# Certificate renew problem **URL:** \ **Category:** Help\ **Created:** [August 2, 2018, 10:10am UTC](https://community.letsencrypt.org/t/certificate-renew-problem/68303 "2018-08-02T10:10:35Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![kellej](https://avatars.discourse-cdn.com/v4/letter/k/51bf81/32.png) [@kellej](https://community.letsencrypt.org/u/kellej)\ **Post date:** [August 2, 2018, 10:10am UTC](https://community.letsencrypt.org/t/certificate-renew-problem/68303/1 "2018-08-02T10:10:35Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: www.vasarhelyanno.hu, vasarhelyanno.hu, api.vasarhelyanno.hu I ran this command: certbot --apache certonly It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Starting new HTTPS connection (1): [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org) Which names would you like to activate HTTPS for? * * * 1: vasarhelyanno.hu 2: api.vasarhelyanno.hu 3: static.vasarhelyanno.hu 4: www.static.vasarhelyanno.hu 5: www.vasarhelyanno.hu * * * Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter ‘c’ to cancel): 2 Obtaining a new certificate Performing the following challenges: tls-sni-01 challenge for api.vasarhelyanno.hu Waiting for verification… Cleaning up challenges Failed authorization procedure. api.vasarhelyanno.hu (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested e4b04d2f57e715b1fd59000622a01da4.8b93d53a6186b5cc132154c49ab4ca82.acme.invalid from [2a00:c760:83:def:aced:fff0:0:2018]:443. Received 2 certificate(s), first certificate had names “mail.vasarhelyanno.hu, vasarhelyanno.hu, www.vasarhelyanno.hu” IMPORTANT NOTES: - The following errors were reported by the server: My web server is (include version): apache2 2.4.34-1 The operating system my web server runs on is (include version): ubuntu 16.04.1 My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [August 2, 2018, 12:46pm UTC](https://community.letsencrypt.org/t/certificate-renew-problem/68303/2 "2018-08-02T12:46:54Z")
Hi, The error is generating due to tls-sni-01, while I’m not sure why it’s generating the error, tls-sni-01 has been disabled for new domains for security purposes (however this is not related to your domain) There’s one easy way to resolve this… try issueing the certificate with `sudo certbot certonly --preferred-challenge http -d api.vasarhelyanno.hu` after a successful issuerance, for future renewals, just run `sudo certbot renew` (as usual) Thank you ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [August 2, 2018, 4:38pm UTC](https://community.letsencrypt.org/t/certificate-renew-problem/68303/3 "2018-08-02T16:38:08Z")
One possibility is that the `api` subdomain has been moved to a separate server but that the IPv6 DNS records haven't been updated accordingly. > [@stevenzhu](#): > > There’s one easy way to resolve this… > try issueing the certificate with `sudo certbot certonly --preferred-challenge http -d api.vasarhelyanno.hu` This is a good tip. (Don't forgot the `--apache`.) The version of Certbot will need to be new enough to have HTTP-01 support in the Apache plugin! ---
**Author:** ![kellej](https://avatars.discourse-cdn.com/v4/letter/k/51bf81/32.png) [@kellej](https://community.letsencrypt.org/u/kellej)\ **Post date:** [August 3, 2018, 6:00am UTC](https://community.letsencrypt.org/t/certificate-renew-problem/68303/4 "2018-08-03T06:00:00Z")
Thank you, but not worked: certbot --apache certonly --preferred-challenge http -d api.vasarhelyanno.hu Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Starting new HTTPS connection (1): [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org) Obtaining a new certificate Performing the following challenges: http-01 challenge for api.vasarhelyanno.hu Waiting for verification… Cleaning up challenges Failed authorization procedure. api.vasarhelyanno.hu (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://api.vasarhelyanno.hu/.well-known/acme-challenge/CsWtTOu429q45jXhiKnRKlF7gZpGyX-n0olVNcdT2Mo:](http://api.vasarhelyanno.hu/.well-known/acme-challenge/CsWtTOu429q45jXhiKnRKlF7gZpGyX-n0olVNcdT2Mo:) " 404 Not Found # Not Found \ **Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [August 3, 2018, 6:27am UTC](https://community.letsencrypt.org/t/certificate-renew-problem/68303/5 "2018-08-03T06:27:34Z") Hi @kellej @schoen is right, your IPV6 records serve different content compare to IPV4 record… [https://letsdebug.net/api.vasarhelyanno.hu/3175](https://letsdebug.net/api.vasarhelyanno.hu/3175) Please try to remove the IPV6 record and re run the certbot, then it should be working correctly… Thank you ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [August 3, 2018, 8:53am UTC](https://community.letsencrypt.org/t/certificate-renew-problem/68303/6 "2018-08-03T08:53:00Z")
> [@stevenzhu](#): > > Please try to remove the IPV6 record (…) Or even better: point it to the correct IPv6 address if the current server has a working IPv6 connection. IPv6 is the future of the internet, removing it permanently would be, personally, not correct. Removing it temporary for debugging purposes is of course not a problem. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 2, 2018, 8:53am UTC](https://community.letsencrypt.org/t/certificate-renew-problem/68303/7 "2018-09-02T08:53:06Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.