All simulated renewals failed

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:hurricanepub.org

I ran this command:sudo certbot renew --dry-run

It produced this output: Processing /etc/letsencrypt/renewal/hurricanepub.org.conf

Simulating renewal of an existing certificate for hurricanepub.org and www.hurricanepub.org

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: hurricanepub.org
Type: unauthorized
Detail: 69.195.19.96: Invalid response from http://hurricanepub.org/.well-known/acme-challenge/nD9JqhTzmdeiM-UJr-CgkDprPMtNo5IBWpwwZnyXOAc: 404

Domain: www.hurricanepub.org
Type: unauthorized
Detail: 69.195.19.96: Invalid response from http://www.hurricanepub.org/.well-known/acme-challenge/TDIEcNlOtBImNBLxNW4cKjNSp82PZtWvH9Da_aFsPPI: 404

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Failed to renew certificate hurricanepub.org with error: Some challenges have failed.

All simulated renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/hurricanepub.org/fullchain.pem (failure)

1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):Apache2

The operating system my web server runs on is (include version):Ubuntu 22.04.4 LTS

My hosting provider, if applicable, is: In House

I can login to a root shell on my machine (yes or no, or I don't know):yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):certbot 1.21.0

This all worked before and at this time I do have a working Cert, I just want to make sure auto renew works This site is accesisable from port 443 and 80, unable to figure out what went wrong
There is only the one domain on this server

2

I only see a "Welcome to hurricanepub.org!" webpage. Is that what you expect to see?

Did you remove all the domains you showed in your prior thread - jonesboro, scpweather, ...

<html>
    <head>
        <title>Welcome to hurricanepub.org!</title>
    </head>
    <body>
        <h1>Success!  The your_domain virtual host is working!</h1>
    </body>
</html>
3 Likes
3

Yes this is a video server not the same server from my previous thread
This server has its own public IP and runs zoneminder
This site is hurricanepub.org not .com

1 Like
4

Okay, thanks. Let's start by reviewing your Apache config.

Please show this

sudo apache2ctl -t -D DUMP_VHOSTS

and this

sudo certbot certificates
1 Like
5

VirtualHost configuration:
*:443 hurricanepub.org (/etc/apache2/sites-enabled/hurricanepub.org-le-ssl.conf:2)
*:80 hurricanepub.org (/etc/apache2/sites-enabled/hurricanepub.org.conf:12)

~$ sudo certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Found the following certs:
Certificate Name: hurricanepub.org
Serial Number: 69c260ec429f9dc74973b86d42e898e3a68
Key Type: RSA
Domains: hurricanepub.org www.hurricanepub.org
Expiry Date: 2025-11-20 18:17:10+00:00 (VALID: 79 days)
Certificate Path: /etc/letsencrypt/live/hurricanepub.org/fullchain.pem
Private Key Path: /etc/letsencrypt/live/hurricanepub.org/privkey.pem

6

Is it possible that its the www.hurricanepub.org is causing the issue and the hurricanepub.org is ok I may have removed www.hurricanepub.org from DNS

Not it I checked

7

Don't think so. You did not remove it from DNS (I just checked) but if you had its error message would be different. Both domains failed with '404'

Please show contents of this:

/etc/apache2/sites-enabled/hurricanepub.org.conf

And this

/etc/letsencrypt/renewal/hurricanepub.org.conf

You can redact the account number if you wish

1 Like
8 
<VirtualHost *:80>
    ServerAdmin [redacted]@ssitmail.com
    ServerName hurricanepub.org
    ServerAlias www.hurricanepub.org
    DocumentRoot /var/www/hurricanepub.org
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine off
RewriteCond %{SERVER_NAME} =www.hurricanepub.org [OR]
RewriteCond %{SERVER_NAME} =hurricanepub.org
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

Renewal config file

# renew_before_expiry = 30 days
version = 1.21.0
archive_dir = /etc/letsencrypt/archive/hurricanepub.org
cert = /etc/letsencrypt/live/hurricanepub.org/cert.pem
privkey = /etc/letsencrypt/live/hurricanepub.org/privkey.pem
chain = /etc/letsencrypt/live/hurricanepub.org/chain.pem
fullchain = /etc/letsencrypt/live/hurricanepub.org/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = 
authenticator = apache
installer = apache
server = https://acme-v02.api.letsencrypt.org/directory
9

Oh, you need to change RewriteEngine off to RewriteEngine on

Not only does "off" break the rewrites you have it also breaks the Certbot --apache option

3 Likes
10

Boy do I feel stupid
Thanks Mike

2 Likes