# Certificate Renewal fails

**URL:** <https://community.letsencrypt.org/t/certificate-renewal-fails/156703>\
**Category:** Help\
**Created:** [July 28, 2021, 9:22pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703 "2021-07-28T21:22:34Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Doc](https://avatars.discourse-cdn.com/v4/letter/d/f07891/32.png) [@Doc](https://community.letsencrypt.org/u/Doc)\
**Post date:** [July 28, 2021, 9:22pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/1 "2021-07-28T21:22:34Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: [bwrs.cdaytech.co.uk](http://bwrs.cdaytech.co.uk)

I ran this command: docker compose, shown below

It produced this output:

Cert is due for renewal, auto-renewing...  
certbot\_1 | Non-interactive renewal: random delay of 57.120881546758554 seconds  
certbot\_1 | Plugins selected: Authenticator webroot, Installer None  
certbot\_1 | Renewing an existing certificate for [bwrs.cdaytech.co.uk](http://bwrs.cdaytech.co.uk)  
certbot\_1 | Performing the following challenges:  
certbot\_1 | http-01 challenge for [bwrs.cdaytech.co.uk](http://bwrs.cdaytech.co.uk)  
certbot\_1 | Using the webroot path /var/www/certbot for all unmatched domains.  
certbot\_1 | Waiting for verification...  
certbot\_1 | Challenge failed for domain [bwrs.cdaytech.co.uk](http://bwrs.cdaytech.co.uk)  
certbot\_1 | http-01 challenge for [bwrs.cdaytech.co.uk](http://bwrs.cdaytech.co.uk)  
certbot\_1 | Cleaning up challenges  
certbot\_1 | Failed to renew certificate [bwrs.cdaytech.co.uk](http://bwrs.cdaytech.co.uk) with error: Some challenges have failed.  
certbot\_1 |  
certbot\_1 | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
certbot\_1 | All renewals failed. The following certificates could not be renewed:  
certbot\_1 | /etc/letsencrypt/live/bwrs.cdaytech.co.uk/fullchain.pem (failure)  
certbot\_1 | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
certbot\_1 | 1 renew failure(s), 0 parse failure(s)  
certbot\_1 | IMPORTANT NOTES:  
certbot\_1 | - The following errors were reported by the server:  
certbot\_1 |  
certbot\_1 | Domain: [bwrs.cdaytech.co.uk](http://bwrs.cdaytech.co.uk)  
certbot\_1 | Type: unauthorized  
certbot\_1 | Detail: Invalid response from  
certbot\_1 | [https://bwrs.cdaytech.co.uk/.well-known/acme-challenge/tDli8qVGj0sEjyTDt87O1rGXfhvmbBywZrz6gSHA8Go](https://bwrs.cdaytech.co.uk/.well-known/acme-challenge/tDli8qVGj0sEjyTDt87O1rGXfhvmbBywZrz6gSHA8Go)  
certbot\_1 | [2606:4700:3030::ac43:a9bd]: "\n \n  
certbot\_1 | \<html lang="en"\>\n \n \<meta  
certbot\_1 | charset="utf-8"\>\n "  
certbot\_1 |  
certbot\_1 | To fix these errors, please make sure that your domain name was  
certbot\_1 | entered correctly and the DNS A/AAAA record(s) for that domain  
certbot\_1 | contain(s) the right IP address.

My web server is (include version): nginx

The operating system my web server runs on is (include version): docker, on ubunut 20.04

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): docker certbot/certbot

Docker-compose:  
certbot:  
image: certbot/certbot  
restart: always  
volumes:

