# Challenge validation has failed

**URL:** <https://community.letsencrypt.org/t/challenge-validation-has-failed/172785>\
**Category:** Help\
**Created:** [February 26, 2022, 7:45pm UTC](https://community.letsencrypt.org/t/challenge-validation-has-failed/172785 "2022-02-26T19:45:48Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![mario](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@mario](https://community.letsencrypt.org/u/mario)\
**Post date:** [February 26, 2022, 7:45pm UTC](https://community.letsencrypt.org/t/challenge-validation-has-failed/172785/1 "2022-02-26T19:45:48Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:  
mmrmedia.xs4all.nl

I ran this command:  
/usr/bin/dehydrated -c

It produced this output:

# INFO: Using main config file /etc/dehydrated/config

# INFO: Running /usr/bin/dehydrated as xxxxx/wheel

# INFO: Using main config file /etc/dehydrated/config

Processing mmrmedia.xs4all.nl

- Signing domains...
- Generating private key...
- Generating signing request...
- Requesting new certificate order from CA...
- Received 1 authorizations URLs from the CA
- Handling authorization for mmrmedia.xs4all.nl
- 1 pending challenge(s)
- Deploying challenge tokens...
- Responding to challenge for mmrmedia.xs4all.nl authorization...
- Cleaning challenge tokens...
- Challenge validation has failed ☹  
ERROR: Challenge is invalid! (returned: invalid) (result: {  
"type": "http-01",  
"status": "invalid",  
"error": {  
"type": "urn:ietf:params:acme:error:caa",  
"detail": "CAA record for mmrmedia.xs4all.nl prevents issuance",  
"status": 403  
},  
"url": "[https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/1780536498/cRF4fA](https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/1780536498/cRF4fA)",  
"token": "CdBLgEwasFq2ETIVpmSB1jEy0fa9iMSZ35uRctpT8W0",  
"validationRecord": [  
{  
"url": "[http://mmrmedia.xs4all.nl/.well-known/acme-challenge/CdBLgEwasFq2ETIVpmSB1jEy0fa9iMSZ35uRctpT8W0](http://mmrmedia.xs4all.nl/.well-known/acme-challenge/CdBLgEwasFq2ETIVpmSB1jEy0fa9iMSZ35uRctpT8W0)",  
"hostname": "mmrmedia.xs4all.nl",  
"port": "80",  
"addressesResolved": [  
"80.100.158.243"  
],  
"addressUsed": "80.100.158.243"  
}  
],  
"validated": "2022-02-26T19:26:25Z"  
})

My web server is (include version):  
Apache 2.4.52

The operating system my web server runs on is (include version):  
Linux Slackware 14.2 kernel 4.4.276  
My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):  
Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):  
no

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):  
dehydrated-0.6.5

The output of dig -t txt mmrmedia.xs4all.nl  
mmrmedia.xs4all.nl. 3600 IN TXT "kpn-domain verification=f8f5431b486c44e489f37d56e89e8277"

What could be the problem here.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [February 26, 2022, 7:53pm UTC](https://community.letsencrypt.org/t/challenge-validation-has-failed/172785/2 "2022-02-26T19:53:22Z")

</div>

> [@mario](#):
>
> CAA record for mmrmedia.xs4all.nl prevents issuance

You need to add a CAA record to override the CAA records for your parent domain (which are kind of a mess)

```nohighlight
dig caa xs4all.nl

; <<>> DiG 9.16.11 <<>> caa xs4all.nl
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56523
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;xs4all.nl. IN CAA

;; ANSWER SECTION:
xs4all.nl. 3600 IN CAA 0 issuewild "sectigo.com"
xs4all.nl. 3600 IN CAA 0 issuewild "letsencrypt.org"
xs4all.nl. 3600 IN CAA 0 issue "comodoca.com"
xs4all.nl. 3600 IN CAA 0 issue "sectigo.com"

;; Query time: 63 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Feb 26 20:50:11 CET 2022
;; MSG SIZE rcvd: 171

```

---

<div class="post-metadata">

**Author:** ![mario](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@mario](https://community.letsencrypt.org/u/mario)\
**Post date:** [February 26, 2022, 8:00pm UTC](https://community.letsencrypt.org/t/challenge-validation-has-failed/172785/3 "2022-02-26T20:00:04Z")

</div>

Thanks for your quick answer.  
Where should i do that xs4all.nl is my provider and i am on a subdomain.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [February 26, 2022, 8:01pm UTC](https://community.letsencrypt.org/t/challenge-validation-has-failed/172785/4 "2022-02-26T20:01:33Z")

</div>

Do you have any control over your DNS records?

Read here: [Certificate Authority Authorization (CAA) - Let's Encrypt](https://letsencrypt.org/docs/caa/)

Otherwise, ask them to modify their records like this:

```nohighlight
xs4all.nl. 3600 IN CAA 0 issue "letsencrypt.org"
xs4all.nl. 3600 IN CAA 0 issue "comodoca.com"
xs4all.nl. 3600 IN CAA 0 issue "sectigo.com"

```

(issue _includes_ issuewild)

---

<div class="post-metadata">

**Author:** ![mario](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@mario](https://community.letsencrypt.org/u/mario)\
**Post date:** [February 26, 2022, 8:08pm UTC](https://community.letsencrypt.org/t/challenge-validation-has-failed/172785/5 "2022-02-26T20:08:25Z")

</div>

No i have no control over the DNS records.  
I was trying to see if i could get it working .  
But i am moving to an other provider next month, so i will try it there and i have some control over DNS

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [February 26, 2022, 8:09pm UTC](https://community.letsencrypt.org/t/challenge-validation-has-failed/172785/6 "2022-02-26T20:09:40Z")

</div>

You can use any other dynamic dns provider, like duckdns or afraid.

---

<div class="post-metadata">

**Author:** ![mario](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@mario](https://community.letsencrypt.org/u/mario)\
**Post date:** [February 26, 2022, 8:36pm UTC](https://community.letsencrypt.org/t/challenge-validation-has-failed/172785/7 "2022-02-26T20:36:24Z")

</div>

Thanks for the tip i will look at that

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [March 28, 2022, 8:37pm UTC](https://community.letsencrypt.org/t/challenge-validation-has-failed/172785/8 "2022-03-28T20:37:16Z")

</div>

Closed on March 28, 2022, 8:37pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.