[rockachopa] Run SSL provisioning after DNS is pointed #689
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: Rockachopa/Timmy-time-dashboard#689
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Depends On: #688 (DNS must be pointed first)
After the DNS A records are changed and propagating (verify with
dig),run the SSL provisioning script:
Or tell Timmy "DNS is pointed, provision SSL" and he'll handle it.
What This Does
If Some Domains Aren't Ready
If only some domains are pointed, certbot will fail for the whole batch.
In that case, run certbot manually for just the ready domains:
Verification
After SSL is provisioned:
echo | openssl s_client -connect alexanderwhitestone.com:443 2>/dev/null | openssl x509 -datesapayne@MM Timmy-time-dashboard % ssh root@143.198.27.163 'bash -s' < ~/worktrees/the-matrix/provision-ssl.sh
=== SSL Certificate Provisioning ===
Domains: alexanderwhitestone.com www.alexanderwhitestone.com alexanderwhitestone.ai www.alexanderwhitestone.ai alexanderwhitestone.org www.alexanderwhitestone.org alexanderwhitestone.net www.alexanderwhitestone.net
Running certbot...
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Account registered.
Requesting a certificate for alexanderwhitestone.com and 7 more domains
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: alexanderwhitestone.com
Type: connection
Detail: 161.35.250.72: Fetching http://alexanderwhitestone.com/.well-known/acme-challenge/ETAcAMy5othfFvyO-OgKtpghAT4B3pDldcFoITQokgE: Connection refused
Domain: www.alexanderwhitestone.com
Type: connection
Detail: 161.35.250.72: Fetching http://www.alexanderwhitestone.com/.well-known/acme-challenge/8E0g1oKaSD2DXj4p7TthbDFDgbQ0nwE6aHrF1xWSh-w: Connection refused
Domain: www.alexanderwhitestone.ai
Type: dns
Detail: DNS problem: NXDOMAIN looking up A for www.alexanderwhitestone.ai - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for www.alexanderwhitestone.ai - check that a DNS record exists for this domain
Domain: alexanderwhitestone.net
Type: unauthorized
Detail: The key authorization file from the server did not match this challenge. Expected "4yMFVbage1PHWZrnCm7DJrmIeml1doOk5KCWn0VJi-w.tsoBcpmGfhjmomLtqw7CyHs9kOrSqYyY3fLyGlXjJrE" (got "<html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>")
Domain: alexanderwhitestone.org
Type: unauthorized
Detail: The key authorization file from the server did not match this challenge. Expected "nF-EH4BcRTnPkiYxedZNlS9VP308iPBtwIR0MMUiN0M.tsoBcpmGfhjmomLtqw7CyHs9kOrSqYyY3fLyGlXjJrE" (got "<html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>")
Domain: www.alexanderwhitestone.net
Type: unauthorized
Detail: The key authorization file from the server did not match this challenge. Expected "Cnh5EChKLUl3dl6GNF2wFEDPms5N5t8Xg4pCES5TM-0.tsoBcpmGfhjmomLtqw7CyHs9kOrSqYyY3fLyGlXjJrE" (got "<html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>")
Domain: www.alexanderwhitestone.org
Type: unauthorized
Detail: The key authorization file from the server did not match this challenge. Expected "wzs-mxmvPhxWOxqHlFWQq4_Ya4PAhmNiTG1g3yxp4pM.tsoBcpmGfhjmomLtqw7CyHs9kOrSqYyY3fLyGlXjJrE" (got "<html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>")
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
apayne@MM Timmy-time-dashboard % ssh root@143.198.27.163
Welcome to Ubuntu 24.04.3 LTS (GNU/Linux 6.8.0-106-generic x86_64)
System information as of Sun Mar 22 20:25:54 UTC 2026
System load: 0.38 Processes: 156
Usage of /: 16.5% of 76.45GB Users logged in: 1
Memory usage: 30% IPv4 address for eth0: 143.198.27.163
Swap usage: 0% IPv4 address for eth0: 10.17.0.5
Expanded Security Maintenance for Applications is not enabled.
66 updates can be applied immediately.
To see these additional updates run: apt list --upgradable
12 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm
Last login: Sun Mar 22 20:23:51 2026 from 162.243.188.66
root@Hermes:~# certbot --nginx -d alexanderwhitestone.com -d www.alexanderwhitestone.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for alexanderwhitestone.com and www.alexanderwhitestone.com
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: alexanderwhitestone.com
Type: connection
Detail: 161.35.250.72: Fetching http://alexanderwhitestone.com/.well-known/acme-challenge/XC0ZtR9oLR1ixRhqeyS_RGjWMrVhjZuiwrEKCmjJYHA: Connection refused
Domain: www.alexanderwhitestone.com
Type: connection
Detail: 161.35.250.72: Fetching http://www.alexanderwhitestone.com/.well-known/acme-challenge/jC6FVeSWIXhhCBF6A-CdSXMYNMT5XcpAYQVbkN3a3uc: Connection refused
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
root@Hermes:~#
What do I need to do?
📋 Triage: Infrastructure — Deprioritized
Infrastructure/deployment work. Keep open, do as needed, but not blocking the harness.
Ref: #1076