# Certbot failed to authenticate some domains (authenticator: webroot)

**URL:** <https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763>\
**Category:** Help\
**Created:** [April 22, 2026, 5:10pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763 "2026-04-22T17:10:41Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 22, 2026, 5:10pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/1 "2026-04-22T17:10:41Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: [savannahriverplastics.com](http://savannahriverplastics.com)

I ran this command: sudo certbot certonly --webroot -w /var/www/html -d [savannahriverplastics.com](http://savannahriverplastics.com) -d [www.savannahriverplastics.com](http://www.savannahriverplastics.com) --agree-tos -m [support@savannahriverplastics.com](mailto:support@savannahriverplastics.com)

It produced this output:  
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:  
Domain: [savannahriverplastics.com](http://savannahriverplastics.com)  
Type: unauthorized  
Detail: 73.108.169.22: Invalid response from [http://savannahriverplastics.com/.well-known/acme-challenge/](http://savannahriverplastics.com/.well-known/acme-challenge/)[lots of numbers...]: 403

My web server is (include version): Apache 2.4.58

The operating system my web server runs on is (include version): linux 24.04 LTS

My hosting provider, if applicable, is: Comcast

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 2.9.0

Here's another part of the output: Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

So the challenge directory .../.well-known/acme-challenge$ does indeed not have any files in it. I added a text file and was able to see that from a browser.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [April 22, 2026, 5:16pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/2 "2026-04-22T17:16:24Z")

</div>

> [@linux](#):
>
> Certbot): 2.9.0

That is a little bit outdated; but not likely having anything to do with your issue.

> [@linux](#):
>
> Apache 2.4.58

That is also a little bit outdated; but very likely having to do with your issue.  
[Apache is notorious for running at all cost - even when misconfigured]

Please show the output of:  
`sudo apachectl -t -D DUMP_VHOSTS`

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [April 22, 2026, 5:28pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/3 "2026-04-22T17:28:19Z")

</div>

Is this expected?

```nohighlight
curl http://savannahriverplastics.com/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>

```

```nohighlight
curl http://www.savannahriverplastics.com/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>

```

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 22, 2026, 5:57pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/5 "2026-04-22T17:57:58Z")

</div>

Opps, I currently have all incoming ip's blocked except mine while I develop the website. I'll open it up when I get home.

Didn't think about that, thanks

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 22, 2026, 10:49pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/6 "2026-04-22T22:49:20Z")

</div>

> [@rg305](#):
>
> sudo apachectl -t -D DUMP\_VHOSTS

Still not working even after I allowed all ip access. Here's the result of what you asked for:

sudo apachectl -t -D DUMP\_VHOSTS  
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message

```nohighlight
VirtualHost configuration:
*:80 is a NameVirtualHost
         default server savannahrivergraphics.com (/etc/apache2/sites-enabled/savannahrivergraphics.conf:1)
         port 80 namevhost savannahrivergraphics.com (/etc/apache2/sites-enabled/savannahrivergraphics.conf:1)
                 alias www.savannahrivergraphics.com
         port 80 namevhost savannahriverplastics.com (/etc/apache2/sites-enabled/savannahriverplastics.conf:1)
                 alias www.savannahriverplastics.com

```

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 22, 2026, 10:52pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/7 "2026-04-22T22:52:03Z")

</div>

Also, the challenge directory ( var/www/savannahriverplastics/html/.well-known/acme-challenge) still has nothing written into it.

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 22, 2026, 11:03pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/8 "2026-04-22T23:03:38Z")

</div>

Disregard last transmission. I thought I'd cleared all of the require statements out and I did a preliminary test but it's not responding. I'll report back when I get it working...Sorry

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [April 22, 2026, 11:29pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/9 "2026-04-22T23:29:41Z")

</div>

> [@linux](#):
>
> the challenge directory ( var/www/savannahriverplastics/html/.well-known/acme-challenge) still has nothing written into it.

You won't usually be able to see that. Certbot deletes the file right after the challenge is complete (successful or not). If you want to see it use `--debug-challenges -v` options in your command

What is the error after opening port 80 to any IP? Still a 403 or something else?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [April 23, 2026, 12:52am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/10 "2026-04-23T00:52:42Z")

</div>

Was that the complete output?

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 23, 2026, 12:54am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/11 "2026-04-23T00:54:01Z")

</div>

80 was open but I've used apache access control directives like require all granted. Then looking at log files I now see many attempts to see pages. No longer 400 code but 403 when they're asking for directories/files that don't exist. The trouble is that for some annoying reason that I'm trying to debug, I can't see any pages at all, even from another computer.

I also know it's working from the outside as I used [gopeeker.com](http://gopeeker.com) to access my site and it render as it should. So given that I tried the certbot script again and got the same error.

