# Error https activate for sub domain name **URL:** \ **Category:** Help\ **Created:** [January 12, 2017, 10:40am UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544 "2017-01-12T10:40:11Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![pidow](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@pidow](https://community.letsencrypt.org/u/pidow)\ **Post date:** [January 12, 2017, 10:40am UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/1 "2017-01-12T10:40:11Z")
Please fill out the fields below so we can help you better. My domain is:woe.fr I ran this command:./certibot-auto It produced this output: My operating system is (include version):debian 7 My web server is (include version):apache My hosting provider, if applicable, is:OVH I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel):if need Hello every body, first sorry for my english i’m french. I need your help today for 2 differents points: 1. when i try to generate https it’s write: IMPORTANT NOTES: - The following errors were reported by the server: 1. i make a mistake fo one subdomain declaration, how can i edit it ? Thx a lot ! ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 12, 2017, 11:14am UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/2 "2017-01-12T11:14:06Z")
Well, with regard to your second problem: you didn’t successfully get a certificate, so I guess there isn’t something to correct. Just run `./certbot-auto` a second time (if the first problem is fixed 😛) and also include the subdomain you forgot earlier. With regard to your first problem: this could be an issue with your Apache configuration, specifically the `` sections. Could you check your Apache configuration files for these `` sections and see if _all_ of them are in the form of `` or ``? Because sometimes there are `` or `` sections and those latter ones can give problems with the [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication) feature of Apache, which is needed for the `TLS-SNI-01` challenge. ---
**Author:** ![pidow](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@pidow](https://community.letsencrypt.org/u/pidow)\ **Post date:** [January 12, 2017, 11:18am UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/3 "2017-01-12T11:18:40Z")
Hello thx for your reply, i go check my vitrualHost, and i tell you 🙂 But for my second problem, i need to modify subdomaine, not include. may be delete to create again ? thx a lot ! ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 12, 2017, 11:23am UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/4 "2017-01-12T11:23:48Z")
> [@pidow](#): > > But for my second problem, i need to modify subdomaine, not include.may be delete to create again ? I'm not sure I understand. You ran `./certbot-auto` without any other commands, right? After that command, you got a list of (sub)domains, fetched from your Apache configuration files, where you could specify one or more domains or subdomains, right? But because there was an error after that step (you never saw "Congratulations!", correct?), if you run `./certbot-auto` _again_, you can specify those (sub)domains from the same list as before, _again_. 🙂 ---
**Author:** ![pidow](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@pidow](https://community.letsencrypt.org/u/pidow)\ **Post date:** [January 12, 2017, 12:19pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/5 "2017-01-12T12:19:58Z")
Hello Osiris, when i make ./certbot-auto, it write: please choose sub domains to generate https files (somethings like this). i can not specify new domains or subdomains. I have added last time domains, but i have make mistake, and it save it 😕 ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 12, 2017, 12:31pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/6 "2017-01-12T12:31:07Z")
Please copy/paste the complete output of `certbot`, because I still don’t quite understand. ---
**Author:** ![pidow](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@pidow](https://community.letsencrypt.org/u/pidow)\ **Post date:** [January 12, 2017, 12:47pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/7 "2017-01-12T12:47:48Z")
> root@:/home/CertbotSSL# ./certbot-auto > Saving debug log to /var/log/letsencrypt/letsencrypt.log > ## Which names would you like to activate HTTPS for? > > ## 1: [woe.fr](http://woe.fr) 2: [admin.woe.fr](http://admin.woe.fr) 3: [forums.woe.fr](http://forums.woe.fr) 4: [www.woe.fr](http://www.woe.fr) > > Select the appropriate numbers separated by commas and/or spaces, or leave input > blank to select all options shown (Enter 'c' to cancel):2 > Obtaining a new certificate > Performing the following challenges: > tls-sni-01 challenge for [admin.woe.fr](http://admin.woe.fr) > Waiting for verification... > Cleaning up challenges > Failed authorization procedure. [forums.woe.fr](http://forums.woe.fr) (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: DNS problem: NXDOMAIN looking up A for [forums.woe.fr](http://forums.woe.fr), [admin.woe.fr](http://admin.woe.fr) (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for TLS-SNI-01 