Question Let's Encrypt fail over IPv6

[Creativados]

Server operating system version

Debian 10.13

Plesk version and microupdate number

Versión 18.0.47

Sorry my english, use translator.

I'm having trouble getting ssl certificates with Let's Encrypt .

When I try to get the certificate it returns this error



when I try to pass the debug it tells me this

Test result for aceval.eu: Error

2 unique issue(s) detected (AAAANotWorking, IssueFromLetsEncrypt)

letsdebug.net

I think I have the server properly configured with IPv6, but I don't know what to think


.\curl.exe -6 aceval.eu

return this

curl: (7) Couldn't connect to server


Any ideas or help.

Thank you

 

[IgorG]

aceval.eu has an AAAA (IPv6) record (2001:41d0:203:4b76

But I see:

# host aceval.eu
aceval.eu has address 51.83.2.118
aceval.eu has IPv6 address 2001:41d0:701:1000::14cb

Are sure that AAAA record is correctly configured in DNS settings?

 

[Creativados]

Where does that information appear?

my DNS records for AAAA are:

	ns2.aceval.eu.		AAAA	2001:41d0:203:4b76::
	aceval.eu.		AAAA	2001:41d0:203:4b76::
	ipv6.aceval.eu.		AAAA	2001:41d0:203:4b76::
	ns1.aceval.eu.		AAAA	2001:41d0:203:4b76::
	webmail.aceval.eu.		AAAA	2001:41d0:203:4b76::
	mail.aceval.eu.		AAAA	2001:41d0:203:4b76::

 

[Creativados]

My result this command

# host aceval.eu
aceval.eu has address 51.83.2.118
aceval.eu has IPv6 address 2001:41d0:203:4b76::
aceval.eu mail is handled by 10 aceval.eu.

 

[IgorG]

My result this command

# host aceval.eu
aceval.eu has address 51.83.2.118
aceval.eu has IPv6 address 2001:41d0:203:4b76::
aceval.eu mail is handled by 10 aceval.eu.

Yes, I see the same now.
Is the problem still actual?

 

[Creativados]

Yes, I see the same now.
Is the problem still actual?

Yes

 

[IgorG]

Do you have an enabled firewall? Try to disable it.

 

[Creativados]

Do you have an enabled firewall? Try to disable it.

I have uninstalled the firewall and the problem persists

 

[Nik G]

@Creativados ,
please be sure that your site available via IPv6.
LE has a priority: it uses IPv6 in case AAAA record exists. so it looks like some misconfiguration on your side.

 

[Creativados]

@Creativados ,
please be sure that your site available via IPv6.
LE has a priority: it uses IPv6 in case AAAA record exists. so it looks like some misconfiguration on your side.

How do I validate the availability of the site through IPv6?

 

[ChristophRo]

You have a firewall and dns (your two nameservers have different config for this domain) and/or ip configuration problem
I randomly get "2001:41d0:701:1000::14cb" or "2001:41d0:203:4b76::" as the AAAA record for aceval.eu, depending on the nameserver I ask.

And on both IPv6 addresses your webserver is not reachable... (IPv4 is OK)

 

[Creativados]

You have a firewall and dns (your two nameservers have different config for this domain) and/or ip configuration problem
I randomly get "2001:41d0:701:1000::14cb" or "2001:41d0:203:4b76::" as the AAAA record for aceval.eu, depending on the nameserver I ask.

And on both IPv6 addresses your webserver is not reachable... (IPv4 is OK)

View attachment 21853

2001:41d0:701:1000::14cb
It was a server configuration error, but I don't know how to get rid of that IP trace

with what NS do you get that name resolution?

 

[Maarten]

Check the firewall and nameserver on 2001:41d0:203:4b76::, UDP traffic on port 53 is blocked:

Nameserver Check - DENIC eG

nast.denic.de

If you run firewalld, check it with this command:

# firewall-cmd --permanent --list-ports

 

[ChristophRo]

directly from your nameservers (hosting.servidor-nombres.com & web2.servidor-nombres.com) of this domain

 

[Creativados]

directly from your nameservers (hosting.servidor-nombres.com & web2.servidor-nombres.com) of this domain

View attachment 21855

And how do I force that change?

I think I have it all set

 

[Creativados]

directly from your nameservers (hosting.servidor-nombres.com & web2.servidor-nombres.com) of this domain

View attachment 21855

hosting.servidor-nombres.com is my server and web2.servidor-nombres.com is sdns2.ovh.net from OVH

 

[Creativados]

Other domain, afartis.com

but not resolve
# dig +short aaaa afartis.com @sdns2.ovh.net

Ans ys resolve my server
# dig +short aaaa afartis.com @hosting.servidor-nombres.com
2001:41d0:203:4b76::


I'm lost

 

[Creativados]

directly from your nameservers (hosting.servidor-nombres.com & web2.servidor-nombres.com) of this domain

View attachment 21855

# dig +short aaaa aceval.eu @web2.servidor-nombres.com
2001:41d0:203:4b76::

But nothing changes