Domain unauthorized

kameleon1er · May 12, 2019, 9:41pm

Hi guys welcome back. I’m in troubles ; I’ve

My domain is: kameleon.fr I’m using ./certbot-auto and I don’t understand the error :

sudo ./certbot-auto --apache -d srv-a.kameleon.fr
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for srv-a.kameleon.fr
Waiting for verification...
Challenge failed for domain srv-a.kameleon.fr
http-01 challenge for srv-a.kameleon.fr
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: srv-a.kameleon.fr
   Type:   unauthorized
   Detail: Invalid response from
   http://srv-a.kameleon.fr/.well-known/acme-challenge/P8U8he1KNC10bo-iEcuVmp8g9s0f6Kta992BrggW7VI
   [163.172.131.140]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
   2.0//EN\">\n<html><head>\n<title>404 Not
   Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

but https://www.ssllabs.com/ssltest/analyze.html?d=master.kameleon.fr is red

Thanks a lot for your help. Best regards.

JuergenAuer · May 12, 2019, 9:56pm

Hi @kameleon1er

checking your subdomain the main things are ok ( https://check-your-website.server-daten.de/?q=srv-a.kameleon.fr ):

Domainname	Http-Status	Sec.	G
• http://srv-a.kameleon.fr/
163.172.131.140	200	0.064	H

• https://srv-a.kameleon.fr/
163.172.131.140	200	0.303	N
Certificate error: RemoteCertificateNameMismatch, RemoteCertificateChainErrors

• http://srv-a.kameleon.fr/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
163.172.131.140	404	0.060	A
Not Found

Port 80 is open, checking a not existing files in /.well-known/acme-challenge sends the expected http status 404 - Not Found.

So find your DocumentRoot, then use it:

certbot run -a webroot -i apache -w yourDocumentRoot -d srv-a.kameleon.fr

JuergenAuer · May 12, 2019, 10:24pm

PS:

There is nothing red, there is a Grade A.

There is one error you should fix, but Ssllabs doesn't check that.

You have the non-www and the www:

Host	T	IP-Address	is auth.	∑ Queries	∑ Timeout
master.kameleon.fr	A	163.172.131.140	yes	1	0
	AAAA		yes
www.master.kameleon.fr	C	master.kameleon.fr	yes	1	0
	A	163.172.131.140	yes

But your certificate

CN=master.kameleon.fr
	12.05.2019
	10.08.2019
expires in 89 days	master.kameleon.fr - 1 entry

has only the non-www, so your www version isn't secure.

Create one certificate with both domain names or remove the www dns entry.

kameleon1er · May 12, 2019, 11:34pm

Hi Juergen, thanks for your help one more time

I don’t really need the “www” , I’ll probably delete the entry in my registar panel.

but I would have liked to understand a little more Certbot.

For my other installed domains declared on my machine, I start by creating a simple Vhost *: 80, then I launch Certbot with its Apache module, and I have the impression that it looks at the configuration of Vhost and created itself the https version; “very cool”.

But for this one, he does not want to. The only thing different I see is that this is the domain that is declared as host of my machine.

kameleon1er · May 13, 2019, 12:50am

I tried to regenerate the cert for srv-a.kameleon.fr but something goes wrong…

sudo ./certbot-auto certonly -d srv-a.kameleon.fr --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Apache Web Server plugin (apache)
2: Spin up a temporary webserver (standalone)
3: Place files in webroot directory (webroot)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-3] then [enter] (press 'c' to cancel): 1
Plugins selected: Authenticator apache, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for srv-a.kameleon.fr
Waiting for verification...
Challenge failed for domain srv-a.kameleon.fr
http-01 challenge for srv-a.kameleon.fr
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: srv-a.kameleon.fr
   Type:   unauthorized
   Detail: Invalid response from
   http://srv-a.kameleon.fr/.well-known/acme-challenge/4QidPgZN10D9Kw1enho0fFDSt0R-3wvIykHWYSMEbfo
   [163.172.131.140]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
   2.0//EN\">\n<html><head>\n<title>404 Not
   Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.

My DNS Zone for settings for type A inputs look correct :

kameleon.fr.			0 A 163.172.131.140 	
	
master.kameleon.fr.		0 A 163.172.131.140 	
	
srv-a.kameleon.fr.		0 A 163.172.131.140

kameleon1er · May 13, 2019, 1:18am

certbot run -a webroot -i apache -w /var/www/html/ -d srv-a.kameleon.fr
doesn’t work

command not found
I also tried ./certbot run…

kameleon1er · May 13, 2019, 3:22am

this little robot drives me crazy

My Vhost for my document root

<VirtualHost *:80>
        ServerAdmin    contact@kameleon.fr
        ServerName     srv-a.kameleon.fr
        ServerAlias    www.srv-a.kameleon.fr


