Certbot renew fails

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
kasdobo.copm

I ran this command:
certbot renew
It produced this output:

Domain: theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://theoceanwindow.com/.well-known/acme-challenge/8EUbEuAJctJ66ffqog1BiPVCBfikIS4xWeKSY6W9B8Y
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

My web server is (include version)Apach24
The operating system my web server runs on is (include version):
FreeBSD 12.1
My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):
Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
Webmin to help but mostly from command line
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 1.7.0

2 Likes

Hi,

Which exact domain are you having issue?
Is it theoceanwindow.com or kasdobo.com?
Are those domains hosted and pointed to the same instance?

Thank you

3 Likes

From certbot certificates

Found the following certs:
Certificate Name: kasdivi.com
Serial Number: 492b895924452c1afc3681144767484a0d9
Domains: theoceanwindow.com kasdivi.com wandjbrewers.com www.kasdivi.com www.theoceanwindow.com www.wandjbrewers.com
Expiry Date: 2020-11-14 10:10:43+00:00 (VALID: 19 days)
Certificate Path: /usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem
Private Key Path: /usr/local/etc/letsencrypt/live/kasdivi.com/privkey.pem

Thanks

2 Likes

Thank you for this information.
Is theoceanwindow.com the only domain didn't pass (throw an error)?

3 Likes

Welcome to the Let's Encrypt Community, Jason :slightly_smiling_face:

Allow me to confer with my colleague...


@stevenzhu

I think kasdobo.copm [sic] is a typo of kasdivi.com.


Absolutely.

www.theoceanwindow.com. 21599 IN CNAME theoceanwindow.com.
theoceanwindow.com. 21599 IN A 209.160.65.133
www.kasdivi.com. 21599 IN CNAME kasdivi.com.
kasdivi.com. 21599 IN A 209.160.65.133
www.wandjbrewers.com. 21599 IN CNAME wandjbrewers.com.
wandjbrewers.com. 21599 IN A 209.160.65.133


By default certbot will cease if it encounters this type of error. In order to proceed with testing the rest of the domain names, @kasdivi would need to add --allow-subset-of-names to his certbot command.

2 Likes

@kasdivi

Please show the output of:
sudo certbot renew --allow-subset-of-names --dry-run

2 Likes

Everything erroed

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Using the webroot path /usr/local/www/kasdivi.com for all unmatched domains.
Waiting for verification...
Challenge failed for domain theoceanwindow.com
Challenge failed for domain wandjbrewers.com
Challenge failed for domain www.theoceanwindow.com
Challenge failed for domain www.wandjbrewers.com
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Cleaning up challenges
Attempting to renew cert (kasdivi.com) from /usr/local/etc/letsencrypt/renewal/kasdivi.com.conf produced an unexpected error: Some challenges have failed.. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem (failure)


All renewal attempts failed. The following certs could not be renewed:
/usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem (failure)


1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

  • The following errors were reported by the server:

Domain: theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://theoceanwindow.com/.well-known/acme-challenge/01wnM_tWnNr0k7QS3tJ51vY15WFJStOfld3D2Ri-SLI
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: wandjbrewers.com
Type: unauthorized
Detail: Invalid response from
http://wandjbrewers.com/.well-known/acme-challenge/cPtTluSdG-1wJVVmWJtZ8kjC2aPZ9wST016dtJ7QWpQ
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: www.theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://www.theoceanwindow.com/.well-known/acme-challenge/cHz1NQkSE7drymp0OgZoSflGrzTw5FauhuxDnjYKu0c
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: www.wandjbrewers.com
Type: unauthorized
Detail: Invalid response from
http://www.wandjbrewers.com/.well-known/acme-challenge/7tcjS7YldFa_8ZeVfWPcjkvQVKxWHSBKRBumcae9FwY
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
jason@triggerfish:/usr/local/etc/apache24/extra:

2 Likes

Excellent! :slightly_smiling_face: I mean... that's terrible :worried:, but I expected it.

