# Cert renewal failure **URL:** \ **Category:** Help\ **Created:** [November 16, 2017, 9:41am UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439 "2017-11-16T09:41:38Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![elmussol](https://avatars.discourse-cdn.com/v4/letter/e/d6d6ee/32.png) [@elmussol](https://community.letsencrypt.org/u/elmussol)\ **Post date:** [November 16, 2017, 9:41am UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/1 "2017-11-16T09:41:38Z")
Greeting folks, first post here. I am trying for first renewal for [https://red.elsmussols.net/](https://red.elsmussols.net/) This is on a fully-updated Debian Stretch box. I am using nginx 1.10.3-1+deb9u1 and certbot 0.10.2-1. Here’s my output: root@pendle:/var/www/red# certbot renew --pre-hook “service nginx stop” --post-hook "service nginx start" Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * ## Processing /etc/letsencrypt/renewal/red.elsmussols.net.conf Cert is due for renewal, auto-renewing… Running pre-hook command: service nginx stop Renewing an existing certificate Performing the following challenges: http-01 challenge for [red.elsmussols.net](http://red.elsmussols.net) Waiting for verification… Cleaning up challenges Attempting to renew cert from /etc/letsencrypt/renewal/red.elsmussols.net.conf produced an unexpected error: Failed authorization procedure. [red.elsmussols.net](http://red.elsmussols.net) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [http://red.elsmussols.net/.well-known/acme-challenge/Xv6CfjN6CoP2IH7fqAXSIIKneK86ux5vqmJMkyQHu4U:](http://red.elsmussols.net/.well-known/acme-challenge/Xv6CfjN6CoP2IH7fqAXSIIKneK86ux5vqmJMkyQHu4U:) Connection refused. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/red.elsmussols.net/fullchain.pem (failure) Running post-hook command: service nginx start 1 renew failure(s), 0 parse failure(s) IMPORTANT NOTES: - The following errors were reported by the server: The well-known directory exists: root@pendle:/var/www/red# ls -al | grep well drwxr-xr-x 2 root root 4096 Nov 16 10:37 .well-known Guidance and thoughts appreciated, additional information gladly supplied. Thank you in advance. ---
**Author:** ![bytecamp](https://avatars.discourse-cdn.com/v4/letter/b/54ee81/32.png) [@bytecamp](https://community.letsencrypt.org/u/bytecamp)\ **Post date:** [November 16, 2017, 9:46am UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/2 "2017-11-16T09:46:23Z")
> [@elmussol](#): > > Connection refused If you stop your webserver software (nginx) before authorization, the challenge files cannot be delivered. Try without the --pre-hook and --post-hook. ---
**Author:** ![elmussol](https://avatars.discourse-cdn.com/v4/letter/e/d6d6ee/32.png) [@elmussol](https://community.letsencrypt.org/u/elmussol)\ **Post date:** [November 16, 2017, 9:55am UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/3 "2017-11-16T09:55:38Z")
So as I suspected that didn’t work as the nginx.conf for that site has enforced https (all http requests are redirected to https). root@pendle:/var/www/red# certbot renew Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * ## Processing /etc/letsencrypt/renewal/red.elsmussols.net.conf Cert is due for renewal, auto-renewing… Renewing an existing certificate Performing the following challenges: http-01 challenge for [red.elsmussols.net](http://red.elsmussols.net) Waiting for verification… Cleaning up challenges Attempting to renew cert from /etc/letsencrypt/renewal/red.elsmussols.net.conf produced an unexpected error: Failed authorization procedure. [red.elsmussols.net](http://red.elsmussols.net) (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://red.elsmussols.net/.well-known/acme-challenge/lg0l66f-LK0WGPgA3qOYnX6PQaYPc6umI-crhYGnKfc](http://red.elsmussols.net/.well-known/acme-challenge/lg0l66f-LK0WGPgA3qOYnX6PQaYPc6umI-crhYGnKfc) [176.58.122.108]: 404. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/red.elsmussols.net/fullchain.pem (failure) 1 renew failure(s), 0 parse failure(s) IMPORTANT NOTES: - The following errors were reported by the server: Perhaps if I comment out the redirect directive just while I’m renewing the cert? ---
