Can not renew certificate

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: jnrothen.ddns.net

I ran this command: letsencrypt renew

It produced this output:

Processing /etc/letsencrypt/renewal/jnrothen.ddns.net.conf

Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for jnrothen.ddns.net
Waiting for verification…
Cleaning up challenges
Unable to clean up challenge directory /var/www/nextcloud/.well-known/acme-challenge
Attempting to renew cert from /etc/letsencrypt/renewal/jnrothen.ddns.net.conf produced an unexpected error: Failed authorization procedure. jnrothen.ddns.net (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://jnrothen.ddns.net/.well-known/acme-challenge/0dehDVVGNnxXApc9WmsS2twIGUAz3nYXBTNlAFTWL70: "

Die Seite wurde n". Skipping.

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/jnrothen.ddns.net/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

My web server is (include version): Apache/2.4.25 with Nextcloud/13.0.4

The operating system my web server runs on is (include version):
Raspbian Stretch
My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

I checked access.log and error.log. I can’t find any request to the webserver requesting the file. I tried to creat another file in the acme directory, which I’m able to access without any problems. I checked letsencrypt.log and the IP address which is resolved and used is correct.

2

If I go to your website, I’m getting a “Windows Home Server-Website”, powered by “Microsoft-IIS/6.0”, not some Nextcloud or Rasbian site.

Are you really really REALLY sure your IP address is correct? I’m resolving your FQDN to 87.173.94.238.

Edit:
On port 443, there is a Nextcloud server running, so the IP seems to be correct… But on port 80… No such Nextcloud server, but a Windows server.

Do you have port 80 and port 443 portmapped to different internal IP addresses by any chance? Or are you running two different webservers on the same host? Because your ACME challenge is being put in the Nextcloud webdir, so I’m assuming the IIS webserver doesn’t have any clue about that ACME challenge, but Let’s Encrypt is connecting to the IIS server, as it’s connecting to port 80.

3

Thanks, that was the fault. My FritzBox crashed some time ago and I had to replace it by a new one. And I think the config backup was to old which I used. The wrong port redirect did not come into my mind. Sorry for that…

4

No problem, we're here to help :grin:

But the most important question remains: can you renew now? :wink:

5

Of course :grinning:
Once the port redirect was corrected, everything went well :wink:

6

Great!   

7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.