LetsEncrypt not working on fresh install

Hi,
I am following this manual https://www.howtoforge.com/tutorial/perfect-server-ubuntu-with-nginx-and-ispconfig-3/2/#comments to install new web server. Everytinhg else working fine, except of Let's Encrypt. It is shown checkbox in ISPConfig, but after Enabling it for any site, it does - nothing. Also checkbox does not stay checked.
Is there anytihng else to be done with Ubuntu 16.04 + NGINX except of this?

Code:

apt-get -y install letsencrypt

In /var/log/letsencrypt/letsencrypt.log I find only this:

Code:

2017-06-26 01:00:08,715:DEBUG:letsencrypt.cli:Root logging level set at 30
2017-06-26 01:00:08,716:INFO:letsencrypt.cli:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2017-06-26 01:00:08,717:DEBUG:letsencrypt.cli:letsencrypt version: 0.4.1
2017-06-26 01:00:08,717:DEBUG:letsencrypt.cli:Arguments: ['-n']
2017-06-26 01:00:08,717:DEBUG:letsencrypt.cli:Discovered plugins: PluginsRegistry(PluginEntryPoint#webroot,PluginEntryPoint#null,PluginEntryPoint#manual,PluginEntryPoint#standalone)
2017-06-26 01:00:08,717:DEBUG:letsencrypt.cli:no renewal failures

 

Hmmm...well, DNS for website is definitelly pointing to this server. Server is behind NAT, ports 80 and 443 are NAT-ed to proper LAN IP and website is publically available via both HTTP and HTTPS protocols.
Maybe the culpit would be OUTBOUND NAT (masquerade), because from LAN to WAN by default firewall is NOT using the same WAN IP as for incoming NAT. Outgoing by default goes through firewall's WAN IP say x.x.x.131, while website incoming NAT is using x.x.x.133 IP for 80 and 443. Might that be a problem?
So to pair WAN IP addresses I would need to know which destination port does Let's Encrypt use to comunicate outbound, so I can create proper outhoing NAT rule.

***EDIT***
I added outbound NAT rule to use the same outbound public IP as for inbound NAT, but still letsencrypt does nothing via ISPConfig.

 

Thanx, Till, but I've tried disabling Let's Encrypt check too, but at no avail. The checkbox for Let's Encrypt under Web Site now stays CHECKED, but SSL is still not working.
BTW...the https://www.problemsite.com does NOT point to the same page as http://www.problemsite.com, but rather to "default" HTTPS site.

 

Just updated from 3.0.X to 3.1.4
There's no "LetsEncrypt" at System -> Server Config
It's visible on sites -> website -> domain. But when enabling it, it gets disabled afterwards (checkmark). Suggestions?

 

I did the following:
apt-get install software-properties-common
add-apt-repository ppa:certbot/certbot
apt-get update
apt-get install python-certbot-apache
certbot --apache certonly
Applied HTTPS for 1 website only

Still no LetsEncrypt under System -> Server config

 

Till, thank you for following up.
Well, I read a lot of your and other threads, so I did not install ANYTHING else regarding Let's Encrypt, except of:

Code:

apt-get install letsencypt

on fresh install. This is actually the 3rd installation of Ubuntu 16.04 + Nginx + MariaDB as per tutorial from initial link. What was different in all my installs is that I DID NOT install Dovecot, Mailman and other mail-related features. Everything else is there. But NONE of those 3 fresh installs is working in regards to LetsEncrypt?!
/etc/letsencrypt is empty. Is this OK?

...but WAIT, something happened BY ITSELF today! Here's the LOG:
/var/log/letsnecrypt/letsencrypt.log growed significantly and /etc/letsencrypt is not empty anymore!