challenge. Requested 02caa707299d474e8ec293ec73c023f8.8d07a8fd6a4ede67e54cac6357058a83.acme.invalid from 37.187.7.10:443. Received certificate containing '[woe.fr](http://woe.fr)' > IMPORTANT NOTES: > > - The following errors were reported by the server: > Domain: [admin.woe.fr](http://admin.woe.fr) > Type: unauthorized > Detail: Incorrect validation certificate for TLS-SNI-01 challenge. > Requested > 02caa707299d474e8ec293ec73c023f8.8d07a8fd6a4ede67e54cac6357058a83.acme.invalid > from 37.187.7.10:443. Received certificate containing '[woe.fr](http://woe.fr)' > To fix these errors, please make sure that your domain name was > entered correctly and the DNS A record(s) for that domain > contain(s) the right IP address. It does not ask me to add new domains.. But i don't understand what's wrong in my apache file (VirtualHost). Have you exemple of this files ? i have this: > VirtualHost 37.187.7.10:443\> > ServerName [admin.woe.fr](http://admin.woe.fr) > DocumentRoot /var/woe/admin/www/ > CustomLog ${APACHE\_LOG\_DIR}/access/accessadmin.log combined > ErrorLog ${APACHE\_LOG\_DIR}/error/erroradmin.log > SSLEngine on > SSLCertificateFile /etc/letsencrypt/live/woe.fr/cert.pem > SSLCertificateKeyFile /etc/letsencrypt/live/woe.fr/privkey.pem > SSLCertificateChainFile /etc/letsencrypt/live/woe.fr/chain.pem > SSLVerifyClient None > /VirtualHost\> ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 12, 2017, 12:51pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/8 "2017-01-12T12:51:47Z")
> [@pidow](#): > > It does not ask me to add new domains.. You can select more than one (sub)domain when asked.. You just entered only '2' (for admin.) Anyway, for the problem of the issuing: you could try to change the IP address in the `` directive to an asterisk (`*`), so Apache uses SNI. ---
**Author:** ![pidow](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@pidow](https://community.letsencrypt.org/u/pidow)\ **Post date:** [January 12, 2017, 1:05pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/9 "2017-01-12T13:05:51Z")
First i wish glad you again for your help ! But when i put \* it’s simply not work, my webpage not show ! May be i have wrong information in my file: /etc/apache2/sites-enabled/woe or /etc/apache2/sites-available/default or /etc/apache2/sites-available/default-ssl Have you small exemple of each ? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 12, 2017, 1:19pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/10 "2017-01-12T13:19:13Z")
No examples, sorry. But if you paste them somewhere for us to see, we might be able to figure out why it doesn’t work. ---
**Author:** ![pidow](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@pidow](https://community.letsencrypt.org/u/pidow)\ **Post date:** [January 12, 2017, 1:42pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/11 "2017-01-12T13:42:33Z")
Please find config file here: [woe.fr/dl.zip](http://woe.fr/dl.zip) thx so much ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 12, 2017, 1:53pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/12 "2017-01-12T13:53:27Z")
Could you run `certbot-auto` with the `-v` switch? For more verbose output. Among that output, you'll see something like: ``` Performing the following challenges: tls-sni-01 challenge for yourdomain Adding Include /etc/apache2/vhosts.d/le_tls_sni_01_cert_challenge.conf to /files/etc/apache2/httpd.conf writing a config file with text: ...Apache configuration stuff... ``` I'm interested in the apache configuration file it says there. I still believe the error you're getting is because Apache is confused with regard of SNI. Apache has a [extensive page about name-based virtual hosting](https://httpd.apache.org/docs/2.4/vhosts/name-based.html), including if and how IP's are used in directives. I'm still guessing it has something to do with that. (Personally, I never use an IP address in my configuration files, because I just use one. Always a "`*`".) Also: in `default.conf` you have a `` section for `www.woe.fr` with a few ServerAliasses. Did you add that later on? Because you've got all your directives already in `woe.conf`. Perhaps a little bit too much 😛 Aaaaaand, you _ALSO_ have your `woe.fr` mentioned in `default-ssl.conf`?!? No wonder Apache doesn't understand it 😛 If I were you, I'd clean up my Apache configuration files: keep all the defaults default and just use `woe.conf` for your site. Also, `certbot` works best with just _one_ configuration file _per virtualhost section_. From the Apache site: > It is important to recognize that the first step in name-based virtual host resolution is IP-based resolution. Name-based virtual host resolution only chooses the most appropriate name-based virtual host after narrowing down the candidates to the best IP-based match. Using a wildcard (\*) for the IP address in all of the VirtualHost directives makes this IP-based mapping irrelevant. ---
