ssl - 如何使用 certbot 修复错误设置 SSL？

Question

我尝试使用 Kubuntu 18 在 Digital Ocean 下为我的 php/laravel 应用程序设置 ssl如本文所述 https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-18-04

但我在尝试使用 certbot 获取免费 SSL 证书时遇到错误:

# sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
Apache Full                ALLOW       Anywhere                  
443                        ALLOW       Anywhere                  
80                         ALLOW       Anywhere                  
22/tcp                     ALLOW       Anywhere                                                                                                                                                                        
Apache Full (v6)           ALLOW       Anywhere (v6)                                                                                                                                                                   
443 (v6)                   ALLOW       Anywhere (v6)                                                                                                                                                                   
80 (v6)                    ALLOW       Anywhere (v6)                                                                                                                                                                   
22/tcp (v6)                ALLOW       Anywhere (v6)                                                                                                                                                                   

# sudo certbot --apache -d products-catalog.nilov-sergey-demo-apps.tk -d www.products-catalog.nilov-sergey-demo-apps.tk                                                                              
Saving debug log to /var/log/letsencrypt/letsencrypt.log                                                                                                                                                               
Plugins selected: Authenticator apache, Installer apache                                                                                                                                                               
Obtaining a new certificate                                                                                                                                                                                            
Performing the following challenges:
http-01 challenge for products-catalog.nilov-sergey-demo-apps.tk
http-01 challenge for www.products-catalog.nilov-sergey-demo-apps.tk
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. www.products-catalog.nilov-sergey-demo-apps.tk (http-01): urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for www.products-catalog.nilov-sergey-demo-apps.tk

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: www.products-catalog.nilov-sergey-demo-apps.tk
   Type:   None
   Detail: DNS problem: NXDOMAIN looking up A for
   www.products-catalog.nilov-sergey-demo-apps.tk

products-catalog.nilov-sergey-demo-apps.tk - 这是我在 freenom.com 上的域名，搜索后我发现了一个提示我需要为 www 子域添加 A 记录

我尝试将新记录添加为 https://imgur.com/a/ijFxlzN但是尝试提交我得到的这个页面:

• Error occured: Invalid value in dnsrecord

怎么了？新记录可以成为我的问题吗？或者我需要以其他方式移动？

更新#2Appache 中的配置是:

 <VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html/lprods/public    
    ServerName products-catalog.nilov-sergey-demo-apps.tk
    ServerAlias products-catalog.nilov-sergey-demo-apps.tk

    <Directory /var/www/html/lprods/public>
      AllowOverride All
      Order Deny,Allow
      Allow from all
      Require all granted
    </Directory>

    Options FollowSymLinks
    DirectoryIndex index.php

    ErrorLog /var/www/html/lprods/storage/logs/error.log
    CustomLog /var/www/html/lprods/storage/logs/access.log combined
</VirtualHost>

在/etc/hosts 中的行

138.68.107.5  products-catalog.nilov-sergey-demo-apps.tk

会不会是我的问题？

更新#3我进行了更多审查并发现了下一个:

我服务器的 IP 是 138.68.107.4 并且在 ssh 下我进入操作系统的控制台

ssh root@138.68.107.4

但在我的/etc/hosts 文件中，我有下一行指向此服务器上的一些其他主机:

# 127.0.0.1 localhost
127.0.0.1 localhost.localdomain localhost
138.68.107.4  box.example.com box

# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

138.68.107.4  votes.nilov-sergey-demo-apps.tk
138.68.107.5  products-catalog.nilov-sergey-demo-apps.tk
138.68.107.6  csvp.nilov-sergey-demo-apps.tk
...

我将最后 3 行修改为:

138.68.107.4  votes.nilov-sergey-demo-apps.tk
138.68.107.4  products-catalog.nilov-sergey-demo-apps.tk
138.68.107.4  csvp.nilov-sergey-demo-apps.tk

但我仍然不确定这是有效值，因为我又遇到下一个错误:

# sudo certbot --apache -d products-catalog.nilov-sergey-demo-apps.tk -d www.products-catalog.nilov-sergey-demo-apps.tk 
Saving debug log to /var/log/letsencrypt/letsencrypt.log 
Plugins selected: Authenticator apache, Installer apache 
Obtaining a new certificate 
Performing the following challenges: 
http-01 challenge for products-catalog.nilov-sergey-demo-apps.tk 
http-01 challenge for www.products-catalog.nilov-sergey-demo-apps.tk 
Waiting for verification... 
Cleaning up challenges 
Failed authorization procedure. www.products-catalog.nilov-sergey-demo-apps.tk (http-01): urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up 
A for www.products-catalog.nilov-sergey-demo-apps.tk 

IMPORTANT NOTES: 
 - The following errors were reported by the server: 

   Domain: www.products-catalog.nilov-sergey-demo-apps.tk 
   Type:   None 
   Detail: DNS problem: NXDOMAIN looking up A for 
   www.products-catalog.nilov-sergey-demo-apps.tk

此错误的原因可能是/etc/hosts 中的 IP 错误或其他问题吗？

谢谢!

Answer 1

域 www.products-catalog.nilov-sergey-demo-apps.tk 未解析:

https://www.whatsmydns.net/#A/www.products-catalog.nilov-sergey-demo-apps.tk

所以这不是服务器配置问题，您只需在您的 DNS 管理器中添加 www.products-catalog 子域记录，

或从 certbot 命令中删除:-d www.products-catalog.nilov-sergey-demo-apps.tk