Code:

2017-06-26 08:59:11,888:DEBUG:acme.client:Received response <Response [200]> (headers: {'Content-Length': '1174', 'Expires': 'Mon, 26 Jun 2017 08:59:11 GMT', 'Boulder-Request-Id': 'NIE3-Gyfy6092QCO9Qi80nZxVSYS16jR4ZjD9hT-yqc', 'Strict-Transport-Security': 'max-age=604800', 'Server': 'nginx', 'Connection': 'keep-alive', 'Pragma': 'no-cache', 'Cache-Control': 'max-age=0, no-cache, no-store', 'Date': 'Mon, 26 Jun 2017 08:59:11 GMT', 'X-Frame-Options': 'DENY', 'Content-Type': 'application/pkix-cert', 'Replay-Nonce': 'OuYJeOxetvz46zc54z54ctG9SSPZ2wkwBN9tSf2o'}): '0\x82............\n\x13\rLet\'s Encrypt1#0!\x06\x03U\x04\x03\x13\x1aLet\'s Encrypt Authority X30\x82\x01"0\r\x0............\x01\x86&http://isrg.trustid.ocsp.identrust.com0;\x06\x08+\x06\x01\x05\x05\x070\x02\x86/http://apps.identrust.com/roots/dstrootcax3.p7c0\x1f\x06\x03U\x1d#\x04\x180...........2\x01\x16"http://cps.root-x1.letsencrypt.org0<\x06\x03U\..........\xa0/\xa0-\x86+http://crl.identrust.com/DSTROOTCAX3CRL.crl0\x1d\x06\x0....... .......c34[\xb4B'
2017-06-26 08:59:11,899:DEBUG:letsencrypt.storage:Creating directory /etc/letsencrypt/archive.
2017-06-26 08:59:11,899:DEBUG:letsencrypt.storage:Creating directory /etc/letsencrypt/live.
2017-06-26 08:59:11,899:DEBUG:letsencrypt.storage:Archive directory /etc/letsencrypt/archive/domain.com and live directory /etc/letsencrypt/live/domain.com created.
2017-06-26 08:59:11,899:DEBUG:letsencrypt.storage:Writing certificate to /etc/letsencrypt/live/domain.com/cert.pem.
2017-06-26 08:59:11,899:DEBUG:letsencrypt.storage:Writing private key to /etc/letsencrypt/live/domain.com/privkey.pem.
2017-06-26 08:59:11,899:DEBUG:letsencrypt.storage:Writing chain to /etc/letsencrypt/live/domain.com/chain.pem.
2017-06-26 08:59:11,899:DEBUG:letsencrypt.storage:Writing full chain to /etc/letsencrypt/live/domain.com/fullchain.pem.
2017-06-26 08:59:11,899:DEBUG:letsencrypt.storage:Writing new config /etc/letsencrypt/renewal/domain.com.conf.
2017-06-26 08:59:11,901:INFO:letsencrypt.reporter:Reporting to user: Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/domain.com/fullchain.pem. Your cert will expire on 2017-09-24. To obtain a new version of the certificate in the future, simply run Let's Encrypt again.
2017-06-26 08:59:11,901:INFO:letsencrypt.reporter:Reporting to user: If you like Let's Encrypt, please consider supporting our work by:

Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
Donating to EFF:                    https://eff.org/donate-le

Now it's getting weird:
- Certificate obviously did get created somehow....maybe by itself, cron?
- Now when I do under Web Site --> SSL = OFF, Letsencrypt=OFF, then once again both to ON... now HTTPS is working!
- but under Web Site --> Letsencrypt checkbox is OFF

***EDIT***
The only thing I changed was assign Web Site from customer = <EMPTY> to real, defined customer. This obviously did some magic in background.

 

Doh...upgraded to latest ISPConfig and the issue is still present - simply cannot engage Let's Encrypt. Out of 4 web sites on this server, I managed to get LetsEncrypt functional only on 1 site, the other 3 simply refuse to cooperate with LetsEncrypt.
Any idea how to troubleshoot?

 

Jesse, brilliant! I have server behind NAT and "Skip Letsencrypt check" under SSL settings of server WEB service config did the job! Thank you!
BTW...now I see Till also mentioned this setting few posts ago, but I missed that.

 

Hi,
I am using ver 3.2 with 20.4LTS. I am stack. It is showing SSL error. I can see certbot is working and certificates were created but those are not in apache config. Please help.