# Attempting to renew cert from /etc/letsencrypt/renewal/groomgy.com.conf produced an unexpected error: Failed authorization procedure

**URL:** <https://community.letsencrypt.org/t/attempting-to-renew-cert-from-etc-letsencrypt-renewal-groomgy-com-conf-produced-an-unexpected-error-failed-authorization-procedure/75710>\
**Category:** Help\
**Created:** [October 24, 2018, 8:39pm UTC](https://community.letsencrypt.org/t/attempting-to-renew-cert-from-etc-letsencrypt-renewal-groomgy-com-conf-produced-an-unexpected-error-failed-authorization-procedure/75710 "2018-10-24T20:39:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kimserey](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kimserey/32/26784_2.png) [@Kimserey](https://community.letsencrypt.org/u/Kimserey)\
**Post date:** [October 24, 2018, 8:39pm UTC](https://community.letsencrypt.org/t/attempting-to-renew-cert-from-etc-letsencrypt-renewal-groomgy-com-conf-produced-an-unexpected-error-failed-authorization-procedure/75710/1 "2018-10-24T20:39:18Z")

</div>

## My domain is:

[https://groomgy.com](https://groomgy.com)

## I ran this command:

sudo certbot renew --dry-run

## It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/groomgy.com.conf

Cert is due for renewal, auto-renewing…  
Plugins selected: Authenticator nginx, Installer nginx  
Starting new HTTPS connection (1): [acme-staging-v02.api.letsencrypt.org](http://acme-staging-v02.api.letsencrypt.org)  
Renewing an existing certificate  
Performing the following challenges:  
tls-sni-01 challenge for [groomgy.com](http://groomgy.com)  
tls-sni-01 challenge for [www.groomgy.com](http://www.groomgy.com)  
Waiting for verification…  
Cleaning up challenges  
Attempting to renew cert ([groomgy.com](http://groomgy.com)) from /etc/letsencrypt/renewal/groomgy.com.conf produced an unexpected error: Failed authorization procedure. [groomgy.com](http://groomgy.com) (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested aac68ac4f8dc5d9ac69fe61ba9bf7b88.276acccc10ef2428291a193cd6b5156f.acme.invalid from 54.255.153.71:443. Received 2 certificate(s), first certificate had names “[groomgy.com](http://groomgy.com), [www.groomgy.com](http://www.groomgy.com)”, [www.groomgy.com](http://www.groomgy.com) (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested c8c650d779b9bc36f90c471411f60fba.62d3f4f004a46a115e19034a46c3295d.acme.invalid from 54.255.153.71:443. Received 2 certificate(s), first certificate had names “[groomgy.com](http://groomgy.com), [www.groomgy.com](http://www.groomgy.com)”. Skipping.  
All renewal attempts failed. The following certs could not be renewed:  
/etc/letsencrypt/live/groomgy.com/fullchain.pem (failure)

## The operating system my web server runs on is (include version):

Ubuntu 16.04

## I can login to a root shell on my machine:

Yes

## I’m using a control panel to manage my site:

No

* * *

I am not sure what to debug or where to look at. Could someone advise me on where to look at?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 24, 2018, 8:44pm UTC](https://community.letsencrypt.org/t/attempting-to-renew-cert-from-etc-letsencrypt-renewal-groomgy-com-conf-produced-an-unexpected-error-failed-authorization-procedure/75710/2 "2018-10-24T20:44:45Z")

</div>

Hi @Kimserey

> [@Kimserey](#):
>
> Performing the following challenges:  
> tls-sni-01 challenge for [groomgy.com](http://groomgy.com)  
> tls-sni-01 challenge for [www.groomgy.com](http://www.groomgy.com)

the tls-sni-01 - challenge is deprecated. So use

```nohighlight
sudo certbot renew --dry-run --preferred-challenges http

```

instead.

---

<div class="post-metadata">

**Author:** ![Kimserey](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kimserey/32/26784_2.png) [@Kimserey](https://community.letsencrypt.org/u/Kimserey)\
**Post date:** [October 24, 2018, 9:35pm UTC](https://community.letsencrypt.org/t/attempting-to-renew-cert-from-etc-letsencrypt-renewal-groomgy-com-conf-produced-an-unexpected-error-failed-authorization-procedure/75710/3 "2018-10-24T21:35:51Z")

</div>

Thanks for the reply @JuergenAuer

I’ve ran `sudo certbot renew --dry-run --preferred-challenges http`.

