如何使用certbot修复使用certbot设置SSL的错误？

Question

我尝试用Kubuntu 18为我的php/laravel应用程序在数字海洋下设置ssl，如本文https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-18-04所示

但我在使用certbot获得免费SSL证书时出错：

# sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
Apache Full                ALLOW       Anywhere                  
443                        ALLOW       Anywhere                  
80                         ALLOW       Anywhere                  
22/tcp                     ALLOW       Anywhere                                                                                                                                                                        
Apache Full (v6)           ALLOW       Anywhere (v6)                                                                                                                                                                   
443 (v6)                   ALLOW       Anywhere (v6)                                                                                                                                                                   
80 (v6)                    ALLOW       Anywhere (v6)                                                                                                                                                                   
22/tcp (v6)                ALLOW       Anywhere (v6)                                                                                                                                                                   

# sudo certbot --apache -d products-catalog.nilov-sergey-demo-apps.tk -d www.products-catalog.nilov-sergey-demo-apps.tk                                                                              
Saving debug log to /var/log/letsencrypt/letsencrypt.log                                                                                                                                                               
Plugins selected: Authenticator apache, Installer apache                                                                                                                                                               
Obtaining a new certificate                                                                                                                                                                                            
Performing the following challenges:
http-01 challenge for products-catalog.nilov-sergey-demo-apps.tk
http-01 challenge for www.products-catalog.nilov-sergey-demo-apps.tk
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. www.products-catalog.nilov-sergey-demo-apps.tk (http-01): urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for www.products-catalog.nilov-sergey-demo-apps.tk

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: www.products-catalog.nilov-sergey-demo-apps.tk
   Type:   None
   Detail: DNS problem: NXDOMAIN looking up A for
   www.products-catalog.nilov-sergey-demo-apps.tk

产品-目录- need sergey-demo-apps.tk-这是我在freenom.com上获得的域，搜索后我发现了一个提示，我需要为www子域添加一个记录

我尝试将新记录添加为https://imgur.com/a/ijFxlzN，但尝试将此页面添加为suBmit：

• Error occured: Invalid value in dnsrecord

怎么了？新唱片会不会是我的问题？还是我要换个方向？

在appache中更新的# 2配置是：

 <VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html/lprods/public    
    ServerName products-catalog.nilov-sergey-demo-apps.tk
    ServerAlias products-catalog.nilov-sergey-demo-apps.tk

    <Directory /var/www/html/lprods/public>
      AllowOverride All
      Order Deny,Allow
      Allow from all
      Require all granted
    </Directory>

    Options FollowSymLinks
    DirectoryIndex index.php

    ErrorLog /var/www/html/lprods/storage/logs/error.log
    CustomLog /var/www/html/lprods/storage/logs/access.log combined
</VirtualHost>

在/etc/主机中排队

138.68.107.5  products-catalog.nilov-sergey-demo-apps.tk

我的问题有问题吗？

更新了# 3我做了一些更多的评论，然后发现：

我的服务器的IP是138.68.107.4，在ssh下，我输入操作系统的控制台

ssh root@138.68.107.4

但是，在我的/etc/host文件中，我有下一行指向此服务器上的其他主机：

# 127.0.0.1 localhost
127.0.0.1 localhost.localdomain localhost
138.68.107.4  box.example.com box

# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

138.68.107.4  votes.nilov-sergey-demo-apps.tk
138.68.107.5  products-catalog.nilov-sergey-demo-apps.tk
138.68.107.6  csvp.nilov-sergey-demo-apps.tk
...

我将最后3行修改为：

138.68.107.4  votes.nilov-sergey-demo-apps.tk
138.68.107.4  products-catalog.nilov-sergey-demo-apps.tk
138.68.107.4  csvp.nilov-sergey-demo-apps.tk

但我仍然不确定这个值是否有效，因为我又有了下一个错误：

# sudo certbot --apache -d products-catalog.nilov-sergey-demo-apps.tk -d www.products-catalog.nilov-sergey-demo-apps.tk 
Saving debug log to /var/log/letsencrypt/letsencrypt.log 
Plugins selected: Authenticator apache, Installer apache 
Obtaining a new certificate 
Performing the following challenges: 
http-01 challenge for products-catalog.nilov-sergey-demo-apps.tk 
http-01 challenge for www.products-catalog.nilov-sergey-demo-apps.tk 
Waiting for verification... 
Cleaning up challenges 
Failed authorization procedure. www.products-catalog.nilov-sergey-demo-apps.tk (http-01): urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up 
A for www.products-catalog.nilov-sergey-demo-apps.tk 

IMPORTANT NOTES: 
 - The following errors were reported by the server: 

   Domain: www.products-catalog.nilov-sergey-demo-apps.tk 
   Type:   None 
   Detail: DNS problem: NXDOMAIN looking up A for 
   www.products-catalog.nilov-sergey-demo-apps.tk

这个错误的原因可能是/etc/主机中的IP错误还是其他问题？

谢谢!

Answer 1

域www.products-catalog.nilov-sergey-demo-apps.tk不解析：

https://www.whatsmydns.net/#A/www.products-catalog.nilov-sergey-demo-apps.tk

​

​

所以这不是服务器配置问题，您只需在DNS管理器中添加www.products-catalog子域记录，

或从certbot命令中删除以下内容：-d www.products-catalog.nilov-sergey-demo-apps.tk

Answer 2

certbot抱怨：

DNS problem: NXDOMAIN looking up A for
www.products-catalog.nilov-sergey-demo-apps.tk

( a)本地/etc/hosts文件不是公共DNS区域文件...just添加域名；因为DNS主机头告诉虚拟主机:当使用DNS区域文件时，不必在DNS区域文件中添加它们，就像在localhost.上一样

然后使用certbot命令，而不使用不存在的www虚拟主机：

sudo certbot --apache -d products-catalog.nilov-sergey-demo-apps.tk

或修复了DNS和虚拟主机，以便为www虚拟主机提供服务；然后，它们应该对两者都适用。需要一个A "address“记录；但是正在提供一个CNAME”公共名称“记录。要解决这个问题，您只需将类型从CNAME更改为A，并等待其分发。

你自己看看：非www和www。HTTPS也完全没有回应。

( c)要修复虚拟主机配置，必须添加适当的ServerAlias

ServerName products-catalog.nilov-sergey-demo-apps.tk
ServerAlias www.products-catalog.nilov-sergey-demo-apps.tk

Answer 3

如果您使用certbot运行--manual certonly，然后使用--apache选项运行，它将将证书“重新安装”到您的--apache服务器上。

跑：

sudo certbot --server https://acme-v02.api.letsencrypt.org/directory 
    -d *.domain.com --manual --preferred-challenges dns-01 certonly

然后添加DNS TXT记录，然后单击certbot指令上的“继续”。一旦完成，您就可以运行这样一个简单的--apache install。

sudo certbot --server https://acme-v02.api.letsencrypt.org/directory  
    -d *.domain.com --apache

这将要求重新安装证书，您只需选择它。