DirectAdmin Certbot request failing 404 with Apache

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: turbodj.com

I ran this command: i dunno

It produced this output: error error error error error error error error error error

My web server is (include version): the one i rent

The operating system my web server runs on is (include version): centos 8

My hosting provider, if applicable, is: why?

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Webmin

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): dunno

1 Like

Our community will need more information in order to answer this question. What do you mean by “banned?” What kind of testing are you trying to do? What is your setup?

3 Likes

keep saying i attempted to many times.. i dont kno wwhats wrong, trial and error gets my punished, i NEED this to work

Why does every post here get flagged and takes 30 minutes to get authorized? kind amakes trying to seek help impossible, consider this a rant as i know this post wont show for 30 minutes and i need disperate help and i cant even speak on thise forum

Our forum software uses automated spam detection that flagged your posts; I’m not sure why, but I released them as soon as I noticed. We are a small organization, it is the holiday season for us, and most participants here are volunteers.

4 Likes

:: too many failed authorizations (5) i keep getting this, makes trouble shooting a very slow process

There is a Let's Encrypt Staging system for testing purposes. It is much less restrictive about failures. I don't know how to set that with DirectAdmin. You'll have to check with their support channel or forum. Or perhaps a different volunteer will know.

I see you got a valid Let's Encrypt cert in Oct that does not expire until Jan 9. But, your server is using a cert you got prior to that which just expired. This tells me something has gone wrong with your server config and likely the DirectAdmin setup.

In any event, just based on your cert history it looks like something significant has changed since Sep30.

Your cert history from the public logs:

3 Likes

i am running 5 sites off that same box, i dotn know why this 1 main and most important site is failing while the others are fine, all are set up identical

1 Like

tried again now type: unauthorized,m invalid response on webased... to many requests on DNS based

I don't either. You haven't given us much to work with.

Have you tried the DirectAdmin Troubleshooting Guide? If so, what steps did you check and what were the results? See: Troubleshooting Let's Encrypt Errors | Directadmin Docs

For example, in your cert history I see a cert from Oct11 with just the domain turbodj.com. Yet, the certs prior to that included that name and several others. In Oct you must have done something different. Although, I am pretty sure the DirectAdmin forum will be a more productive avenue for you.

Google showed some example commands for using the LE Staging system but I don't know DirectAdmin well enough to vouch for them. I'd follow DA Troubleshooting first.

You get 5 failures per hour against the LE Production system. I recommend doing a more targetting debug with DA. Or, switch to using the Staging system. Some systems have their own rate limits. The exact error message that indicates an LE Rate limit is described here: Rate Limits - Let's Encrypt

3 Likes

Screenshot - 8fd715946f1384ed8ed16a123de3fd90 - Gyazo i pretty much kust click this one button.. i dont know whats being sent where by what and what has to look where to verify what, buty simethign aint working

and apparently my software will not lert me use the 'test' feature, it replies with "You've asked to renew/replace a seemingly valid certificate with a test certificate (domains: turbodj.com, admin.turbodj.com, mail.turbodj.com, webmail.turbodj.com, www.turbodj.com). We will not do that "

That was partially helpful. The part on the right of that screen would be helpful too. Or, just copy/paste here the error line that starts with "Detail: "

I see how you ended up here. DA uses a program called Certbot to get Let's Encrypt certs. And, Certbot always refers people here for any kind of problem.

If you were running Certbot manually we could better give you suggestions on how to debug and correct your problem. But, when Certbot is running inside a configurator like DA you really need to work with that configurator vendor. Even when we know the exact error we are likely to say you need to check something in your Apache or DA config. Keeping DA and your other components in sync is important. Something has likely gotten out of sync and you need to get that restored.

Sometimes a volunteer here will have personal experience with such a configurator. But, the quickest and more reliable approach is to visit the DA forum: https://forum.directadmin.com/

Or, as indicated in their Troubleshooting guide, submit a support ticket to DA.

