# Certbot is not working on apache2 **URL:** \ **Category:** Help\ **Created:** [December 19, 2024, 10:08pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525 "2024-12-19T22:08:32Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 19, 2024, 10:08pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/1 "2024-12-19T22:08:32Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [bjoernspecker.de](http://bjoernspecker.de) I ran this command: sudo certbot It produced this output: Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems: Domain: [bjoernspecker.de](http://bjoernspecker.de) Type: tls Detail: xxx:: Fetching [https://bjoernspecker.de/wordpress/.well-known/acme-challenge/cyqyAcB1ZI7Mge-VH1cDnUnsuwg9VK7nwyKvBNa\_GGM:](https://bjoernspecker.de/wordpress/.well-known/acme-challenge/cyqyAcB1ZI7Mge-VH1cDnUnsuwg9VK7nwyKvBNa_GGM:) remote error: tls: handshake failure Domain: [www.bjoernspecker.de](http://www.bjoernspecker.de) Type: tls Detail: xxx::: Fetching [https://bjoernspecker.de/wordpress/.well-known/acme-challenge/efFlbj7dNl\_3MLxn2UgOjKSOOMY-t8sBPQkkKBsNFOU:](https://bjoernspecker.de/wordpress/.well-known/acme-challenge/efFlbj7dNl_3MLxn2UgOjKSOOMY-t8sBPQkkKBsNFOU:) remote error: tls: handshake failure Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet. My web server is (include version): The operating system my web server runs on is (include version): Raspberry Pi OS My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Terminal The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 2.1.0 I stopped apache2 server on my raspberry pi, but im still not able to execute certbot without errors. I need your help please. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 19, 2024, 10:58pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/2 "2024-12-19T22:58:25Z")
> [@bs4114](#): > > Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems: > Domain: `bjoernspecker.de` > Type: tls > Detail: xxx:: Fetching `https://bjoernspecker.de/wordpress/.well-known/acme-challenge/cyqyAcB1ZI7Mge-VH1cDnUnsuwg9VK7nwyKvBNa_GGM`: remote error: tls: handshake failure Was that the result even with Apache stopped? Because --standalone requires exclusive use of port 80. Also, you have both IPv4 and IPv6 addresses in your DNS. Which of them was shown in the error message (it helps to know). Assuming Apache was stopped, then something else processed the HTTP request before Certbot --standalone ever saw it. The --standalone would never redirect to HTTPS yet we see an HTTPS URL in the error message. If you have a working Apache server why are you using --standalone? Usually the --apache or --webroot methods are used which allows Apache to stay running. Otherwise with --standalone you need to stop it not only for the first cert but also each renewa. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [December 20, 2024, 6:30am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/3 "2024-12-20T06:30:16Z")
> [@MikeMcQ](#): > > Was that the result even with Apache stopped? Probably not looking at the `/wordpress/` that has worked itself in the URL after the HTTP to HTTPS redirect. ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 20, 2024, 12:38pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/4 "2024-12-20T12:38:43Z")
I have tried this command: certbot --apache This error appeard: The requested apache plugin does not appear to be installed If I try to install the apache plugin i get this: E: Package python-certbot-apache cannot be found ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 20, 2024, 2:40pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/5 "2024-12-20T14:40:58Z")
> [@bs4114](#): > > If I try to install the apache plugin i get this: E: Package python-certbot-apache cannot be found What was the install command that produced that error? ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 20, 2024, 6:44pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/6 "2024-12-20T18:44:11Z")
The install command was: sudo apt-get install python-certbot-apache ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 20, 2024, 7:11pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/7 "2024-12-20T19:11:52Z")
I don't have a Pi system to check but what does this say? ```nohighlight sudo apt-cache search certbot | grep -Ei 'encrypt|apache' ``` ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 20, 2024, 10:22pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/8 "2024-12-20T22:22:01Z")
> [@MikeMcQ](#): > > `sudo apt-cache search certbot | grep -Ei 'encrypt|apache'` The output is as follows: Automatic configuration of HTTPS using Let's Encrypt python3-certbot-apache - Apache plugin for Certbot ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 20, 2024, 10:38pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/9 "2024-12-20T22:38:31Z")
> [@bs4114](#): > > python3-certbot-apache So, shouldn't you run? `sudo apt-get install python3-certbot-apache` You ran this. > [@bs4114](#): > > sudo apt-get install python-certbot-apache ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 20, 2024, 11:23pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/10 "2024-12-20T23:23:15Z")
I've tried this and the installation was sucessfull, but it still does not work: "The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet." ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 20, 2024, 11:44pm UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/11 "2024-12-20T23:44:55Z")
> [@bs4114](#): > > Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems: > Domain: [bjoernspecker.de](http://bjoernspecker.de) > Type: tls > Detail: xxx:: Fetching [https://bjoernspecker.de/wordpress/.well-known/acme-challenge/cyqyAcB1ZI7Mge-VH1cDnUnsuwg9VK7nwyKvBNa\_GGM:](https://bjoernspecker.de/wordpress/.well-known/acme-challenge/cyqyAcB1ZI7Mge-VH1cDnUnsuwg9VK7nwyKvBNa_GGM:) remote error: tls: handshake failure > [@bs4114](#): > > but it still does not work: Would you please show the part of the error message like you did in first post? (and that I show above). You should not be getting the same "handshake failure" with the --apache plugin. It is important to know exactly what the error is. ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 21, 2024, 12:01am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/12 "2024-12-21T00:01:32Z")