## Here is the response:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/groomgy.com.conf

Cert is due for renewal, auto-renewing…  
Plugins selected: Authenticator nginx, Installer nginx  
Starting new HTTPS connection (1): [acme-staging-v02.api.letsencrypt.org](http://acme-staging-v02.api.letsencrypt.org)  
Renewing an existing certificate  
Performing the following challenges:  
http-01 challenge for [groomgy.com](http://groomgy.com)  
http-01 challenge for [www.groomgy.com](http://www.groomgy.com)  
Waiting for verification…  
Cleaning up challenges  
Attempting to renew cert ([groomgy.com](http://groomgy.com)) from /etc/letsencrypt/renewal/groomgy.com.conf produced an unexpected error: Failed authorization procedure. [www.groomgy.com](http://www.groomgy.com) (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://www.groomgy.com/.well-known/acme-challenge/33K\_\_0lsi2z3wrqqRRGliFzbBm8zlv19GLpAruXV2hA:](http://www.groomgy.com/.well-known/acme-challenge/33K__0lsi2z3wrqqRRGliFzbBm8zlv19GLpAruXV2hA:) “\r\n404 Not Found\r\n\<body bgcolor=“white”\>\r\n\<h1.\>404 Not Found\r\n

* * *
”, [groomgy.com](http://groomgy.com) (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://groomgy.com/.well-known/acme-challenge/d09ncTEswJzosEV8qgj09KQELn5IRUzjFgSBa-FULWg:](http://groomgy.com/.well-known/acme-challenge/d09ncTEswJzosEV8qgj09KQELn5IRUzjFgSBa-FULWg:) “\r\n404 Not Found\r\n\<body bgcolor=“white”\>\r\n\<h1.\>404 Not Found\r\n
* * *
”. Skipping.  
All renewal attempts failed. The following certs could not be renewed:  
/etc/letsencrypt/live/groomgy.com/fullchain.pem (failure)

DRY RUN: simulating ‘certbot renew’ close to cert expiry  
(The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:  
/etc/letsencrypt/live/groomgy.com/fullchain.pem (failure)  
DRY RUN: simulating ‘certbot renew’ close to cert expiry  
(The test certificates above have not been saved.)  
1 renew failure(s), 0 parse failure(s)

* * *

My server returns 404 Not Found on the url [http://groomgy.com/.well-known/acme-challenge/d09ncTEswJzosEV8qgj09KQELn5IRUzjFgSBa-FULWg](http://groomgy.com/.well-known/acme-challenge/d09ncTEswJzosEV8qgj09KQELn5IRUzjFgSBa-FULWg)

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 24, 2018, 10:50pm UTC](https://community.letsencrypt.org/t/attempting-to-renew-cert-from-etc-letsencrypt-renewal-groomgy-com-conf-produced-an-unexpected-error-failed-authorization-procedure/75710/4 "2018-10-24T22:50:40Z")

</div>

Please share your log.

> [@Kimserey](#):
>
> /var/log/letsencrypt/letsencrypt.log

And create a file in /.well-known/acme-challenge - file name 1234, so you should be able to load this file via

```nohighlight
http://groomgy.com/.well-known/acme-challenge/1234

```

If this works, you know your correct webroot (path to /). So perhaps use

```nohighlight
sudo certbot renew --dry-run --preferred-challenges http --webroot -w yourwebroot

```

If this doesn't work, there may be wrong redirects. Or a proxy server.

---

<div class="post-metadata">

**Author:** ![Kimserey](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kimserey/32/26784_2.png) [@Kimserey](https://community.letsencrypt.org/u/Kimserey)\
**Post date:** [October 25, 2018, 12:59pm UTC](https://community.letsencrypt.org/t/attempting-to-renew-cert-from-etc-letsencrypt-renewal-groomgy-com-conf-produced-an-unexpected-error-failed-authorization-procedure/75710/5 "2018-10-25T12:59:59Z")

</div>

Thanks for the reply @JuergenAuer, specifying the root worked, thank you so much.

I don’t remember specifying the webroot 3 months ago when I first setup the SSL.  
Was the cron job renewal failing due to the deprecation of tls-sni-01 challenge?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 25, 2018, 2:23pm UTC](https://community.letsencrypt.org/t/attempting-to-renew-cert-from-etc-letsencrypt-renewal-groomgy-com-conf-produced-an-unexpected-error-failed-authorization-procedure/75710/6 "2018-10-25T14:23:20Z")

</div>

> [@Kimserey](#):
>
> Was the cron job renewal failing due to the deprecation of tls-sni-01 challenge?

Perhaps. I don't know. But there are a lot of users, tls-sni-01 fails, switching to http-01 works.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [November 24, 2018, 2:23pm UTC](https://community.letsencrypt.org/t/attempting-to-renew-cert-from-etc-letsencrypt-renewal-groomgy-com-conf-produced-an-unexpected-error-failed-authorization-procedure/75710/7 "2018-11-24T14:23:22Z")

</div>

Closed on November 24, 2018, 2:23pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.