Please fill out the fields below so we can help you better.
I ran this command:/usr/bin/letsencrypt certonly --keep-until-expiring --non-interactive --staple-ocsp --must-staple --hsts --redirect --rsa-key-size 2048 --uir --webroot -w /home/sporkschivago/public_html -d www.example.com -d example.com -w /home/sporkschivago/public_html/cpanel -d cpanel.example.com -w /home/sporkschivago/public_html/cpcalendars -d cpcalendars.example.com -w /home/sporkschivago/public_html/cpcontacts -d cpcontacts.example.com -w /home/sporkschivago/public_html/webdisk -d webdisk.example.com -w /home/sporkschivago/public_html/webmail -d webmail.example.com -w /home/sporkschivago/public_html/whm -d whm.example.com -w /usr/local/apache/htdocs -d franklin.example.com --email myrealemail@someplace.com --agree-tos
It produced this output:Saving debug log to /var/log/letsencrypt/letsencrypt.log
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for www.example.com
http-01 challenge for example.com
http-01 challenge for cpanel.example.com
http-01 challenge for cpcalendars.example.com
http-01 challenge for cpcontacts.example.com
http-01 challenge for webdisk.example.com
http-01 challenge for webmail.example.com
http-01 challenge for whm.example.com
http-01 challenge for franklin.example.com
Using the webroot path /usr/local/apache/htdocs for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. www.example.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.example.com/.well-known/acme-challenge/NgfmRoCfZ0ofQZSJa_P7CH1KpVr4-1vPUO94g8dh8b8: "
IMPORTANT NOTES:
-
The following errors were reported by the server:
Domain: www.example.com
<meta http-equi"
Type: unauthorized
Detail: Invalid response from
http://www.example.com/.well-known/acme-challenge/NgfmRoCfZ0ofQZSJa_P7CH1KpVr4-1vPUO94g8dh8b8:
"To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
My operating system is (include version):CentOS 7.3.1611 (Core)
My web server is (include version):Apache/2.4.25 (cPanel)
My hosting provider, if applicable, is:Linode
I can login to a root shell on my machine (yes or no, or I don’t know):Yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):I use cPanel and WHM version 11.60.0.35, but I do not use it to install the Let’s Encrypt certificates. I have a crontab entry setup and would like to continue to use the crontab entry.
I have setup my server so no one can go to the insecure version of it. For example, any traffic to port 80 gets redirected to port 443, unless of course, it’s a special subdomain. I have created subdomains for the various cpanel programs (webmail, whm, etc). Here’s a snippet of my .htaccess file. I think there’s something wrong with it:
# Tell the browser to check for index.html and index.php, in that order.
# if either exist, load that file by default.
DirectoryIndex index.php index.html
<IfModule mod_headers.c>
# Turn off caching for Google Chrome.
Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate, post-check=0, pre-check=0"
Header set Pragma "no-cache"
Header set Expires "Wed, 11 Jan 1984 05:00:00 GMT"
# Add P3P Privacy Headers to the site (this causes infinite redirects for some reason).
# Header set P3P "policyref="/w3c/p3p.xml""
</IfModule>
<IfModule mod_rewrite.c>
#Turn RewriteMod on.
RewriteEngine On
# Allow .well-known through for Let's Encrypt.
RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/
# Redirect https://cpanel.example.com to https://www.example.com:2083
RewriteCond %{HTTP_HOST} ^cpanel.example.com$
RewriteRule ^(.*)$ "https\:\/\/www\.example\.com\:2083\/$1" [R=301,L]
...
# Redirect all other users to the https version of our website,
# because we have SSL certs now.
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]
</IfModule>
I can post the entire file if needed. I recently added that RewriteCond %{REQUEST_URI}… under the RewriteCond %{HTTPS}!=on, thinking that’s what was causing the problems. If I create the directory .well-known/acme-challenge and create a file called test.html, when I go to Chrome and type in http://www.example.com/.well-known/acme-challenge/test.html, I see my file, but it’s being redirected to the https version, because I’m on the Google Chrome’s pre-load list, but if I use wget to retreive the file, it appears to be retrieved over port 80. I believe Let’s Encrypt’s binary needs to conduct it’s business over port 80, so everything should be good there, as far as I can tell. Any idea what I’m doing wrong?