        DocumentRoot /var/www/html/index.html

        <Directory />
                Options FollowSymLinks
                AllowOverride All
        </Directory>
        <Directory /var/www/html/index.html>
                Options FollowSymLinks
                AllowOverride All
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =srv-a.kameleon.fr [OR]
RewriteCond %{SERVER_NAME} =www.srv-a.kameleon.fr
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

kameleon1er · May 13, 2019, 3:30am

For https :

<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerAdmin    contact@kameleon.fr
        ServerName     srv-a.kameleon.fr
        ServerAlias    www.srv-a.kameleon.fr


        DocumentRoot /var/www/html/index.html

        <Directory />
                Options FollowSymLinks
                AllowOverride All
        </Directory>
        <Directory /var/www/html/index.html>
                Options FollowSymLinks
                AllowOverride All
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.

# RewriteCond %{SERVER_NAME} =srv-a.kameleon.fr [OR]
# RewriteCond %{SERVER_NAME} =www.srv-a.kameleon.fr
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

<Directory /usr/share/phpmyadmin>
    Allow from all
    Deny from None
    Order Allow,Deny
</Directory>

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/srv-a.kameleon.fr-0001/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/srv-a.kameleon.fr-0001/privkey.pem
</VirtualHost>
</IfModule>

JuergenAuer · May 13, 2019, 7:23am

You have certbot-auto, so use that with sudo.

If the apache plugin doesn't work, it may not understand your configuration. But if you have a running webserver, webroot should always work.

That's

DocumentRoot /var/www/html/index.html

a terrible definition, a DocumentRoot should be a folder, not a file.

Change that to

DocumentRoot /var/www/html

then use this DocumentRoot as webroot.

kameleon1er · May 13, 2019, 1:21pm

Hi Juergen, I fixed the document root and relaunch certbot-auto but still have mismatch common name " |Common names|scw-60ac07|| --- | --- |Alternative names|- **INVALID**|"

After reading lot of posts this night in the forum, I found this one, very similar of my own "

Invalid Alternative Name "

and after exploring my memory I remember that this domain is very young in my server config, and probably my ex sys-admin didn’t use certbot-apache to deploy it. Damned !

How can I erase it and replace whith a fresh new one from my favorite little bot ?

Thanks a lot.

here my las command :

sudo ./certbot-auto --apache --cert-name srv-a.kameleon.fr
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/srv-a.kameleon.fr.conf)

What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

JuergenAuer · May 13, 2019, 1:38pm

Then install it, if there is already a certificate.

Certbot is waiting.

kameleon1er · May 13, 2019, 1:50pm

…

What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Attempt to reinstall this existing certificate
2: Renew & replace the cert (limit ~5 per 7 days)

choose option : 1

then :

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

choose opation : 1 too…

then :

Congratulations! You have successfully enabled https://srv-a.kameleon.fr and
https://www.srv-a.kameleon.fr

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=srv-a.kameleon.fr
https://www.ssllabs.com/ssltest/analyze.html?d=www.srv-a.kameleon.fr

Always T grade

JuergenAuer · May 13, 2019, 2:01pm

You have a curious configuration ( https://check-your-website.server-daten.de/?q=srv-a.kameleon.fr ):

Why? Your www version is correct, your non-www doesn’t work:

Domainname	Http-Status	redirect	Sec.	G
• http://www.srv-a.kameleon.fr/
163.172.131.140	301	https://www.srv-a.kameleon.fr/	0.053	A

• http://srv-a.kameleon.fr/
163.172.131.140	200		0.063	H

• https://srv-a.kameleon.fr/
163.172.131.140	200		0.330	N
Certificate error: RemoteCertificateNameMismatch, RemoteCertificateChainErrors

• https://www.srv-a.kameleon.fr/
163.172.131.140	404		0.670	M
Not Found

Your non-www has a self signed certificate

CN=scw-60ac07
	18.10.2016
	16.10.2026
expires in 2713 days

your www version has the correct certificate with both domain names:

CN=srv-a.kameleon.fr
	13.05.2019
	11.08.2019
expires in 90 days	
srv-a.kameleon.fr, www.srv-a.kameleon.fr - 2 entries

So check your vHost - configuration with

apachectl -S

find your www-vHost and add the non-www version as alias.

And deactivate your non-www version.

Or deactivate your www-version and change the rows with the certificate of your non-www version.

But it’s possible that there is no non-www version, because the default vHost with a self signed certificate is used.

kameleon1er · May 13, 2019, 4:25pm

You’re simply the best

stupid error in document root, this magic command helped me too :

grep -R "DocumentRoot" /etc/apache2/sites-enabled

/var/www is the directory where are my websites but the defaut installation with index.html is in /www/var/www/html

Have to my www version to achieve.

Thanks a lot Juergen

system · June 12, 2019, 4:25pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.