Which names would you like to activate HTTPS for? We recommend selecting either all domains, or all domains in a VirtualHost/server block. * * * 1: [bjoernspecker.de](http://bjoernspecker.de) 2: [www.bjoernspecker.de](http://www.bjoernspecker.de) * * * Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter 'c' to cancel): 1,2 Requesting a certificate for [bjoernspecker.de](http://bjoernspecker.de) and [www.bjoernspecker.de](http://www.bjoernspecker.de) Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems: Domain: [bjoernspecker.de](http://bjoernspecker.de) Type: tls Detail: xxx::: Fetching [https://bjoernspecker.de/wordpress/.well-known/acme-challenge/MJmhWWJwYO3QJH6LRnKAJJqghqCV\_r6H2qER72ahp4g:](https://bjoernspecker.de/wordpress/.well-known/acme-challenge/MJmhWWJwYO3QJH6LRnKAJJqghqCV_r6H2qER72ahp4g:) remote error: tls: handshake failure Domain: [www.bjoernspecker.de](http://www.bjoernspecker.de) Type: tls Detail: xxx::: Fetching [https://bjoernspecker.de/wordpress/.well-known/acme-challenge/UYENaeuEgtAQ4wbkMr7tfitZmnyy\_UNvJnrTLs4E3LM:](https://bjoernspecker.de/wordpress/.well-known/acme-challenge/UYENaeuEgtAQ4wbkMr7tfitZmnyy_UNvJnrTLs4E3LM:) remote error: tls: handshake failure Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet. ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 21, 2024, 12:41am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/13 "2024-12-21T00:41:40Z")
I discovered that i need a txt record to verify that I am the owner of the website. What do I have to type in the txt recorf? ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 21, 2024, 1:24am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/14 "2024-12-21T01:24:38Z")
> [@bs4114](#): > > I discovered that i need a txt record to verify that I am the owner of the website. No, you use that with a DNS Challenge. So far you have been trying an HTTP Challenge. Both --standalone and --apache use HTTP Challenge. The DNS Challenge is more difficult to setup. You can see an HTTPS URL in the error message. If --apache worked correctly you would not see that. Something in your system is redirecting the original HTTP request from the Let's Encrypt server to HTTPS. And, adding a `/wordpress/` to the URL too. Something is unusual in your Apache config that it could not be configured by the --apache option. We need to study your Apache config. What does this command show? ```nohighlight apachectl -t -D DUMP_VHOSTS ``` You may need to use `apache2ctl` or `httpd` instead of `apachectl`. I don't remember which command the Pi uses. ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 21, 2024, 2:41am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/15 "2024-12-21T02:41:37Z")
> [@MikeMcQ](#): > > `apachectl -t -D DUMP_VHOSTS` AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message VirtualHost configuration: \*:80 is a NameVirtualHost default server [www.bjoernspecker.de](http://www.bjoernspecker.de) (/etc/apache2/ports.conf:6) port 80 namevhost [www.bjoernspecker.de](http://www.bjoernspecker.de) (/etc/apache2/ports.conf:6) port 80 namevhost [bjoernspecker.de](http://bjoernspecker.de) (/etc/apache2/sites-enabled/bjoernspecker.de.conf:8) alias [www.bjoernspecker.de](http://www.bjoernspecker.de) ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 21, 2024, 2:46am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/16 "2024-12-21T02:46:26Z")
I've set the Server name in apache2.conf, but the certbot error persists: Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 21, 2024, 3:05am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/17 "2024-12-21T03:05:16Z")
> [@bs4114](#): > > port 80 namevhost `www.bjoernspecker.de` (/etc/apache2/ports.conf:6) > port 80 namevhost `bjoernspecker.de` (/etc/apache2/sites-enabled/bjoernspecker.de.conf:8) > alias `www.bjoernspecker.de` That looks very wrong. You should not have any VirtualHost definitions in your ports.conf file. And, whatever is there overlaps domain names in your sites-enabled folder. For Apache to work correctly each port:name combination must be unique. Please show contents of both these files ```nohighlight /etc/apache2/ports.conf /etc/apache2/sites-enabled/bjoernspecker.de.conf ``` ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 21, 2024, 6:02am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/18 "2024-12-21T06:02:49Z")
/etc/apache2/ports.conf: ```nohighlight Listen 80 DocumentRoot "/var/www/html/wordpress" ServerName www.bjoernspecker.de Listen 443 Listen 443 ``` ---
**Author:** ![bs4114](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bs4114](https://community.letsencrypt.org/u/bs4114)\ **Post date:** [December 21, 2024, 6:15am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/20 "2024-12-21T06:15:39Z")
/etc/apache2/sites-enabled/bjoernspecker.de.conf: ```nohighlight ServerName bjoernspecker.de DocumentRoot /var/www/html ServerAlias www.bjoernspecker.de ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined Options FollowSymLinks AllowOverride All # Let's Encrypt challenge location Alias /.well-known/acme-challenge/ /var/www/html/.well-known/acme-challenge/ Options None AllowOverride None ForceType text/plain RedirectMatch 404 "^(?!/\.well-known/acme-challenge/[\w-]{43}$)" ServerAdmin webmaster@localhost DocumentRoot /var/www/html ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 21, 2024, 10:10am UTC](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525/22 "2024-12-21T10:10:09Z")
> [@bs4114](#): > > ```nohighlight > Listen 80 > > Listen 443 > > > > Listen 443 > > > ``` Make your ports.conf look like above by removing VirtualHost [Next page](https://community.letsencrypt.org/t/certbot-is-not-working-on-apache2/230525.md?page=2)