- ./data/certbot/conf:/etc/letsencrypt
- ./data/certbot/www:/var/www/certbot  
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

nginx.conf:

```nohighlight
events {}

http{
  server {
    listen 80;
    server_name bwrs.cdaytech.co.uk;

    location / {
      return 301 https://$host$request_uri;
    }
    location /.well-known/acme-challenge/ {
      root /var/www/certbot;
    }
  }

  server {
    listen 443 ssl;
    server_name bwrs.cdaytech.co.uk;

    ssl_certificate /etc/letsencrypt/live/bwrs.cdaytech.co.uk/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/bwrs.cdaytech.co.uk/privkey.pem;

    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    include /etc/nginx/cloudflare;

    location / {
        proxy_pass http://bitwarden;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location /admin {
        proxy_pass http://bitwarden/admin;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        auth_basic "Administrator Area";
        auth_basic_user_file /etc/nginx/.htpasswd;
   }
  }
}

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 28, 2021, 9:36pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/2 "2021-07-28T21:36:10Z")

</div>

Hi @Doc, and welcome to the LE community forum 🙂

I suspect that order matters:

> [@Doc](#):
>
> ```nohighlight
> location / {
> return 301 https://$host$request_uri;
> }
> location /.well-known/acme-challenge/ {
> root /var/www/certbot;
> }
> 
> ```

Where everything is being redirected before it can be matched to the challenge path.

---

<div class="post-metadata">

**Author:** ![Doc](https://avatars.discourse-cdn.com/v4/letter/d/f07891/32.png) [@Doc](https://community.letsencrypt.org/u/Doc)\
**Post date:** [July 29, 2021, 10:11am UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/3 "2021-07-29T10:11:38Z")

</div>

Hi @rg305, and thanks for your help. Unfortunately swapping the order doesn't allow it to renew the certificate either. As the current certificate is no longer valid, I have attempted to run the script below, but receive the same error message.

script:

#!/bin/bash

if ! [-x "$(command -v docker-compose)"]; then  
echo 'Error: docker-compose is not installed.' \>&2  
exit 1  
fi

domains=([bwrs.cdaytech.co.uk](http://bwrs.cdaytech.co.uk))  
rsa\_key\_size=4096  
data\_path="./data/certbot"  
[email="admin@cdaytech.co.uk](mailto:email=%22admin@cdaytech.co.uk)" # Adding a valid address is strongly recommended  
staging=1 # Set to 1 if you're testing your setup to avoid hitting request limits

if [-d "$data\_path"]; then  
read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision  
if ["$decision" != "Y"] && ["$decision" != "y"]; then  
exit  
fi  
fi

if [! -e "$data\_path/conf/options-ssl-nginx.conf"] || [! -e "$data\_path/conf/ssl-dhparams.pem"]; then  
echo "### Downloading recommended TLS parameters ..."  
mkdir -p "$data\_path/conf"  
curl -s [https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot\_nginx/\_internal/tls\_configs/options-ssl-nginx.conf](https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf) \> "$data\_path/conf/options-ssl-nginx.conf"  
curl -s [https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem](https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem) \> "$data\_path/conf/ssl-dhparams.pem"  
echo  
fi

echo "### Creating dummy certificate for $domains ..."  
path="/etc/letsencrypt/live/$domains"  
mkdir -p "$data\_path/conf/live/$domains"  
docker-compose run --rm --entrypoint "  
openssl req -x509 -nodes -newkey rsa:$rsa\_key\_size -days 1  
-keyout '$path/privkey.pem'   
-out '$path/fullchain.pem'   
-subj '/CN=localhost'" certbot  
echo

echo "### Starting nginx ..."  
docker-compose up --force-recreate -d nginx  
echo

echo "### Deleting dummy certificate for $domains ..."  
docker-compose run --rm --entrypoint "  
rm -Rf /etc/letsencrypt/live/$domains &&   
rm -Rf /etc/letsencrypt/archive/$domains &&   
rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot  
echo

echo "### Requesting Let's Encrypt certificate for $domains ..."  
#Join $domains to -d args  
domain\_args=""  
for domain in "${domains[@]}"; do  
domain\_args="$domain\_args -d $domain"  
done

# Select appropriate email arg

case "$email" in  
"") email\_arg="--register-unsafely-without-email" ;;  
\*) email\_arg="--email $email" ;;  
esac

# Enable staging mode if needed

if [$staging != "0"]; then staging\_arg="--staging"; fi

docker-compose run --rm --entrypoint "  
certbot certonly --webroot -w /var/www/certbot   
$staging\_arg   
$email\_arg   
$domain\_args   
--rsa-key-size $rsa\_key\_size   
--agree-tos   
--force-renewal" certbot  
echo

echo "### Reloading nginx ..."  
docker-compose exec nginx nginx -s reload

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 29, 2021, 1:40pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/4 "2021-07-29T13:40:27Z")

</div>

> [@Doc](#):
>
> Unfortunately swapping the order doesn't allow it to renew the certificate either.

> [@Doc](#):
>
> I have attempted to run the script below

> [@Doc](#):
>
> staging=1 # Set to 1 if you're testing your setup to avoid hitting request limits

Did you run that in staging?

> [@Doc](#):
>
> echo "### Deleting dummy certificate for $domains ..."  
> docker-compose run --rm --entrypoint "  
> rm -Rf /etc/letsencrypt/live/$domains &&  
> rm -Rf /etc/letsencrypt/archive/$domains &&  
> rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot

That has got to be the worst production code ever used here.  
It seems to delete existing certs without even checking their validity.  
And it doesn't even use the built-in `certbot delete` parameter.  
Very pre-alpha / very early in the development code cycle (not production ready).

---

<div class="post-metadata">

**Author:** ![Doc](https://avatars.discourse-cdn.com/v4/letter/d/f07891/32.png) [@Doc](https://community.letsencrypt.org/u/Doc)\
**Post date:** [July 29, 2021, 1:54pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/5 "2021-07-29T13:54:53Z")

</div>

It was run in staging to test, but error is present with staging set to 0. The deleted certs are temporary certs to allow nginx to start for the first time without a valid cert, and would normally only be used to generate the first cert so no need to test for validity. After that, update would be handled by certbot using the docker-compose file from the first post.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 29, 2021, 2:08pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/6 "2021-07-29T14:08:43Z")

</div>

OK, so begin at the beginning...

hmm...  
Do you realize that your site is behind Cloudflare IPs?

