Don't renew certificate

[sixberk]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: moodle.vske.cz

I ran this command: certbot --apache renew

It produced this output:

---

Processing /etc/letsencrypt/renewal/moodle.vske.cz-0001.conf

---

Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for moodle.vske.cz
Enabled Apache rewrite module
Waiting for verification…
Cleaning up challenges
Attempting to renew cert (moodle.vske.cz-0001) from /etc/letsencrypt/renewal/moodle.vske.cz-0001.conf produced an unexpected error: Failed authorization procedure. moodle.vske.cz (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://moodle.vske.cz/.well-known/acme-challenge/NxUN5kIWjaxwVExPEG2W9b2zqTdiJ8ee0gNd3oWtBpM [2a02:e98:80:a01::111]: “\n\n403 Forbidden\n\n

Forbidden

\n<p”. Skipping.

My web server is (include version): apache2 2.4.25-3+deb9u7

The operating system my web server runs on is (include version): Debian 4.9.65-3+deb9u2 (2018-01-04)

My hosting provider, if applicable, is: faster.cz

I can login to a root shell on my machine (yes or no, or I don’t know):
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): certbot 0.28.0

[sixberk]

https://moodle.vske.cz/.well-known/acme-challenge/test works

[JuergenAuer]

Hi @sixberk

@sixberk

https://moodle.vske.cz/.well-known/acme-challenge/test

that looks good. The http version works too, there is a check of your domain ( https://check-your-website.server-daten.de/?q=moodle.vske.cz ).

Ipv4 and ipv6 works, there is no redirect, but checking your test file via http is ok.

Domainname	Http-Status	redirect	Sec.	G
• http://moodle.vske.cz/
77.240.176.44	303	https://moodle.vske.cz	0.147	A
• http://moodle.vske.cz/
2a02:e98:80:a01::111	303	https://moodle.vske.cz	0.104	A
• https://moodle.vske.cz	200		0.383	N
Certificate error: RemoteCertificateChainErrors
• https://moodle.vske.cz/
77.240.176.44	200		0.983	N
Certificate error: RemoteCertificateChainErrors
• https://moodle.vske.cz/
2a02:e98:80:a01::111	200		0.440	N
Certificate error: RemoteCertificateChainErrors
• http://moodle.vske.cz/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
77.240.176.44	404		0.070	A
Not Found
Visible Content: Not Found The requested URL /.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de was not found on this server. Apache/2.4.25 (Debian) Server at moodle.vske.cz Port 80
• http://moodle.vske.cz/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
2a02:e98:80:a01::111	404		0.056	A
Not Found

So you have found your correct webroot.

Then use this information:

certbot run -a webroot -i apache -w yourWebroot -d moodle.vske.cz

[sixberk]

I used to certbot run -a webroot -i apache -w /home/www.vske.cz/novy_moodle.vske.cz -d moodle.vske.cz but same problem:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer apache
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for moodle.vske.cz
Using the webroot path /home/www.vske.cz/novy_moodle.vske.cz for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. moodle.vske.cz (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://moodle.vske.cz/.well-known/acme-challenge/mUJi0Ck2j0oBHIObkIa2kdcjeGiGMXcsLQVFPsviIVg [2a02:e98:80:a01::111]: “\n\n404 Not Found\n\n

Not Found

\n<p”

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: moodle.vske.cz
  Type: unauthorized
  Detail: Invalid response from
  http://moodle.vske.cz/.well-known/acme-challenge/mUJi0Ck2j0oBHIObkIa2kdcjeGiGMXcsLQVFPsviIVg
  [2a02:e98:80:a01::111]: “\n\n404 Not
  Found\n\n

  Not Found

  \n<p”

  To fix these errors, please make sure that your domain name was
  entered correctly and the DNS A/AAAA record(s) for that domain
  contain(s) the right IP address.

I have alias for /.well-known/acme-challenge/ to /var/www/acme-challenge/

# Serve ACME challenge responses
Alias /.well-known/acme-challenge/ /var/www/acme-challenges/

<Directory /var/www/acme-challenges/>
Options FollowSymlinks
Options -Indexes
AllowOverride None
# Apache >= 2.3

Require all granted

# Apache < 2.3
<IfModule !mod_authz_core.c>
Order Allow,Deny
Allow from all

[JuergenAuer]

@sixberk

I have alias for /.well-known/acme-challenge/ to /var/www/acme-challenge/

Then remove that alias. Or change it to /var/www/.well-known/acme-challenge, so you can use /var/www as webroot.

[sixberk]

thanks but I can’t try it because rate limit
I will try soon

[JuergenAuer]

Then use the test system with certonly.

So you can check if it works.

[sixberk]

Thanks a lot. It works.