Skip to main content

autossl not renewing certs following change to let's encrypt

accafella
Hello, I finally bought the bullet and decided to go with Let's Encrypt to secure my mail but found it not as easy as I expected. I followed the steps in the documentation but the server is sending this alert .. The "LetsEncrypt" AutoSSL provider could not renew the SSL certificate without a reduction of coverage because of the following problems: DNS DCV: The DNS query to "_cpanel-dcv-test-record.domain.com" for the DCV challenge returned no "TXT" record that matches the value "_cpanel-dcv-test-record=etc..." I added a corresponding 'txt' record and waited the recommended 15 minutes but the warning messages persist. My DNS is hosted remotely. additionally, "The system queried for a temporary file at, domain.com but the web server responded with the following error: 404 (Not Found). A DNS (Domain Name System) or web server misconfiguration may exist." I checked and the .well-known/acme-challenge/ directory is empty. I'm fairly new to this and would dearly appreciate some pointers or help thanks.

Comments

8 comments

Date Votes
  • cPanelLauren
    Hello, The issue occurring here appears to be a DNS related issue. When you check the domain's IP using a site like whatsmydns.com does the IP address match the one assigned to the server you're running the DNS check from?
    0
  • accafella
    Hi and thanks for the reply. Yes, the IP address is the same - it is shared on a VPS. curiously though when I did a search for an MX record at mail.domain.com there were none. is that normal ? That record definitely exists. One question I wanted to ask, maybe on another thread, is why the cpanel zone editor only allows me to create A, CNAME and MX records ? The documentation suggests that all are available and I thought creating the missing TXT record here might solve the problem but the option is not available. Thanks again.
    0
  • cPanelLauren
    When I do a dig for any records while you do have an A record for the MX present you do not have an MX record for the domain. This would need to be added where DNS for the domain is hosted
    0
  • accafella
    Thanks. I have inherited this server from a far more experienced colleague but I admit some of the settings didn't make sense - such as the empty name field for the mx record. This is now fixed and the mx record is dig-able. what I don't understand is that we have never had any issues with email not working. it's just the certificate which has only become a problem since trying to get let's encrypt to work. I have put my zone editor question on another post in General Discussion as it will be more useful there.
    0
  • cPanelLauren
    Without an MX record, email senders will attempt delivery to the address record - i.e., the A record of the domain in this instance. This is discussed in RFC 5321
    0
  • accafella
    hi Lauren, please excuse my slowness, there's something I don't understand and I hope you will explain. HTTP DCV: "
    so I added an mx record for     www.mail.domain.tld with memset and now the dig results are correct but I re-run autoSSL and the same error appears. so I added an mx record for www.mail.domain.tld in cpanel re-run autoSSL and still the same error firstly, how do the cpanel and memset zone records relate to each other ? and do I actually need www.mail.domain.tld ? additionally ; DNS DCV: The DNS query to "_cpanel-dcv-test-record.domain.tld" for the DCV challenge returned no "TXT" record that matches the value "_cpanel-dcv-test-record=hashfile".;
    there actually is such a txt record, I promise
    0
  • cPanelLauren
    Hello, This issue specifically for www.mail.domain.tld is a bit different than the initial issue. Which was for mail.domain.tld (without the www) this is usually accommodated by a CNAME Record pointing to mail.domain.tld, but it is not necessary to have. The bigger portion of the issue is that the DNS DCV check can't complete, I believe that the dcv record is there unfortunately the query used to obtain it does not all access. Here is what I get when I attempt to run a curl request just to your domain (which I've removed from any output in this thread) [root@server .cpanel]# curl -kvv domain.tld
    • About to connect() to domain.tld port 80 (#0)
    • Trying ...
    • Connected to domain.tld () port 80 (#0)
    [QUOTE] GET / HTTP/1.1 User-Agent: curl/7.29.0 Host: domain.tld Accept: /
    < HTTP/1.1 403 Forbidden < Date: Tue, 10 Dec 2019 23:06:30 GMT < Server: Apache < Content-Length: 318 < Content-Type: text/html; charset=iso-8859-1
    0
  • accafella
    The curl issue may be a Wordpress security thing. I'll look into that, it would be good to check the dns handshake. I'm wondering if that's a parameter in .htaccess ? But thanks enormously for all your help and patience. I've ended up fixing the issue with closer inspection of the autoSSL manager on WHM and checked the Allow AutoSSL to replace invalid or expiring non-AutoSSL certificates. Embarrassingly simple really after all that - I actually do need new glasses - but thanks once again for your help.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post