**Author:** ![bytecamp](https://avatars.discourse-cdn.com/v4/letter/b/54ee81/32.png) [@bytecamp](https://community.letsencrypt.org/u/bytecamp)\ **Post date:** [November 16, 2017, 10:23am UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/4 "2017-11-16T10:23:48Z")
> [@elmussol](#): > > Perhaps if I comment out the redirect directive just while I’m renewing the cert? The redirect does not matter as long as the URL stays correctly mapped to the filesystem. In your log output, there is error 404 (Not Found). You descriibe that the webroot for [red.elsmussols.net](http://red.elsmussols.net) is /var/www/red. So please create a file test.txt in the directory /var/www/red/.well-known/acme-challenge/ and try to access that via [http://red.elsmussols.net/.well-known/acme-challenge/test.txt](http://red.elsmussols.net/.well-known/acme-challenge/test.txt). As long as this does not work, the mapping is wrong. ---
**Author:** ![elmussol](https://avatars.discourse-cdn.com/v4/letter/e/d6d6ee/32.png) [@elmussol](https://community.letsencrypt.org/u/elmussol)\ **Post date:** [November 16, 2017, 10:50am UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/5 "2017-11-16T10:50:53Z")
So that’s a fail. I get redirected to https and get an insecure notification (the cert is now expired). If I approve an exception I get a blank page. The file is definitely in the right place: `root@pendle:~# cat /var/www/red/.well-known/acme-challenge/test.txt Testing to see if acme-challenge can get here.` As I mentioned above: `root@pendle:/var/www/red# ls -al | grep well drwxr-xr-x 2 root root 4096 Nov 16 10:37 .well-known` Is the ownership of this correct? Perhaps this directory and its contents should be www-data:www-data not root:root. ---
**Author:** ![elmussol](https://avatars.discourse-cdn.com/v4/letter/e/d6d6ee/32.png) [@elmussol](https://community.letsencrypt.org/u/elmussol)\ **Post date:** [November 16, 2017, 12:54pm UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/6 "2017-11-16T12:54:28Z")
chown made no difference. I am out of ideas. ---
**Author:** ![jmorahan](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jmorahan/32/1873_2.png) [@jmorahan](https://community.letsencrypt.org/u/jmorahan)\ **Post date:** [November 16, 2017, 3:29pm UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/7 "2017-11-16T15:29:54Z")
That might be the correct location, but if I request your test.txt file I get a 404 - and a Set-Cookie and Expires header from PHP. Could there be something in your nginx configuration routing those URLs to PHP instead of serving them from the filesystem? ---
**Author:** ![elmussol](https://avatars.discourse-cdn.com/v4/letter/e/d6d6ee/32.png) [@elmussol](https://community.letsencrypt.org/u/elmussol)\ **Post date:** [November 16, 2017, 3:46pm UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/8 "2017-11-16T15:46:19Z")
This could be it. Extract from nginx config for this site: [code]# make sure webfinger and other well known services aren’t blocked # by denying dot files and rewrite request to the front controller location ^~ /.well-known/ { allow all; rewrite ^/(.\*) /index.php?q=$uri&$args last;[/code] ---
**Author:** ![elmussol](https://avatars.discourse-cdn.com/v4/letter/e/d6d6ee/32.png) [@elmussol](https://community.letsencrypt.org/u/elmussol)\ **Post date:** [November 16, 2017, 3:47pm UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/9 "2017-11-16T15:47:37Z")
Would it make sense to comment out this section whilst renewing the cert and then reenabling afterward? ---
**Author:** ![jmorahan](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jmorahan/32/1873_2.png) [@jmorahan](https://community.letsencrypt.org/u/jmorahan)\ **Post date:** [November 16, 2017, 5:27pm UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/10 "2017-11-16T17:27:39Z")
I’m not familiar enough with nginx config to say for sure, but it’s worth a try 🙂 if it works you might then be able to find some alternative config that can be left in place permanently. Perhaps someone more familiar with nginx can help with that. ---
**Author:** ![elmussol](https://avatars.discourse-cdn.com/v4/letter/e/d6d6ee/32.png) [@elmussol](https://community.letsencrypt.org/u/elmussol)\ **Post date:** [December 11, 2017, 6:24pm UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/11 "2017-12-11T18:24:29Z")
Fixed. PHP was interfering so the following was added to the nginx.conf: `# test to excude well-known/acme-challenge/ ignored location ^~ /.well-known/acme-challenge/ { allow all; try_files $uri =404; }` Thank you to everyone who took the time and made the effort to reply. Your input poointed me in the right direction. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 10, 2018, 6:24pm UTC](https://community.letsencrypt.org/t/cert-renewal-failure/46439/12 "2018-01-10T18:24:38Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.