Certbot renewal http-01 error

[Osiris]

@pathma

Can I point to another location using the --webroot?

Probably not. The idea about the webroot plugin is that you can use your existing configuration to serve the challenge file.

@pathma

Is there a pointer to using webroot, I dont understand how that works.

I'm not sure I understand the question here. It's rather simple. The webroot plugin has to point to the "DocumentRoot" of your VirtualHost and it needs to be able to serve files under the /.well-known/acme-challenge/ path. That's it.

@pathma

Do I need the -i apache for that?

No, the installer plugin is separate from the webroot authenticator plugin.

@pathma

Probably have to disable the redirect to https, as the cert is expired now

An expired certificate is not a problem for the validation servers. It even ignores self-signed certificates.

[JuergenAuer]

What's the content of

@pathma

/etc/apache2/sites-enabled/default-ssl.conf

Is there the same DocumentRoot used?

PS: No, unrelevant, you have removed the redirect http -> https.

[pathma]

I think apache prevents access to hidden folders. I am looking into IndexIgnoreReset as I can't access anything in a hidden folder

[pathma]

I am at my wits end ! wget http://jstjesuits.org/.well-known/acme-challenge/index.html gives 404 but http://jstjesuits.org/.well-known2/acme-challenge/index.html works. I even moved .well-known2 to .well-known and it fails.

[Osiris]

Both of those URLs are giving the default Apache page, so actually none of those work.

[pathma]

OK its fixed now. I rebooted the system. After that .well-known didn't give a 404. After I installed the new certs and reverted everything back to the way it used to be. I tested the certbot again, and it failed. Wget shows its once again failing if the folder name is .well-known but its OK if its .well-known2. Its a mystery whats causing this, but its probably related to my system and not letsencrypt. I am wondering if its some apparmor side effect. Anyway, thanks for the responses. I will have to deal with this issue again in 90 days, sigh

[pathma]

Hah! I found the issue. fail2ban had a regex for /var/www/jstb/.well-known/security.txt . Something I must have added , having looked at cyber attackers doing GETs for various files in my apache logfiles. At that time I didn't realise that .well-known was related to letsencrypt, and added that as a regex to ban cyber attackers. Not sure why the reboot helped, maybe it unbanned the IP I was using to test.