# Cannot renew "Failed authorization procedure" **URL:** \ **Category:** Help\ **Created:** [August 9, 2017, 5:00pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844 "2017-08-09T17:00:26Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![unruly1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/unruly1/32/15481_2.png) [@unruly1](https://community.letsencrypt.org/u/unruly1)\ **Post date:** [August 9, 2017, 5:00pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/1 "2017-08-09T17:00:26Z")
Please fill out the fields below so we can help you better. My domain is: [home.unruly1.com](http://home.unruly1.com) I ran this command: certbot-auto renew It produced this output: Attempting to renew cert ([home.unruly1.com](http://home.unruly1.com)) from /etc/letsencrypt/renewal/home.unruly1.com.conf produced an unexpected error: Failed authorization procedure. [home.unruly1.com](http://home.unruly1.com) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [https://home.unruly1.com](https://home.unruly1.com),/.well-known/acme-challenge/nr5vlmOtWSkIMI-wfZhtvahZBDVFgFRDWQlGGeJQUtk: Error getting validation data. Skipping. My web server is (include version): nginx The operating system my web server runs on is (include version): ubuntu 14 My hosting provider, if applicable, is: self I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [August 9, 2017, 5:30pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/2 "2017-08-09T17:30:36Z")
> [@unruly1](#): > > It produced this output: Attempting to renew cert ([home.unruly1.com](http://home.unruly1.com)) from /etc/letsencrypt/renewal/home.unruly1.com.conf produced an unexpected error: Failed authorization procedure. [home.unruly1.com](http://home.unruly1.com) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [https://home.unruly1.com](https://home.unruly1.com),/.well-known/acme-challenge/nr5vlmOtWSkIMI-wfZhtvahZBDVFgFRDWQlGGeJQUtk: Error getting validation data. Skipping. Hi @unruly1, If you literally pasted the output there, then the trouble is the comma in the URL (notice that it says `"home.unruly1.com,"` with a comma instead of just `"home.unruly1.com"`). As this is an HTTPS URL, it shows that the certificate authority is following a 301 redirect message sent by your web server. The problem would probably lie with a redirect rule set in your web server configuration that redirects people from HTTP to HTTPS — it probably contains a typo that has an extra comma that doesn't belong there. ---
**Author:** ![unruly1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/unruly1/32/15481_2.png) [@unruly1](https://community.letsencrypt.org/u/unruly1)\ **Post date:** [August 10, 2017, 5:02pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/3 "2017-08-10T17:02:33Z")
Thanks for the quick reply. I did copy/paste the output. I did notice that and I have been looking everywhere for what is putting that comma in there.. Thank you for pointing me to the redirect. I fixed that and now I am having a problem bypassing the authentication prompt for the /.well-known directory despite this entry in the nginx reverse > location ~ /.well-known/acme-challenge/ { > auth\_basic off; > autoindex on; > } although I do have the following entry after that > ``` > auth_basic "Restricted"; > > ``` any help is appreciated. thanks ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [August 10, 2017, 5:39pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/4 "2017-08-10T17:39:19Z")
Maybe it’s because you’ve written `.wellknown` instead of `.well-known` there? ---
**Author:** ![unruly1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/unruly1/32/15481_2.png) [@unruly1](https://community.letsencrypt.org/u/unruly1)\ **Post date:** [August 10, 2017, 10:05pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/5 "2017-08-10T22:05:08Z")
oops. now THAT one was a typo… (fixed it on my post) I verified it is correct on the server … any other ideas? ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [August 10, 2017, 11:59pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/6 "2017-08-10T23:59:15Z")
I don’t happen to know enough about nginx to diagnose this, unfortunately. (I’d agree that getting rid of the basic auth on that directory is necessary in order to let this renewal go ahead.) ---
**Author:** ![unruly1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/unruly1/32/15481_2.png) [@unruly1](https://community.letsencrypt.org/u/unruly1)\ **Post date:** [August 11, 2017, 2:06am UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/7 "2017-08-11T02:06:20Z")
yeah, the auto renew worked when I removed basic auth in the reverse config but I’d like to be able to script it to auto-renew while maintaining basic auth in my nginx reverse proxy… I’ll do some more research here is the tutorial I followed: [Secure nginx Reverse Proxy with Let’s Encrypt](https://www.htpcguides.com/secure-nginx-reverse-proxy-with-lets-encrypt-on-ubuntu-16-04-lts/) ---
**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\ **Post date:** [August 11, 2017, 3:46pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/8 "2017-08-11T15:46:50Z")
> [@unruly1](#): > > although I do have the following entry after that It's been my experience that nginx is somewhat sensitive to the order of location blocks. Try moving the block that enables http auth earlier in the file to before the block that disables it for `/.well-known`. EDIT: This would be the case if the location block that enables http auth also uses the `~` (regexp match) operator. If it's just enabled in `location /` as I would expect then it should be ok. 🤔 You might also consider instead using: `location ^~ /.well-known/acme-challenge/` That is, use `^~` instead of `~`. This operator causes nginx to bypass any `~` rules when the prefix matches. ---
**Author:** ![unruly1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/unruly1/32/15481_2.png) [@unruly1](https://community.letsencrypt.org/u/unruly1)\ **Post date:** [August 12, 2017, 11:45pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/9 "2017-08-12T23:45:11Z")
Thank you for sharing your experience. I modified my file and an initial test indicates it is working properly. Appreciate your help. Consider this resolved for now. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 11, 2017, 11:45pm UTC](https://community.letsencrypt.org/t/cannot-renew-failed-authorization-procedure/39844/10 "2017-09-11T23:45:51Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.