403 error when using Apache Tomcat with Certbot/Win-Acme/CertifyTheWeb in Windows Server

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: tstpublic.serviceconnect.defence.gov.au

I ran this command: (stopped Apache service before running the commands)

#For Certbot, tried both:
certbot certonly --webroot -v
certbot certonly --standalone

#For Win-ACME, wacs.exe with options M, 2, hostname, 4, 2, 2, 4, 2, 3, file path, 1, 5, 3

#For CertifytheWeb: run Request Certificate

It produced this output:

#For Certbot,

C:\Program Files\Certbot>certbot certonly --standalone
Saving debug log to C:\Certbot\log\letsencrypt.log
Please enter the domain name(s) you would like on your certificate (comma and/or
space separated) (Enter 'c' to cancel): tstpublic.serviceconnect.defence.gov.au
Requesting a certificate for tstpublic.serviceconnect.defence.gov.au

Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
Domain: tstpublic.serviceconnect.defence.gov.au
Type: unauthorized
Detail: 2620:1ec:bdf::41: Invalid response from http://tstpublic.serviceconnect.defence.gov.au/.well-known/acme-challenge/vA9XveVUFBkvUWwmSQU4MtAkBqVJnUWAq7NSH9NdSO4: 403

Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet.

#For Win-ACME,

Plugin Manual generated source tstpublic.serviceconnect.defence.gov.au with 1 identifiers
Plugin Single created 1 order
Cached order has status invalid, discarding
[tstpublic.serviceconnect.defence.gov.au] Authorizing...
[tstpublic.serviceconnect.defence.gov.au] Authorizing using http-01 validation (SelfHosting)
[tstpublic.serviceconnect.defence.gov.au] Authorization result: invalid
[tstpublic.serviceconnect.defence.gov.au] {"type":"urn:ietf:params:acme:error:unauthorized","detail":"2620:1ec:bdf::41: Invalid response from http://tstpublic.serviceconnect.defence.gov.au/.well-known/acme-challenge/-7SbJ_apDgNR_cZMwJgyEh0iX7dOm3vyD-ZE-CIoxok: 403","status":403,"instance":null}
[tstpublic.serviceconnect.defence.gov.au] Deactivating pending authorization

#CertifytheWeb error:

CertifyTheWeb
CertifyTheWeb616×205 27.4 KB

My web server is (include version): Apache Tomcat 9.0

The operating system my web server runs on is (include version): Windows Server 2019

My hosting provider, if applicable, is: n/a

I can login to a root shell on my machine (yes or no, or I don't know): n/a

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

-Server has Internet access
-Azure App gateway is forwarding http requests as http (tcp port 80)
-In the past, we ran these commands without making any changes to Apache config

Please assist.

2

Hello @FM2023,

For the HTTP-01 challenge with a nonexistent file the HTTP Response expected would be 404 Not Found - HTTP | MDN, not 403 Forbidden - HTTP | MDN. I believe you have a configuration issue with the web server.

$ curl -Ii http://tstpublic.serviceconnect.defence.gov.au/.well-known/acme-challenge/sometestfile
HTTP/1.1 403 Forbidden
Date: Thu, 12 Dec 2024 00:26:42 GMT
Content-Type: text/html
Content-Length: 1066
Connection: keep-alive
ETag: "675a0f86-42a"
x-azure-ref: 20241212T002641Z-178c4fbb74958557hC1PDXkhz400000008f000000000gcfu
X-Cache: CONFIG_NOCACHE

Using the online tool Let's Debug yields results in alignment with the above https://letsdebug.net/tstpublic.serviceconnect.defence.gov.au/2307875

UnexpectedHttpResponse

UnexpectedHttpResponse

Warning

Sending an ACME HTTP validation request to tstpublic.serviceconnect.defence.gov.au results in unexpected HTTP response 403 Forbidden. This indicates that the webserver is misconfigured or misbehaving.

403 Forbidden

This URL path is Forbidden body { ; text-align: center; padding: 150px; background: linear-gradient(to bottom, #454545, #000000);} h1 { font-size: 50px; } body { font: 20px Helvetica, sans-serif; color: #FFFFFF; } article { height:100%; display: block; text-align: left; width: 650px; margin: 0 auto; } a { color: #dc8100; text-decoration: none; } a:hover { color: #333; text-decoration: none; }

This URL path is Forbidden

If you see this page and you think the page has been blocked in error

   

Please Contact Nicholas.a.dowson@avanade.com

   

Thank you for visiting.