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 23, 2026, 1:07am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/12 "2026-04-23T01:07:39Z")

</div>

Make that a 404 code, not 403.

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [April 23, 2026, 1:45am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/13 "2026-04-23T01:45:55Z")

</div>

> [@linux](#):
>
> Make that a 404 code

That is almost always because the --webroot-path (-w) you specified to Certbot is not the same as the DocumentRoot for the VirtualHost matching that domain name.

geopeeker is fine. We often use the HTTP test here: [Check website performance and response : Check host - online website monitoring](https://check-host.net/check-http)

And, also: [https://letsdebug.net](https://letsdebug.net)

These two also show that connections from the public internet are fine. Just giving you more tools for future reference.

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 23, 2026, 2:00am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/14 "2026-04-23T02:00:46Z")

</div>

Thanks for that.

So I didn't specify the --webroot-path (-w) whatever that is. I assumed cerbot would find the correct root but apparently not. If they're different then no wonder it failed. Where/how is it specified?

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [April 23, 2026, 2:05am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/15 "2026-04-23T02:05:32Z")

</div>

> [@linux](#):
>
> I ran this command: sudo certbot certonly --webroot -w /var/www/html -d [savannahriverplastics.com](http://savannahriverplastics.com) -d [www.savannahriverplastics.com](http://www.savannahriverplastics.com) --agree-tos -m [support@savannahriverplastics.com](mailto:support@savannahriverplastics.com)

> [@linux](#):
>
> So I didn't specify the --webroot-path (-w) whatever that is

Sure you did. Your first post specified `-w /var/www/html`

-w is the shorthand for --webroot-path

Also see: [User Guide — Certbot 5.6.0.dev0 documentation](https://eff-certbot.readthedocs.io/en/latest/using.html#certbot-command-line-options)

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 23, 2026, 2:22am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/16 "2026-04-23T02:22:59Z")

</div>

I'm an idiot. More to come; thanks

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 23, 2026, 3:16pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/17 "2026-04-23T15:16:26Z")

</div>

OK, progress. First, I was dealing with a flaky AP that I fixed at midnight. Anyway, to make a long story short, I reworked the ip blocks, re-ran the certbot script with the correct root path and voila, it worked, almost.

Now, the /etc/letsencrypt path is populated with the keys, I added the virtualhost 443 text block in the apache config file. Then when I did a config test it broke with the error msg: SSLCertificateFile: file '/etc/letsencrypt/live/savannahriverplastics.com/fullchain.pem' does not exist or is empty.

The file does exist and is linked to /etc/letsencrypt/archive/savannahrivergraphics.com/fullchain1.pem with permisions 644. That should work.

I'm continuing to research it... Any ideas?

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [April 23, 2026, 3:22pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/18 "2026-04-23T15:22:34Z")

</div>

> [@linux](#):
>
> Then when I did a config test it broke

Did you run the config test using `sudo` ?

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 23, 2026, 3:48pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/19 "2026-04-23T15:48:06Z")

</div>

Wow, what an obvious mistake. I actually have two websites I'm working on [savannahriverplastics.com](http://savannahriverplastics.com) and [savannahrivergraphics.com](http://savannahrivergraphics.com). I meant to set up the SSL cert for ...plastics but mistakenly ran the certbot script for [savannahriverplastics.com](http://savannahriverplastics.com). That explains it.

Now I have to either cancel the existing cert (or do I?) and rerun it with the correct URL. More to come.

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [April 23, 2026, 3:53pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/20 "2026-04-23T15:53:57Z")

</div>

> [@linux](#):
>
> I meant to set up the SSL cert for `...plastics` but mistakenly ran the certbot script for `savannahriverplastics.com`

Did you mistype the names? I see a cert for ...graphics which you can use when you setup that VirtualHost

Let's check what you actually have first. Please show output of this

```nohighlight
sudo certbot certificates

```

---

<div class="post-metadata">

**Author:** ![linux](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@linux](https://community.letsencrypt.org/u/linux)\
**Post date:** [April 23, 2026, 4:05pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763/21 "2026-04-23T16:05:50Z")

</div>

Yes, I definitely typed the wrong site:

```nohighlight
Found the following certs:
   Certificate Name: savannahrivergraphics.com
     Serial Number: 661a8de9be34f00fe5f0615347131261e58
     Key Type: ECDSA
     Domains: savannahrivergraphics.com www.savannahrivergraphics.com
     Expiry Date: 2026-07-22 12:35:18+00:00 (VALID: 89 days)
     Certificate Path: 
/etc/letsencrypt/live/savannahrivergraphics.com/fullchain.pem
     Private Key Path: 
/etc/letsencrypt/live/savannahrivergraphics.com/privkey.pem

```

So should I delete the existing cert? I think I'd rather do that and  
start over. How to do it?

[Next page](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-webroot/246763.md?page=2)