```nohighlight
Name: bwrs.cdaytech.co.uk
Addresses: 2606:4700:3030::ac43:a9bd
           2606:4700:3032::6815:1bcb
           172.67.169.189
           104.21.27.203

```

And as such, HTTP requests will never reach your actual site (via HTTP); as they will all be redirected to HTTPS (by Cloudflare) first.  
As well as other CF consideration(s) needed to enable you to get a cert when behind them.  
[I don't use CF, so I can't speak with much detail here]

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 29, 2021, 2:13pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/7 "2021-07-29T14:13:10Z")

</div>

So start by adding HTTPS challenge file request consideration (as was done in the HTTP server block):

> [@Doc](#):
>
> ```nohighlight
> server {
> listen 443 ssl;
> server_name bwrs.cdaytech.co.uk;
> 
> ssl_certificate /etc/letsencrypt/live/bwrs.cdaytech.co.uk/fullchain.pem;
> ssl_certificate_key /etc/letsencrypt/live/bwrs.cdaytech.co.uk/privkey.pem;
> 
> include /etc/letsencrypt/options-ssl-nginx.conf;
> ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
> include /etc/nginx/cloudflare;
> 
> location / {
> proxy_pass http://bitwarden;
> proxy_set_header Host $host;
> proxy_set_header X-Real-IP $remote_addr;
> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
> proxy_set_header X-Forwarded-Proto $scheme;
> }
> location /admin {
> proxy_pass http://bitwarden/admin;
> proxy_set_header Host $host;
> proxy_set_header X-Real-IP $remote_addr;
> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
> proxy_set_header X-Forwarded-Proto $scheme;
> auth_basic "Administrator Area";
> auth_basic_user_file /etc/nginx/.htpasswd;
> }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![Doc](https://avatars.discourse-cdn.com/v4/letter/d/f07891/32.png) [@Doc](https://community.letsencrypt.org/u/Doc)\
**Post date:** [July 29, 2021, 2:48pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/8 "2021-07-29T14:48:54Z")

</div>

Of Course! I completely missed that it was looking for the response on https. Made that change and it all seems good now.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 29, 2021, 2:50pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/9 "2021-07-29T14:50:03Z")

</div>

Glad to have helped 🙂

Cheers form Miami 🍻

#FreeCuba

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [August 28, 2021, 2:50pm UTC](https://community.letsencrypt.org/t/certificate-renewal-fails/156703/10 "2021-08-28T14:50:27Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.