— The ServiceConnect Project Team

SC-Stacked-Logo-Reverse-white.png730×160 16.7 KB

Trace:
@0ms: Making a request to http://tstpublic.serviceconnect.defence.gov.au/.well-known/acme-challenge/letsdebug-test (using initial IP 2620:1ec:bdf::45)
@0ms: Dialing 2620:1ec:bdf::45
@569ms: Server response: HTTP 403 Forbidden

And a second UnexpectedHttpResponse

UnexpectedHttpResponse

Warning

Sending an ACME HTTP validation request to tstpublic.serviceconnect.defence.gov.au results in unexpected HTTP response 403 Forbidden. This indicates that the webserver is misconfigured or misbehaving.

403 Forbidden

This URL path is Forbidden body { ; text-align: center; padding: 150px; background: linear-gradient(to bottom, #454545, #000000);} h1 { font-size: 50px; } body { font: 20px Helvetica, sans-serif; color: #FFFFFF; } article { height:100%; display: block; text-align: left; width: 650px; margin: 0 auto; } a { color: #dc8100; text-decoration: none; } a:hover { color: #333; text-decoration: none; }

This URL path is Forbidden

If you see this page and you think the page has been blocked in error

   

Please Contact Nicholas.a.dowson@avanade.com

   

Thank you for visiting.

— The ServiceConnect Project Team

SC-Stacked-Logo-Reverse-white.png730×160 16.7 KB

Trace:
@0ms: Making a request to http://tstpublic.serviceconnect.defence.gov.au/.well-known/acme-challenge/letsdebug-test (using initial IP 13.107.246.45)
@0ms: Dialing 13.107.246.45
@580ms: Server response: HTTP 403 Forbidden

Please show the output of sudo apachectl -t -D DUMP_VHOSTS

Here details on Apache can be found in documentation and forums:

3 Likes
3

Thanks. We are using Windows Server 2019.

1 Like
4

Sorry @FM2023,

The title "403 error when using Apache Tomcat with Certbot/Win-Acme/CertifyTheWeb in Windows Server" is a bit misleading to me. How does one using Windows Server show the DUMP_VHOSTS for Apache on Windows Server?

2 Likes
5

Sorry, using Windows OS not linux. Apache Tomcat is the web server.

6

Understood; again.

2 Likes
7

Also @FM2023 Certbot Discontinuing Windows Beta Support in 2024
Thus Certbot is no long a viable option for any Windows including Windows Server.

3 Likes
8

Possibly:
httpd.exe -t -D DUMP_VHOSTS

3 Likes
9

Not for windows.

10

Yes, so we tried Win-ACME and CertifytheWeb as well. Same result.

11

Is the site available via IPv6?

2 Likes
12

Apache for Windows = yes [I've used it]
Tomcat for Windows = ? ? ?

2 Likes
13

Then how is that done for Windows?

2 Likes
14

It's "Tomcat" [not "Apache"] for Windows.
So... who knows!

2 Likes
15

server_running
server_running715×233 46.8 KB

16

no. Only IPv4.

17

double-click that service and find the path to the executable.

2 Likes
18

Here is another link that may be of assistance to you Apache Tomcat 9 (9.0.99-dev) - Windows Service How-To

2 Likes
19

"C:\Program Files\Apache\Tomcat9\bin\Tomcat9.exe" //RS//Tomcat9

20

And there lies the problem!:

Name:      s-part-0013.t-0009.fb-t-msedge.net
Addresses: 2620:1ec:29:1::41     <<<<<<<<<<<<<<<<<<<<<<<<< IPv6
           13.107.253.41
Aliases:   tstpublic.serviceconnect.defence.gov.au     <<<<<<<<<<<<<<<<<<<<<<<<<
           npserviceconnect.azurefd.net
           azurefd-t-prod.trafficmanager.net
           shed.dual-low.s-part-0013.t-0009.t-msedge.net
           azurefd-t-fb-prod.trafficmanager.net
           dual.s-part-0013.t-0009.fb-t-msedge.net
3 Likes