Clean server install, one website, 403 error

My domain is: derek.dahlsad.com

I ran this command: certbot -apache v

It produced this output:

[root@usfour httpd]# certbot --apache -v

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator apache, Installer apache

Which names would you like to activate HTTPS for?

We recommend selecting either all domains, or all domains in a VirtualHost/server block.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1: dahlsad.com

2: derek.dahlsad.com

3: www.dahlsad.com

4: usfour.equilibri-yum.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Select the appropriate numbers separated by commas and/or spaces, or leave input

blank to select all options shown (Enter 'c' to cancel): 2

Requesting a certificate for derek.dahlsad.com

Performing the following challenges:

http-01 challenge for derek.dahlsad.com

Waiting for verification...

Challenge failed for domain derek.dahlsad.com

http-01 challenge for derek.dahlsad.com

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:

Domain: derek.dahlsad.com

Type: unauthorized

Detail: 23.105.39.97: Invalid response from http://derek.dahlsad.com/.well-known/acme-challenge/z9r8-1Nge-YUOPtftbR_zC3rdEnj_RYULwWmP30FY1w: 403

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Cleaning up challenges

Some challenges have failed.

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):

Server version: Apache/2.4.62 (AlmaLinux)

Server built: Jan 29 2025 00:00:00

The operating system my web server runs on is (include version):

AlmaLinux release 9.5 (Teal Serval)

My hosting provider, if applicable, is: virtual server from Leaseweb

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 3.1.0

So, I’ve never used Let’s Encrypt before, and this is a “new” server – clean install of OS, installed Apache and other things, and there’s just one domain on it – dahlsad.com – and I’m trying to install certificates for derek.dahlsad.com (dahlsad.com, www.dahlsad.com, and usfour.equilibri-yum.com (the server’s canonical name) are also VirtualHosts but all get the same error.)

I’ve gone through the previous messages about 403 errors. I’ve change the owner on /var/lib/letsencrypt to apache:apache, the folder that the html files are in has been changed to apache:apache, the folder where my http.conf and includes has been changed to apache:apache (which I believe is bad form). http://derek.dahlsad.com works fine. https://derek.dahlsad.com gives a ERR_SSL_PROTOCOL_ERROR but I don’t see anything in ssl_error_log. Access_log does show the connection attempt:

23.178.112.104 - - [21/Aug/2025:12:16:11 +0000] "GET /.well-known/acme-challenge/z9r8-1Nge-YUOPtftbR_zC3rdEnj_RYULwWmP30FY1w HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"

Any suggestions appreciated, thanks!

1 Like

Welcome @derekdahlsad

As long as Certbot is running as root you should not be changing permissions of folders. Based on your command prompt you probably are but usually people just use sudo instead

Let's start by you showing output of this

sudo httpd -t -D DUMP_VHOSTS

Did you check the default Apache error log? That often has more details about a 403. You mentioned an ssl error log but I am not sure what you mean by that.

3 Likes

[root@usfour derek]# httpd -t -D DUMP_VHOSTS

VirtualHost configuration:
23.105.39.97:443 is a NameVirtualHost
default server www.dahlsad.com (/www/vhostconfig/dahlsad.include:1)
port 443 namevhost www.dahlsad.com (/www/vhostconfig/dahlsad.include:1)
port 443 namevhost derek.dahlsad.com (/www/vhostconfig/dahlsad.include:16)

23.105.39.97:80 is a NameVirtualHost
default server usfour.equilibri-yum.com (/www/vhostconfig/1.include:1)
port 80 namevhost usfour.equilibri-yum.com (/www/vhostconfig/1.include:1)
port 80 namevhost dahlsad.com (/www/vhostconfig/dahlsad.include:9)
port 80 namevhost usfour (/www/vhostconfig/dahlsad.include:22)

The highlighted one is the one I’m trying to set up, but note that I get the same error no matter which ones I try to set up:

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: www.dahlsad.com
Type: unauthorized
Detail: 23.105.39.97: Invalid response from http://www.dahlsad.com/.well-known/acme-challenge/L8fLa1IfczRaGCXuB19a_FJkKzZNk2LkVlyszpGllQ0: 403

(And, I only expect to set up derek.dahlsad.com – the other vhosts are there so that Apache responds with something and I have control over it; like usfour.equilibri-yum.com is a bounce to Google.com to avoid snoopers poking around)

You don't have a VirtualHost for port 80 for that domain.

Any HTTP requests then fall into the default server for port 80. Which is usfour in your group of port 80 listeners. That is probably rejecting the request with a 403.

Your port 443 VHost for that is for www subdomain. You have one in port 80 just for the apex domain. You should keep port 80 and 443 consistent

3 Likes

[root@usfour vhostconfig]# httpd -t -D DUMP_VHOSTS
VirtualHost configuration:
23.105.39.97:443 is a NameVirtualHost
default server www.dahlsad.com (/www/vhostconfig/dahlsad.include:1)
port 443 namevhost www.dahlsad.com (/www/vhostconfig/dahlsad.include:1)
port 443 namevhost derek.dahlsad.com (/www/vhostconfig/dahlsad.include:22)
23.105.39.97:80 is a NameVirtualHost
default server usfour.equilibri-yum.com (/www/vhostconfig/1.include:1)
port 80 namevhost usfour.equilibri-yum.com (/www/vhostconfig/1.include:1)
port 80 namevhost usfour (/www/vhostconfig/dahlsad.include:8)
port 80 namevhost dahlsad.com (/www/vhostconfig/dahlsad.include:15)
port 80 namevhost derek.dahlsad.com (/www/vhostconfig/dahlsad.include:28)

Was missing a ServerName reference on the port 80 one – however, same error:

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: derek.dahlsad.com
Type: unauthorized
Detail: 23.105.39.97: Invalid response from http://derek.dahlsad.com/.well-known/acme-challenge/LeWnj_TYvUWf_lddkPC_-1l9bftQjFNUxt2mhj2VO2E: 403

Also, I removed everything else – just the site I want online:

ServerAdmin admin@blacksunn.net ServerName derek.dahlsad.com DocumentRoot /www/derek-sites/derekdahlsad/ ServerAdmin admin@blacksunn.net ServerName derek.dahlsad.com DocumentRoot /www/derek-sites/derekdahlsad/

[root@usfour vhostconfig]# httpd -t -D DUMP_VHOSTS
VirtualHost configuration:
23.105.39.97:443 derek.dahlsad.com (/www/vhostconfig/dahlsad.include:1)
23.105.39.97:80 derek.dahlsad.com (/www/vhostconfig/dahlsad.include:7)

Same thing:

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: derek.dahlsad.com
Type: unauthorized
Detail: 23.105.39.97: Invalid response from http://derek.dahlsad.com/.well-known/acme-challenge/b3YS2NB_pv4be8T6faYueRUwQXGBTGcBoeE13i16kqg: 403

Hmmm, I’m not sure why this worked, but I ran:

certbot certonly --webroot -w /www/derek-sites/derekdahlsad

And it downloaded two PEMs to /etc/letsencrypt/live/derek.dahlsad.com/.

Then I ran

certbot –apache

and it asked me if I wanted to reinstall the existing certificate…

and now the site has HTTPS running successfully.

I’ll keep an eye on it to see if it does update automatically, and I’ll try this with the other subdomains.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.