关于在 AWS ubuntu 服务器中为部署的 Flask Web 创建 Let's Encrypt 的错误答案

【问题标题】：Error about created Let's Encrypt in AWS ubuntu server for flask web deployed关于在 AWS ubuntu 服务器中为部署的 Flask Web 创建 Let's Encrypt 的错误
【发布时间】：2018-01-28 10:27:43
【问题描述】：

我从 godaddy.com 申请了一个域（例如 example.com）。我运行命令创建 Let's Encrypt，但出现错误。

(venv) ubuntu2@212.../microblog$ wget https://dl.eff.org/certbot-auto
(venv) ubuntu2@212.../microblog$ chmod a+x ./certbot-auto
(venv) ubuntu2@212...~/microblog$ ../certbot-auto certonly --webroot -w /home/ubuntu2/microblog -d example.com --email example@aa.com

但是有如下错误：

Requesting to rerun ./certbot-auto with root privileges...
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for example.com
Using the webroot path /home/ubuntu2/microblog for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. example.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://example.com/.well-known/acme-challenge/V9B6Dz7gPx7RhyLmpYIlwYUhs1d4rWJF2HlpJbNbjbY: "<!DOCTYPE html><body style="padding:0; margin:0;"><html><body><iframe src="http://mcc.godaddy.com/park/MaO2MaO2LKWaYaOvrt==/fe/M"

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: example.com
   Type:   unauthorized
   Detail: Invalid response from
   http://example.com/.well-known/acme-challenge/V9B6Dz7gPx7RhyLmpYIlwYUhs1d4rWJF2HlpJbNbjbY:
   "<!DOCTYPE html><body style="padding:0;
   margin:0;"><html><body><iframe
   src="http://mcc.godaddy.com/park/MaO2MaO2LKWaYaOvrt==/fe/M"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

和/etc/nginx/sites-enabled/microblog如下

server {
# listen on port 80 (http)
listen 80;
server_name example.com;
location / {
# redirect any requests to the same URL but on https
return 301 https://$host$request_uri;
}
}
server {
# listen on port 443 (https)
listen 443 ssl;
server_name example.com;
# location of the self-signed SSL certificate
#ssl_certificate /home/ubuntu/microblog2/certs/cert.pem;
#ssl_certificate_key /home/ubuntu/microblog2/certs/key.pem;
# write access and error logs to /var/log
access_log /var/log/microblog_access.log;
error_log /var/log/microblog_error.log;
location / {
# forward application requests to the gunicorn server
proxy_pass http://127.0.0.1:8000;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /static {
# handle static files directly, without forwarding to the application
alias /home/ubuntu2/microblog/static;
expires 30d;
}
location ^~ /.well-known/acme-challenge/ {
default_type "text/plain";
root /home/ubuntu2/microblog/;
}
location = /.well-known/acme-challenge/ {
return 404;
}
}

我不知道哪里错了，你能帮我解决这个问题吗，谢谢！

【问题讨论】：

标签： python amazon-web-services nginx lets-encrypt

【解决方案1】：

从错误消息中可以看出，example.com 还没有指向你的 Nginx 服务器地址。请注意错误消息中的这一点：

   Detail: Invalid response from
   http://example.com/.well-known/acme-challenge/V9B6Dz7gPx7RhyLmpYIlwYUhs1d4rWJF2HlpJbNbjbY:
   "<!DOCTYPE html><body style="padding:0;
   margin:0;"><html><body><iframe
   src="http://mcc.godaddy.com/park/MaO2MaO2LKWaYaOvrt==/fe/M"  <<<<<<<<<<<<<<<

godaddy.com/park 部分可能表示该域已停放在 GoDaddy，并且尚未到达您的服务器。

提供的错误信息也有助于理解问题：

  To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

检查 DNS 设置，然后重试。另请注意 - 它可能与 DNS 传播时间有关，DNS 更改是最近的。在这种情况下，您需要等待更改传播，最长 24 小时。

Ps 您可以通过在命令行上运行curl example.com 来确认。确保它返回服务器的主页。当它出现时，再试一次。

【讨论】：

嗨，感谢您的 cmets，当我 curl example.com 时，结果如下： 301 Moved Permanently
301 永久移动

nginx/1.10.3 (Ubuntu)
您好，我已经更新了 Godaddy 站点中的域信息。跟不上一句：DNS传播时间相关
摆脱 301 重定向到 https。在正确配置 SSL 之前，您无法重定向到 https。

301 永久移动