Mevzek
In your case since you are using redirection (which does not work for http validation) you will need to use dns validation. This means creating TXT records on your DNS server. - John Hanley

1 Answers

1
votes

I checked the IPv6 address with nslookup and this pointed to somewhere else. I do not understand how this can happen because I never touched the IPv6 (AAAA) record. I guess Certbot is checking A and AAAA and because they did not match the authentication failed.

I deleted the AAAA records for the domain and was able to get a cert without a problem.