Check that your DNS and NGINX configuration is correct

[lps]

My YunoHost server

Hardware: Old laptop or computer
YunoHost version: started when using 3.6.4.6 but since updated to 3.7.0.12 problem persists.
I have access to my server: Through webadmin.

Are you in a special context or did you perform some particular tweaking on your YunoHost instance?: no

Description of my issue

My Yunohost is no longer accessible outside of my network (but browsers and internet are).

When I use the YunoHost port tester all appear red, however when I check my router and firewall settings the ports are open.

I haven’t figured this out and my instance has been in limbo since it’s a non-critical, family/testing at this point only. However recently I started receiving emails about the "Certificate renewing attempt for my.domain failed!"

Which gave me this clue

"YunohostError: It seems the domain my.domain cannot be accessed through HTTP. Check that your DNS and NGINX configuration is correct"

How do I check this?

Thanks in advance:)

[Aleks]

Basically make sure that you followed https://yunohost.org/isp_box_config (though you seem to say that you already configured port stuff …)

Also check that you registered a DNS record on your DNS provider ?

Otherwise, this warning could be a false-negative and you can try to run from the command line "sudo yunohost domain cert-install yourdomain.tld --no-checks"

[lps]

I’m confused since this was working using the YunoHost provided subdomain and then one day just stopped, so I don’t thing DNS is an issue if I’m using the Subdomain is it?

I’ll try the command to see what I come up with and look at the isp_box_config. I checked my ports using https://ports.yunohost.org/

And again, this was working until a few weeks ago.

Thanks for your help:)

[Aleks]

Hmyea, i’m just throwing pointers and just making sure that you did all the usual checks …

Anyway, just try to 'sudo yunohost domain cert-install yourdomain.tld --no-checks' and let’s see from what it says …

[lps]

Okay, I tried that and it prompted me to “–force”

Error: The certificate for domain “my.domain”
is not self-signed. Are you sure you want to replace it? (Use ‘–force’ to do so.)

However it didn’t recognize the “–force” command:(

bash: --force: command not found

[Aleks]

Hokay … but is the issue really that your certificate is invalid ? You can check this using :

yunohost domain cert-status your.domain.tld

[lps]

I don’t think so, I’m just grasping at anything as I can’t figure out what happened. This occurred before the expiry of certificates.

I’ve been considering just doing a fresh install on another drive and hoping to use the same subdomain, and restoring with a YunoHost backup. Is this possible?

[Aleks]

Just … give the result of the command (ideally redacting private info like domain name if you care about privacy)

@lps

I’ve been considering just doing a fresh install

Please no, it’s like moving to a new flat because your microwave doesn’t work … Given the nature of the issue it’s not likely to solve anything, you’ll just waste your time … We just need to precisely diagnose the issue and apply the appropriate fix.

[ljf]

I recommand you to follow @Aleks suggestion to check your certificate.

If the command returns that your certificate is a valide Let’sEncrypt certificate, may be your isp share now your IP address with other customer OR change the settings of your box.
If your IP is shared you could need to ask your ISP for a “full stack ip”.

[lps]

That command returned

certificates:
my.domain:
CA_type: Let’s Encrypt
summary: CRITICAL
validity: -12

[Aleks]

@Aleks

Anyway, just try to 'sudo yunohost domain cert-install yourdomain.tld --no-checks' and let’s see from what it says …

@lps

Error: The certificate for domain “my.domain”
is not self-signed. Are you sure you want to replace it? (Use ‘–force’ to do so.)

Alright, my bad, now I realize that my suggestion was wrong. What I meant to say was :

sudo yunohost domain cert-renew yourdomain.tld --no-checks

(so cert-renew instead of cert-install)

[lps]

