Letsencrypt Create a fresh domain gives error on creating Let's encrypt

Hi there,

Yesterday a client bought a new domain and today it was ready to use @ cloudflare. Took a while, slow domain registar, but very cheap, only euro 1,38 for a .nl domain.

Install went fine, get A at ssllabs when testing the domain, but I keep with a question. Can I keep it this way, or should I delete the domain, wait a few days and give it a new try. I don't know how it will react on renewal.

Error is below.

Code (Text):

[Thu Aug 22 23:18:28 UTC 2019] responseHeaders='HTTP/1.1 400 Bad Request
Server: nginx
Content-Type: application/problem+json
Content-Length: 144
Boulder-Requester: 63907569
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0002NWDogESUkxpetpQQgQNdCbbWjjE9bjicvgARiZE8gMA
Expires: Thu, 22 Aug 2019 23:18:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 22 Aug 2019 23:18:28 GMT
Connection: close
^M'
[Thu Aug 22 23:18:28 UTC 2019] code='400'
[Thu Aug 22 23:18:28 UTC 2019] original='{
  "type": "urn:ietf:params:acme:error:malformed",
  "detail": "Unable to update challenge :: authorization must be pending",
  "status": 400
}'
[Thu Aug 22 23:18:28 UTC 2019] response='{
  "type": "urn:ietf:params:acme:error:malformed",
  "detail": "Unable to update challenge :: authorization must be pending",
  "status": 400
}'

---

 

To bad, did not work

Code (Text):

[Sat Aug 24 19:57:21 UTC 2019] responseHeaders='HTTP/1.1 400 Bad Request
Server: nginx
Content-Type: application/problem+json
Content-Length: 144
Boulder-Requester: 63907569
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0001uX9ehDtmPjiRJCiOjgm5uYX6ZXYEYJ3_oMZz-Vd9T_I
Expires: Sat, 24 Aug 2019 19:57:21 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 24 Aug 2019 19:57:21 GMT
Connection: close
^M'
[Sat Aug 24 19:57:21 UTC 2019] code='400'
[Sat Aug 24 19:57:21 UTC 2019] original='{
  "type": "urn:ietf:params:acme:error:malformed",
  "detail": "Unable to update challenge :: authorization must be pending",
  "status": 400
}'
[Sat Aug 24 19:57:21 UTC 2019] response='{
  "type": "urn:ietf:params:acme:error:malformed",
  "detail": "Unable to update challenge :: authorization must be pending",
  "status": 400
}'

And a part of the error

Code (Text):

[Sat Aug 24 20:04:38 UTC 2019] www.xxxx.nl:Verify error:Invalid response from http://www.xxxx.nl/.well-known/acme-challenge/Pul7G5N9AiKS<snpipped>

 

Code (Text):

[URL='https://letsdebug.net/xxxxnl/57648#CloudflareCDN-Warning']CloudflareCDN[/URL]
Warning
The domain XXX.nl is being served through Cloudflare CDN. Any Let's Encrypt certificate installed on the origin server will only encrypt traffic between the server and Cloudflare. It is strongly recommended that the SSL option 'Full SSL (strict)' be enabled.
https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean-

Cloudflare was on FULL SSL.

Install was done with option 22 and option 4 issue live cert with HTTPS default.

Reissued as you told,

Code (Text):

./acmetool.sh reissue-only domain.com live

SSL Labs gives A, my other domains normally give A+
A part of the error log shows this and the pending issue.

Code (Text):

www.xxxx.nl:Verify error:Invalid response from http://www.xxxx.nl/.well-known/acme-challenge/Pul7G5N9AiKS<snpipped>

Will get a test domain @ dot.tk for testing. I Guess that the problem is with domain register. Yesterday I did many domains with the same install options (migrating a server again) and did not have any issues.

FYI: Multisite WP goes as planned, some little issues, but will resolve these.

 

Guess that's a little present from that "cheap" domain register. It gives 400 "Pending Authorization" but it has been registered a week ago and transfer the DNS to Cloudflare ASAP.

Will delete it, first do a

Code (Text):

DROP DATABASE dbname;
DELETE FROM mysql.user WHERE user = 'username';

Afterwards, run the ./wp_uninstall for the domains to keep all thing nice and clean.

Don't want any mess and left overs on my servers. Tried another domain, registered @ dot.tk they are free and did not give any problem.

 

Update:

Cheap domain register told "It's Cloudflare, MIM attack, server backend and some other strange things"

Finally, today resolved, code to move to other domains register (also difficult and some issues, support tickets) but all fine. No more problems, A+ SSL as usual.

Lesson learned: Everything has a price tag. (except CMM, see My site running Centmin mod are just a airplane. They fly )

 

Yep, bought a com.br today and no problem at all with Registro.br