Letsencrypt could not access the challenge file

strarsis · October 26, 2023, 1:00pm

OK, no AAAA record rules out the classic IPv6 over IPv4 address for validation with Let’s Encrypt issue.

Note that this error message comes from Trellis, that does a check on its own, before actually making Let’s Encrypt validate the domain (this can save quotas).
So when your workstation/CI server that runs Ansible (applies the Trellis playbook) is not able to resolve the domain or fetch the file (fail2ban comes to mind), this pre-check will fail, even when Let’s Encrypt may actually be able to validate:

github.com

roots/trellis/blob/02cfc360911c545611d624c01ce4d97f197c6d00/roles/letsencrypt/tasks/nginx.yml#L68


      
            register: letsencrypt_test_challenges
            ignore_errors: true
            when: site_uses_letsencrypt
            loop: "{{ wordpress_sites | dict2items }}"
            loop_control:
              label: "{{ item.key }}"
          
          - name: Notify of challenge failures
            fail:
              msg: >
                Could not access the challenge file for the hosts/domains: {{ item.failed_hosts | join(', ') }}.
                Let's Encrypt requires every domain/host be publicly accessible.
                Make sure that a valid DNS record exists for {{ item.failed_hosts | join(', ') }} and that they point to this server's IP.
                If you don't want these domains in your SSL certificate, then remove them from `site_hosts`.
                See https://roots.io/trellis/docs/ssl for more details.
            when: item is not skipped and item is failed
            loop: "{{ letsencrypt_test_challenges.results }}"

So check on your workstation/CI server on which Ansible is used to apply the Trellis playbook, whether you can resolve that domain and whether you can request files from that site. It may very well be that you added test records to /etc/hosts or your local DNS server for example, that interferes with fetching the test file from the site by your own workstation/CI server.