It returned this, I’m including all without my domain of course

Info: Now attempting renewing of certificate for domain my.domain !
Info: Parsing account key…
Info: Parsing CSR…
Info: Found domains: my.domain
Info: Getting directory…
Info: Directory found!
Info: Registering account…
Info: Already registered!
Info: Creating new order…
Info: Order created!
Info: Verifying my.domain…
Error: Challenge did not pass for my.domain: {u’status’: u’invalid’, u’challenges’: [{u’status’: u’invalid’, u’validationRecord’: [{u’url’: u’http://my.domain/.well-known/acme-challenge/TirihEnGdMQs5SXJZEcRYGGfG9AvIdNxhbt860pD5q0’, u’hostname’: u’my.domain’, u’addressUsed’: u’69.41.198.18’, u’port’: u’80’, u’addressesResolved’: [u’69.41.198.18’]}], u’url’: u’https://acme-v02.api.letsencrypt.org/acme/chall-v3/3683059310/J1TqIw’, u’token’: u’TirihEnGdMQs5SXJZEcRYGGfG9AvIdNxhbt860pD5q0’, u’error’: {u’status’: 400, u’type’: u’urn:ietf:params:acme:error:connection’, u’detail’: u’Fetching http://my.domain/.well-known/acme-challenge/TirihEnGdMQs5SXJZEcRYGGfG9AvIdNxhbt860pD5q0: Connection refused’}, u’type’: u’http-01’}], u’identifier’: {u’type’: u’dns’, u’value’: u’my.domain’}, u’expires’: u’2020-04-07T23:42:29Z’}
Warning: Debug information:

• domain ip from DNS 69.41.198.18
• domain ip from local DNS 69.41.198.18
• public ip of the server 69.41.198.18

Error: Certificate renewing for my.domain failed !
Info: The operation ‘Renew ‘my.domain’ Let’s Encrypt certificate’ could not be completed. Please share the full log of this operation using the command ‘yunohost log display 20200331-234226-letsencrypt_cert_renew-my.domain --share’ to get help
Error: Traceback (most recent call last):
File “/usr/lib/moulinette/yunohost/certificate.py”, line 384, in certificate_renew
_fetch_and_enable_new_certificate(domain, staging, no_checks=no_checks)
File “/usr/lib/moulinette/yunohost/certificate.py”, line 577, in _fetch_and_enable_new_certificate
raise YunohostError(‘certmanager_cert_signing_failed’)
YunohostError: Could not sign the new certificate

Error: Could not sign the new certificate

[lps]

FYI I did some more searching and verified my NGINX configuration with this command and it seems fine

sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

[Aleks]

Alright so i confirm that I also cannot access your ip over http/https, so that definitely looks like an issue about port forwarding … I understand that it was working a few days or weeks ago and that you probably dind’t touch anything, but you have to forget about this myth that “computers things work forever”. In reality, they do have many stupid reasons to spontaneously break from one day to the next… (Fortunately we will have regular automatic diagnosis shipped in YunoHost 3.8 to help make it easier and faster to spot this and pinpoint the actual issue…)

Anyway, I can just advise you to carefully read https://yunohost.org/isp_box_config and make sure that your port forwarding configuration is correct on your router / internet box interface …

If that still isnt the issue, then I do agree with ljf about investigating the fact that your ISP might have decided that you can’t control port 80/443 anymore and/or maybe you now have an IP shared with other customer. But first let’s do the usual check on your router interface…

[lps]

I’ve gone through the docs in the first place but will go over them again. I really hope I don’t need to deal with my ISP about this, that’ll be a headache.

Unrelated to this but I thought I’d ask anyway. Since I upgraded to Nextcloud 18 it went directly to Maintenance Mode. How do I get out of it? It’s been over a day.

[Aleks]

@lps

Unrelated to this but I thought I’d ask anyway. Since I upgraded to Nextcloud 18 it went directly to Maintenance Mode. How do I get out of it? It’s been over a day.

sudo -u nextcloud php7.3 occ maintenance:mode --off

[lps]

Is it possible that all my ports are closed if it was only my ISP?

[Aleks]

Yes

On the other hand, I can tell that ports.yunohost.org is not always reliable … But if you have a linux machine that is preferrably not on the same local network, you can make sure of this by running nc -w 3 your.ip 22 (for example to check port 22)

[lps]

I’m not sure I understand the command
is nc for nextcloud?
“your.ip” is literally that or it’s meant to be replaced as my actual ip address?

When i run it on the same local network it gave me this:

nc: getaddrinfo for host “your.ip” port 22: Name or service not known

[lps]

For anyone following this thread I wanted to say I resolved my issue and @Aleks was correct. It had to do with my port forwarding. I discovered that the automatically assigned IP address for my device/server had changed from what I had in my “Virtual Servers/Port Forwarding” dialogue on my router.

For example I had forwarded the ports for “192.168.0.108” which my machine had automatically been assigned and after a power outage the router simply assigned another number “192.168.0.142” but I didn’t change me port forwarding rules.

Now I’m off to read the router docs on how to hold a specific IP address so this doesn’t happen again.

Thanks for all your help:)