# Certbot renewal error

**URL:** <https://community.letsencrypt.org/t/certbot-renewal-error/156287>\
**Category:** Help\
**Created:** [July 22, 2021, 10:53pm UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287 "2021-07-22T22:53:58Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![bravo](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bravo](https://community.letsencrypt.org/u/bravo)\
**Post date:** [July 22, 2021, 10:53pm UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/1 "2021-07-22T22:53:58Z")

</div>

Hi, Team

I'm trying to renew certifications, but I have gotten errors. The first installation of certification was done successfully. The WEB sites work and I can access to them from outside. Please see following information as well.

My domain is:corp-associe.jp, [koshirophotography.com](http://koshirophotography.com)

I ran this command: certbot renew

It produced this output:  
rocessing /etc/letsencrypt/renewal/www.corp-associe.jp.conf

* * *

Renewing an existing certificate for www.corp-associe.jp and 3 more domains

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:  
Domain: [blog.koshirophotography.com](http://blog.koshirophotography.com)  
Type: unauthorized  
Detail: Invalid response from [https://blog.koshirophotography.com/.well-known/acme-challenge/kuFVuRhrxhH64wEPGnmPiluKCQwmdY4mlcnDcXk8wBE](https://blog.koshirophotography.com/.well-known/acme-challenge/kuFVuRhrxhH64wEPGnmPiluKCQwmdY4mlcnDcXk8wBE) [203.141.138.215]: "\n\n403 Forbidden\n\n

# Forbidden
\n\<p"

Domain: [www.koshirophotography.com](http://www.koshirophotography.com)  
Type: unauthorized  
Detail: Invalid response from [https://www.koshirophotography.com/.well-known/acme-challenge/ozzoolA4NrMzmz\_sc6VCj0i25Te9k2qhC9XFVPnnEOE](https://www.koshirophotography.com/.well-known/acme-challenge/ozzoolA4NrMzmz_sc6VCj0i25Te9k2qhC9XFVPnnEOE) [203.141.138.215]: "\<!doctype html\>\n\<html lang="ja" \>\n\n\t\<meta charset="UTF-8" /\>\n\t\<meta name="viewport" content="width=device-width, initial-s"

Domain: [nightview.koshirophotography.com](http://nightview.koshirophotography.com)  
Type: unauthorized  
Detail: Invalid response from [https://nightview.koshirophotography.com/.well-known/acme-challenge/fASZvCu8GTcIZr-\_l0T2uP6N55u4ffW7gFFMN8-ulhI](https://nightview.koshirophotography.com/.well-known/acme-challenge/fASZvCu8GTcIZr-_l0T2uP6N55u4ffW7gFFMN8-ulhI) [203.141.138.215]: "\n\n403 Forbidden\n\n

# Forbidden
\n\<p"

Domain: www.corp-associe.jp  
Type: unauthorized  
Detail: Invalid response from [https://www.corp-associe.jp/.well-known/acme-challenge/f1ov3kuJe7kXbNPTghzf-Jnm2u0mH-AHxX1x\_BaFprU](https://www.corp-associe.jp/.well-known/acme-challenge/f1ov3kuJe7kXbNPTghzf-Jnm2u0mH-AHxX1x_BaFprU) [203.141.138.215]: "\<!doctype html\>\n\<html lang="ja" \>\n\n\t\<meta charset="UTF-8" /\>\n\t\<meta name="viewport" content="width=device-width, initial-s"

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Failed to renew certificate www.corp-associe.jp with error: Some challenges have failed.

* * *

All renewals failed. The following certificates could not be renewed:  
/etc/letsencrypt/live/www.corp-associe.jp/fullchain.pem (failure)

* * *

1 renew failure(s), 0 parse failure(s)  
Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): Apache2.4.46

The operating system my web server runs on is (include version): RHEL 8.3

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 1.17.0

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [July 22, 2021, 11:25pm UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/2 "2021-07-22T23:25:05Z")

</div>

> [@bravo](#):
>
> [blog.koshirophotography.com](http://blog.koshirophotography.com)

Even visiting your home page, we see this forbidden error:

![image](https://global.discourse-cdn.com/letsencrypt/original/3X/3/8/387173a28189ae37302ee646bc3327c4b84565c8.png)

which would probably also be affecting your Certbot setup, since you're using `--webroot`.

It might be worth looking into `/var/log/httpd/error_log` to see whether there are any messages that might give a clue about what the nature of the Forbidden error is.

It would also help to post the contents of `/etc/letsencrypt/renewal/www.corp-associe.jp.conf`, so we can see how the different domains' webroots are mapped.

---

<div class="post-metadata">

**Author:** ![bravo](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bravo](https://community.letsencrypt.org/u/bravo)\
**Post date:** [July 23, 2021, 12:39am UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/3 "2021-07-23T00:39:21Z")

</div>

Hi,  
Thank you for your quick response. Yes, there was some misconfiguration of httpd.ssl.conf file. I modified and both subdomain work now. You can access to [blog.xxxxx.com](http://blog.xxxxx.com). However, I still have gotten the error as below.