2 Likes

Detail: 209.222.97.163: Invalid response from http://admin.turbodj.com/.well-known/acme-challenge/ouQyJb_H3NKKxwYrTrAw4BLia8Uk1Ir-sXmG5rX-pfE: 404

Yes, well, that means the DocumentRoot in your Apache config for those domain names don't match what DA told Certbot to use for that domain. Does that mean anything to you?

Are you able to run a command like: sudo certbot certificates

And copy/paste the output here?

1 Like

Saving debug log to /var/log/letsencrypt/letsencrypt.log


Found the following certs:
Certificate Name: excheker.com
Serial Number: 568d29414372306557272f8c644e83c2d65
Key Type: RSA
Domains: excheker.com admin.excheker.com mail.excheker.com webmail.excheker. com www.excheker.com
Expiry Date: 2026-03-07 22:34:40+00:00 (VALID: 68 days)
Certificate Path: /etc/letsencrypt/live/excheker.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/excheker.com/privkey.pem
Certificate Name: gridatc.com
Serial Number: 3cf671b5d07abaafac6904fa3c414fffc1e
Key Type: RSA
Domains: gridatc.com admin.gridatc.com mail.gridatc.com webmail.gridatc.com www.gridatc.com
Expiry Date: 2025-04-24 03:09:40+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/gridatc.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/gridatc.com/privkey.pem
Certificate Name: gridtalkie.com
Serial Number: 55275a4771a64b1b5ef0af5917a78547c66
Key Type: RSA
Domains: gridtalkie.com admin.gridtalkie.com mail.gridtalkie.com webmail.gri dtalkie.com www.gridtalkie.com
Expiry Date: 2026-03-07 17:59:41+00:00 (VALID: 68 days)
Certificate Path: /etc/letsencrypt/live/gridtalkie.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/gridtalkie.com/privkey.pem
Certificate Name: turbodj.com
Serial Number: 548262692ac28bbf0761ec5be0fa75ae9d9
Key Type: RSA
Domains: turbodj.com admin.turbodj.com mail.turbodj.com webmail.turbodj.com www.turbodj.com
Expiry Date: 2025-12-28 23:39:42+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/turbodj.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/turbodj.com/privkey.pem
Certificate Name: unicomgrid.com
Serial Number: 4820cd8e70d5179ce278134ba99819cc337
Key Type: RSA
Domains: unicomgrid.com admin.unicomgrid.com mail.unicomgrid.com webmail.uni comgrid.com www.unicomgrid.com
Expiry Date: 2024-06-28 10:13:09+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/unicomgrid.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/unicomgrid.com/privkey.pem

OK. that's good.

Please show contents of file below. I don't know that this will lead to a solution. Because if your DA setup and your Apache are out of sync I can't help get that sorted. But, maybe it will be a clue

/etc/letsencrypt/renewal/turbodj.com.conf

As an aside, now that I know you can run Certbot directly you can test with the LE Staging system doing this:

sudo certbot renew --dry-run --cert-name turbodj.com
1 Like

renew_before_expiry = 30 days

version = 1.22.0
archive_dir = /etc/letsencrypt/archive/turbodj.com
cert = /etc/letsencrypt/live/turbodj.com/cert.pem
privkey = /etc/letsencrypt/live/turbodj.com/privkey.pem
chain = /etc/letsencrypt/live/turbodj.com/chain.pem
fullchain = /etc/letsencrypt/live/turbodj.com/fullchain.pem

Options used in the renewal process

[renewalparams]
reuse_key = True
account = b53570608a8a9b68bda318e4cbca42c0
rsa_key_size = 2048
server = https://acme-v02.api.letsencrypt.org/directory
authenticator = webroot
webroot_path = /home/turbodj/public_html,
autorenew = False
[[webroot_map]]
admin.turbodj.com = /home/turbodj/public_html
mail.turbodj.com = /home/turbodj/public_html
turbodj.com = /home/turbodj/public_html
webmail.turbodj.com = /home/turbodj/public_html
www.turbodj.com = /home/turbodj/public_html