Certbot renew fails

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
kasdobo.copm

I ran this command:
certbot renew
It produced this output:

Domain: theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://theoceanwindow.com/.well-known/acme-challenge/8EUbEuAJctJ66ffqog1BiPVCBfikIS4xWeKSY6W9B8Y
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

My web server is (include version)Apach24
The operating system my web server runs on is (include version):
FreeBSD 12.1
My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):
Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
Webmin to help but mostly from command line
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 1.7.0

Hi,

Which exact domain are you having issue?
Is it theoceanwindow.com or kasdobo.com?
Are those domains hosted and pointed to the same instance?

Thank you

From certbot certificates

Found the following certs:
Certificate Name: kasdivi.com
Serial Number: 492b895924452c1afc3681144767484a0d9
Domains: theoceanwindow.com kasdivi.com wandjbrewers.com www.kasdivi.com www.theoceanwindow.com www.wandjbrewers.com
Expiry Date: 2020-11-14 10:10:43+00:00 (VALID: 19 days)
Certificate Path: /usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem
Private Key Path: /usr/local/etc/letsencrypt/live/kasdivi.com/privkey.pem

Thanks

Thank you for this information.
Is theoceanwindow.com the only domain didn't pass (throw an error)?

Welcome to the Let's Encrypt Community, Jason :slightly_smiling_face:

Allow me to confer with my colleague...


@stevenzhu

I think kasdobo.copm [sic] is a typo of kasdivi.com.


Absolutely.

www.theoceanwindow.com. 21599 IN CNAME theoceanwindow.com.
theoceanwindow.com. 21599 IN A 209.160.65.133
www.kasdivi.com. 21599 IN CNAME kasdivi.com.
kasdivi.com. 21599 IN A 209.160.65.133
www.wandjbrewers.com. 21599 IN CNAME wandjbrewers.com.
wandjbrewers.com. 21599 IN A 209.160.65.133


By default certbot will cease if it encounters this type of error. In order to proceed with testing the rest of the domain names, @kasdivi would need to add --allow-subset-of-names to his certbot command.

@kasdivi

Please show the output of:
sudo certbot renew --allow-subset-of-names --dry-run

Everything erroed

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Using the webroot path /usr/local/www/kasdivi.com for all unmatched domains.
Waiting for verification...
Challenge failed for domain theoceanwindow.com
Challenge failed for domain wandjbrewers.com
Challenge failed for domain www.theoceanwindow.com
Challenge failed for domain www.wandjbrewers.com
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Cleaning up challenges
Attempting to renew cert (kasdivi.com) from /usr/local/etc/letsencrypt/renewal/kasdivi.com.conf produced an unexpected error: Some challenges have failed.. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem (failure)


All renewal attempts failed. The following certs could not be renewed:
/usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem (failure)


1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

  • The following errors were reported by the server:

Domain: theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://theoceanwindow.com/.well-known/acme-challenge/01wnM_tWnNr0k7QS3tJ51vY15WFJStOfld3D2Ri-SLI
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: wandjbrewers.com
Type: unauthorized
Detail: Invalid response from
http://wandjbrewers.com/.well-known/acme-challenge/cPtTluSdG-1wJVVmWJtZ8kjC2aPZ9wST016dtJ7QWpQ
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: www.theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://www.theoceanwindow.com/.well-known/acme-challenge/cHz1NQkSE7drymp0OgZoSflGrzTw5FauhuxDnjYKu0c
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: www.wandjbrewers.com
Type: unauthorized
Detail: Invalid response from
http://www.wandjbrewers.com/.well-known/acme-challenge/7tcjS7YldFa_8ZeVfWPcjkvQVKxWHSBKRBumcae9FwY
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
jason@triggerfish:/usr/local/etc/apache24/extra:

Excellent! :slightly_smiling_face: I mean... that's terrible :worried:, but I expected it.

Processing /usr/local/etc/letsencrypt/renewal/kasdivi.com.conf


Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for kasdivi.com
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.kasdivi.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Using the webroot path /usr/local/www/kasdivi.com for all unmatched domains.
Waiting for verification...
Challenge failed for domain theoceanwindow.com
Challenge failed for domain wandjbrewers.com
Challenge failed for domain www.theoceanwindow.com
Challenge failed for domain www.wandjbrewers.com
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Cleaning up challenges
Performing the following challenges:
http-01 challenge for kasdivi.com
http-01 challenge for www.kasdivi.com
Using the webroot path /usr/local/www/kasdivi.com for all unmatched domains.
Waiting for verification...
Cleaning up challenges


new certificate deployed without reload, fullchain is
/usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem



** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates below have not been saved.)

Congratulations, all renewals succeeded. The following certs have been renewed:
/usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem (success)
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates above have not been saved.)


IMPORTANT NOTES:

  • The following errors were reported by the server:

Domain: theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://theoceanwindow.com/.well-known/acme-challenge/RCmmhLD7yoE0FV9ViWXoB4fiMFIf_XUxCtpaun4nSbo
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: wandjbrewers.com
Type: unauthorized
Detail: Invalid response from
http://wandjbrewers.com/.well-known/acme-challenge/PHO6vsIL8ed9On7H9jlQ_HtPguAiducGOPpPBP0_r4M
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: www.theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://www.theoceanwindow.com/.well-known/acme-challenge/yjYpWUBpKFnCksO_EVet8RMc-X776kIkO_kmnMDGxxI
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: www.wandjbrewers.com
Type: unauthorized
Detail: Invalid response from
http://www.wandjbrewers.com/.well-known/acme-challenge/N7CdlXuDwYeFTg3N8LHgfC-BkrwvJoNgudvZYzmay1Q
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
jason@triggerfish:/usr/local/etc/apache24/extra:

We'll get you moving. Don't you worry! :wink:

To everyone:

I am creating multiple posts because @kasdivi is responding via email.

@kasdivi

Please create a file named ./.well-known/acme-challenge/test (without a file extension) containing "OK".

No problem. I know I screwed this up a whole ago

Thanks

I noticed you're not getting errors for kasdivi.com. Then I noticed this:

/usr/local/www/kasdivi.com/

Let's make this really easy...

sudo certbot certonly --webroot -w /usr/local/www/kasdivi.com -d "kasdivi.com,www.kasdivi.com" -w /usr/local/www/theoceanwindow.com -d "theoceanwindow.com,www.theoceanwindow.com" -w /usr/local/www/wandjbrewers.com -d "wandjbrewers.com,www.wandjbrewers.com" --deploy-hook "sudo /usr/local/sbin/apachectl graceful"

I have created the folders and files as you directed

No worries. Just run the last, long command I gave you. I can almost guarantee it will work beautifully. You can delete the test files.

dont go to the track. response was

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Using the webroot path /usr/local/www/wandjbrewers.com for all unmatched domains.
Waiting for verification...
Challenge failed for domain theoceanwindow.com
Challenge failed for domain www.theoceanwindow.com
http-01 challenge for theoceanwindow.com
http-01 challenge for www.theoceanwindow.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

What is the webroot folder for theoceanwindow.com?

I assumed it was /usr/local/www/theoceanwindow.com

it is /usr/local/www/theoceanwindow.com. as you assumed

That command should have worked then. Me thinks there is a webserver configuration issue with theoceanwindow.com.

The difference of content seems strange to me...

http://theoceanwindow.com

https://theoceanwindow.com

What's the output here:
sudo apachectl -S

Seems to me that the webroot (for port 80) of theoceanwindow.com is /usr/local/www/wandjbrewers.com ...