 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/0/7/070033ccc216f159bd8e7671b877b208cfadaf4f.png)

Here is log file where is under /etc/letsencrypt/renewal.

# renew\_before\_expiry = 30 days

version = 1.13.0  
archive\_dir = /etc/letsencrypt/archive/www.corp-associe.jp  
cert = /etc/letsencrypt/live/www.corp-associe.jp/cert.pem  
privkey = /etc/letsencrypt/live/www.corp-associe.jp/privkey.pem  
chain = /etc/letsencrypt/live/www.corp-associe.jp/chain.pem  
fullchain = /etc/letsencrypt/live/www.corp-associe.jp/fullchain.pem

# Options used in the renewal process

[renewalparams]  
account = 3430b538ce67ebb0aae1eaf065766dfd  
authenticator = webroot  
apache\_server\_root = /usr/local/apache2  
apache\_vhost\_root = /usr/local/apache2/conf/extra  
apache\_challenge\_location = /usr/local/apache2/conf  
server = [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)  
[[webroot\_map]]  
[blog.koshirophotography.com](http://blog.koshirophotography.com) = /data1/virtualdocs/wordpress/blog-koshirophotography  
[nightview.koshirophotography.com](http://nightview.koshirophotography.com) = /data1/virtualdocs/wordpress/nightview-koshirophotography  
www.corp-associe.jp = /data1/htdocs/wordpress  
[www.koshirophotography.com](http://www.koshirophotography.com) = /data1/virtualdocs/wordpress/koshirophotography

Or I will need to wait for 30 or 45 minitues and try renewal process after rebooting apache service?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 23, 2021, 12:45am UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/4 "2021-07-23T00:45:36Z")

</div>

> [@bravo](#):
>
> there was some misconfiguration of httpd.ssl.conf

Can you show the file (so we may look for other problems/mistakes)?

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [July 23, 2021, 4:10am UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/5 "2021-07-23T04:10:04Z")

</div>

> [@bravo](#):
>
> [blog.koshirophotography.com](http://blog.koshirophotography.com) = /data1/virtualdocs/wordpress/blog-koshirophotography

OK, so just to take this one example, let's try create a file:

```
mkdir -p /data1/virtualdocs/wordpress/blog-koshirophotography/.well-known/acme-challenge
echo Hello > /data1/virtualdocs/wordpress/blog-koshirophotography/.well-known/acme-challenge/test.txt

```

and then we should be able to see it by visiting [http://blog.koshirophotography.com/.well-known/acme-challenge/test.txt](http://blog.koshirophotography.com/.well-known/acme-challenge/test.txt)

That's the basic premise of how `--webroot` works.

If that's not working, we can start looking into why:

- Wrong directory?
- SELinux?
- something else?

---

<div class="post-metadata">

**Author:** ![bravo](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bravo](https://community.letsencrypt.org/u/bravo)\
**Post date:** [July 23, 2021, 4:28am UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/6 "2021-07-23T04:28:00Z")

</div>

Hello \_az

I have created test.txt under following directory. Does it work??  
I don't see "Hello" text on this page.

[root@web1 acme-challenge]# pwd  
/data1/virtualdocs/wordpress/blog-koshirophotography/.well-known/acme-challenge  
[root@web1 acme-challenge]# ls  
test.txt

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [July 23, 2021, 6:05am UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/7 "2021-07-23T06:05:38Z")

</div>

> [@bravo](#):
>
> [blog.koshirophotography.com](http://blog.koshirophotography.com)

No, it redirects to https and goes to this page:

 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/f/3/f359fb9adbf9e9f29f011864fb58fa318a81a791.png)

You can test this kind of thing from your own phone using 4G data instead of wifi, that way you are accessing your website externally like Let's Encrypt would.

If the test.txt file works for you but not for external visitors that suggests that on your machine the website address is resolving to a different server (e.g. a test server instead of the production server).

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [July 23, 2021, 7:46am UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/8 "2021-07-23T07:46:54Z")

</div>

... and if you can't see the text file either, some more helpful things to post would be:

- The `/data1/virtualdocs/wordpress/blog-koshirophotography/.htaccess` file, if it exists
- The Apache `.conf` file for the blog virtual host

---

<div class="post-metadata">

**Author:** ![bravo](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bravo](https://community.letsencrypt.org/u/bravo)\
**Post date:** [July 23, 2021, 9:00pm UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/9 "2021-07-23T21:00:56Z")

</div>

Hi,  
Thanks for your help. The .htaccess file exist. I tried to install new certification from scratch. I renamed current directory like www.corp-associe.jp to www.corp-associe.jp.old under /etc/letsencrypt/live and archive and tried to get new one. It was done successfully and the page work now. Also, I tried to renew the certifications, but I got error like there is no file exist of www.corp-associe.jp, so I renamed back to original file name. And it worked as well. I will go with this setting and see what happens. I think there might be way to clean up the certification before getting new one from scratch...

Sorry for confusion, but I appreciate for your help.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [August 22, 2021, 9:01pm UTC](https://community.letsencrypt.org/t/certbot-renewal-error/156287/10 "2021-08-22T21:01:49Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.