2 Likes

Processing /usr/local/etc/letsencrypt/renewal/kasdivi.com.conf


Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for kasdivi.com
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.kasdivi.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Using the webroot path /usr/local/www/kasdivi.com for all unmatched domains.
Waiting for verification...
Challenge failed for domain theoceanwindow.com
Challenge failed for domain wandjbrewers.com
Challenge failed for domain www.theoceanwindow.com
Challenge failed for domain www.wandjbrewers.com
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Cleaning up challenges
Performing the following challenges:
http-01 challenge for kasdivi.com
http-01 challenge for www.kasdivi.com
Using the webroot path /usr/local/www/kasdivi.com for all unmatched domains.
Waiting for verification...
Cleaning up challenges


new certificate deployed without reload, fullchain is
/usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem



** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates below have not been saved.)

Congratulations, all renewals succeeded. The following certs have been renewed:
/usr/local/etc/letsencrypt/live/kasdivi.com/fullchain.pem (success)
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates above have not been saved.)


IMPORTANT NOTES:

  • The following errors were reported by the server:

Domain: theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://theoceanwindow.com/.well-known/acme-challenge/RCmmhLD7yoE0FV9ViWXoB4fiMFIf_XUxCtpaun4nSbo
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: wandjbrewers.com
Type: unauthorized
Detail: Invalid response from
http://wandjbrewers.com/.well-known/acme-challenge/PHO6vsIL8ed9On7H9jlQ_HtPguAiducGOPpPBP0_r4M
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: www.theoceanwindow.com
Type: unauthorized
Detail: Invalid response from
http://www.theoceanwindow.com/.well-known/acme-challenge/yjYpWUBpKFnCksO_EVet8RMc-X776kIkO_kmnMDGxxI
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

Domain: www.wandjbrewers.com
Type: unauthorized
Detail: Invalid response from
http://www.wandjbrewers.com/.well-known/acme-challenge/N7CdlXuDwYeFTg3N8LHgfC-BkrwvJoNgudvZYzmay1Q
[209.160.65.133]: "\n\n404 Not
Found\n\n

Not Found

\n<p"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
jason@triggerfish:/usr/local/etc/apache24/extra:

2 Likes

We'll get you moving. Don't you worry! :wink:

1 Like

To everyone:

I am creating multiple posts because @kasdivi is responding via email.

@kasdivi

Please create a file named ./.well-known/acme-challenge/test (without a file extension) containing "OK".

2 Likes

No problem. I know I screwed this up a whole ago

Thanks

2 Likes

I noticed you're not getting errors for kasdivi.com. Then I noticed this:

/usr/local/www/kasdivi.com/

Let's make this really easy...

sudo certbot certonly --webroot -w /usr/local/www/kasdivi.com -d "kasdivi.com,www.kasdivi.com" -w /usr/local/www/theoceanwindow.com -d "theoceanwindow.com,www.theoceanwindow.com" -w /usr/local/www/wandjbrewers.com -d "wandjbrewers.com,www.wandjbrewers.com" --deploy-hook "sudo /usr/local/sbin/apachectl graceful"

2 Likes

I have created the folders and files as you directed

2 Likes

No worries. Just run the last, long command I gave you. I can almost guarantee it will work beautifully. You can delete the test files.

2 Likes

dont go to the track. response was

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for theoceanwindow.com
http-01 challenge for wandjbrewers.com
http-01 challenge for www.theoceanwindow.com
http-01 challenge for www.wandjbrewers.com
Using the webroot path /usr/local/www/wandjbrewers.com for all unmatched domains.
Waiting for verification...
Challenge failed for domain theoceanwindow.com
Challenge failed for domain www.theoceanwindow.com
http-01 challenge for theoceanwindow.com
http-01 challenge for www.theoceanwindow.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

2 Likes

What is the webroot folder for theoceanwindow.com?

I assumed it was /usr/local/www/theoceanwindow.com

2 Likes

it is /usr/local/www/theoceanwindow.com. as you assumed

2 Likes

That command should have worked then. Me thinks there is a webserver configuration issue with theoceanwindow.com.

The difference of content seems strange to me...

http://theoceanwindow.com

https://theoceanwindow.com

2 Likes

What's the output here:
sudo apachectl -S

Seems to me that the webroot (for port 80) of theoceanwindow.com is /usr/local/www/wandjbrewers.com ...

2 Likes