Certbot renewal http-01 error

Probably not. The idea about the webroot plugin is that you can use your existing configuration to serve the challenge file.

I'm not sure I understand the question here. It's rather simple. The webroot plugin has to point to the "DocumentRoot" of your VirtualHost and it needs to be able to serve files under the /.well-known/acme-challenge/ path. That's it.

No, the installer plugin is separate from the webroot authenticator plugin.

An expired certificate is not a problem for the validation servers. It even ignores self-signed certificates.

1 Like

What's the content of

Is there the same DocumentRoot used?

PS: No, unrelevant, you have removed the redirect http -> https.

I think apache prevents access to hidden folders. I am looking into IndexIgnoreReset as I can't access anything in a hidden folder

I am at my wits end ! wget http://jstjesuits.org/.well-known/acme-challenge/index.html gives 404 but http://jstjesuits.org/.well-known2/acme-challenge/index.html works. I even moved .well-known2 to .well-known and it fails.

Both of those URLs are giving the default Apache page, so actually none of those work.

1 Like

OK its fixed now. I rebooted the system. After that .well-known didn't give a 404. After I installed the new certs and reverted everything back to the way it used to be. I tested the certbot again, and it failed. Wget shows its once again failing if the folder name is .well-known but its OK if its .well-known2. Its a mystery whats causing this, but its probably related to my system and not letsencrypt. I am wondering if its some apparmor side effect. Anyway, thanks for the responses. I will have to deal with this issue again in 90 days, sigh

Hah! I found the issue. fail2ban had a regex for /var/www/jstb/.well-known/security.txt . Something I must have added , having looked at cyber attackers doing GETs for various files in my apache logfiles. At that time I didn't realise that .well-known was related to letsencrypt, and added that as a regex to ban cyber attackers. Not sure why the reboot helped, maybe it unbanned the IP I was using to test.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.