Certbot challenge mismatch error

When trying the challenge URL from any browser, I get the correct (expected) response. But proceeding with the certbot command give a wrong anwser:

Expected value:
LPaCyeRPk6zA9IVVQ-K5ghbVysEWmaE9_SDpbmpmH5Y.54c9RZBaaB94IPo6klfn4PF8KRyYA3BYLDkhJup6v8c

Detail: The key authorization file from the server did not match this challenge. Expected "LPaCyeRPk6zA9IVVQ-K5ghbVysEWmaE9_SDpbmpmH5Y.54c9RZBaaB94IPo6klfn4PF8KRyYA3BYLDkhJup6v8c" (got "LPaCyeRPk6zA9IVVQ-K5ghbVysEWmaE9_SDpbmpmH5Y.4E3VCTFsySjUrqnCg0ooULx-3kbdPBygi0aWkvg5Gd8")

note: only the second part of the challenge is wrong. wget, curl and web browser gives the correct challenge, only letsencrypt gets the wrong one (in blod).

no cache server , no multiple host associated with the domain.

additional informations:

My domain is: varbado-interim.com

I ran this command: certbot certonly --webroot -w /home/varbado-interim/public_html -d varbado-interim.com --debug-challenges -v

It produced this output:

The following URLs should be accessible from the internet and return the value
mentioned:

URL:
http://varbado-interim.com/.well-known/acme-challenge/LPaCyeRPk6zA9IVVQ-K5ghbVysEWmaE9_SDpbmpmH5Y
Expected value:
LPaCyeRPk6zA9IVVQ-K5ghbVysEWmaE9_SDpbmpmH5Y.54c9RZBaaB94IPo6klfn4PF8KRyYA3BYLDkhJup6v8c


Press Enter to Continue
Waiting for verification...
Challenge failed for domain varbado-interim.com
http-01 challenge for varbado-interim.com

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: varbado-interim.com
Type: unauthorized
Detail: The key authorization file from the server did not match this challenge. Expected "LPaCyeRPk6zA9IVVQ-K5ghbVysEWmaE9_SDpbmpmH5Y.54c9RZBaaB94IPo6klfn4PF8KRyYA3BYLDkhJup6v8c" (got "LPaCyeRPk6zA9IVVQ-K5ghbVysEWmaE9_SDpbmpmH5Y.4E3VCTFsySjUrqnCg0ooULx-3kbdPBygi0aWkvg5Gd8")

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): apache2

The operating system my web server runs on is (include version): Ubuntu 24.024

My hosting provider, if applicable, is: self-hosted

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): I am using webmin and virtualmin

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.9.0

@mendrika, welcome to the community! :slightly_smiling_face:

Please check the result of the letsdebug site for your domain:

It gives the explanation of what very likely might be the configuration problem.

5 Likes

thank you @bruncsak

the domain name was recently transfered to a the current IP address

it turns out that the domain name also had an IPv6 AAA entry, we just deleted the entry and it worked

thank you very much

4 Likes