**Author:** ![pidow](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@pidow](https://community.letsencrypt.org/u/pidow)\ **Post date:** [January 12, 2017, 2:09pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/13 "2017-01-12T14:09:26Z")
yes i have add it in defaut.conf, and i see after that it was automaticaly add in default-ssl conf 😕 that why i wish have exemple, because i think that i have some mistake. about apache site: i’m sorry, i don’t understand what it’s write. You think that i must clear (so erase all?) my default file ? i don’t understand what i must make ☹ ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 12, 2017, 2:11pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/14 "2017-01-12T14:11:17Z")
[In French](https://httpd.apache.org/docs/2.4/fr/vhosts/name-based.html). ---
**Author:** ![pidow](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@pidow](https://community.letsencrypt.org/u/pidow)\ **Post date:** [January 12, 2017, 3:13pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/15 "2017-01-12T15:13:08Z")
is better: Default > VirtualHost \*:80\> > ServerAdmin [woe@woe.fr](mailto:woe@woe.fr) > DocumentRoot /var/woe/site/www > > Options FollowSymLinks > #AllowOverride None > /Directory\> > Directory /var/woe/site/www/\> > Options Indexes FollowSymLinks MultiViews > #AllowOverride None > Order allow,deny > allow from all > /Directory\> > ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ > Directory "/usr/lib/cgi-bin"\> > AllowOverride None > Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch > Order allow,deny > Allow from all > /Directory\> > ErrorLog ${APACHE\_LOG\_DIR}/error.log > > # Possible values include: debug, info, notice, warn, error, crit, > > # alert, emerg. > > LogLevel warn > CustomLog ${APACHE\_LOG\_DIR}/access.log combined > /VirtualHost\> DEFAULT SSL: > IfModule mod\_ssl.c\> > VirtualHost \*:443\> > ServerAdmin [woe@woe.fr](mailto:woe@woe.fr) > DocumentRoot /var/woe/site/www > Directory /\> > Options FollowSymLinks > AllowOverride None > /Directory\> > Directory /var/www/\> > Options Indexes FollowSymLinks MultiViews > #AllowOverride None > Order allow,deny > allow from all > /Directory\> > ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ > Directory "/usr/lib/cgi-bin"\> > AllowOverride None > Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch > Order allow,deny > Allow from all > /Directory\> > ErrorLog ${APACHE\_LOG\_DIR}/error.log > # Possible values include: debug, info, notice, warn, error, crit, > > # alert, emerg. > > LogLevel warn > CustomLog ${APACHE\_LOG\_DIR}/ssl\_access.log combined > SSLEngine on > SSLCertificateFile /etc/letsencrypt/live/woe.fr/cert.pem > SSLCertificateKeyFile /etc/letsencrypt/live/woe.fr/privkey.pem > SSLCertificateChainFile /etc/letsencrypt/live/woe.fr/chain.pem > SSLVerifyClient None > ServerName [woe.fr](http://woe.fr) > ServerAlias [admin.woe.fr](http://admin.woe.fr) > ServerAlias [forum.woe.fr](http://forum.woe.fr) > ServerAlias [www.woe.fr](http://www.woe.fr) > SSLCertificateChainFile /etc/letsencrypt/live/woe.fr/chain.pem > /VirtualHost\> > /IfModule\> and woe conf: > NameVirtualHost \*:80 > VirtualHost \*:80\> > ServerName [forum.woe.fr](http://forum.woe.fr) > DocumentRoot /var/woe/fofo/www/ > CustomLog ${APACHE\_LOG\_DIR}/access/accessfofo.log combined > ErrorLog ${APACHE\_LOG\_DIR}/error/errorfofo.log > # > #php\_admin\_value open\_basedir /var/woe/fofo/www/ > /IfModule\> > /VirtualHost\> > VirtualHost \*:80\> > ServerName [admin.woe.fr](http://admin.woe.fr) > DocumentRoot /var/woe/admin/www/ > #CustomLog ${APACHE\_LOG\_DIR}/accessadmin.log combined > #ErrorLog ${APACHE\_LOG\_DIR}/erroradmin.log > CustomLog ${APACHE\_LOG\_DIR}/access/accessadmin.log combined > ErrorLog ${APACHE\_LOG\_DIR}/error/erroradmin.log > /VirtualHost\> > VirtualHost \*:80\> > ServerName [maj.woe.fr](http://maj.woe.fr) > DocumentRoot /var/woe/maj/www/ > CustomLog ${APACHE\_LOG\_DIR}/access/accessmaj.log combined > ErrorLog ${APACHE\_LOG\_DIR}/error/errormaj.log > /VirtualHost\> > VirtualHost \*:80\> > ServerName [woe.fr](http://woe.fr) > DocumentRoot /var/woe/site/www/ > CustomLog ${APACHE\_LOG\_DIR}/access/accesssite.log combined > ErrorLog ${APACHE\_LOG\_DIR}/error/errorsite.log > /VirtualHost\> > VirtualHost \*:80\> > ServerName [www.woe.fr](http://www.woe.fr) > DocumentRoot /var/woe/site/www/ > CustomLog ${APACHE\_LOG\_DIR}/access/accesssite.log combined > ErrorLog ${APACHE\_LOG\_DIR}/error/errorsite.log > /VirtualHost\> > ######################################################################## > NameVirtualHost \*:443 > VirtualHost \*:443\> > ServerName [www.woe.fr](http://www.woe.fr) > DocumentRoot /var/woe/site/www/ > CustomLog ${APACHE\_LOG\_DIR}/access/accesssite.log combined > ErrorLog ${APACHE\_LOG\_DIR}/error/errorsite.log > SSLEngine on > SSLCertificateFile /etc/letsencrypt/live/woe.fr/cert.pem > SSLCertificateKeyFile /etc/letsencrypt/live/woe.fr/privkey.pem > SSLCertificateChainFile /etc/letsencrypt/live/woe.fr/chain.pem > SSLVerifyClient None > /VirtualHost\> > VirtualHost \*:443\> > ServerName [admin.woe.fr](http://admin.woe.fr) > DocumentRoot /var/woe/admin/www/ > CustomLog ${APACHE\_LOG\_DIR}/access/accessadmin.log combined > ErrorLog ${APACHE\_LOG\_DIR}/error/erroradmin.log > SSLEngine on > SSLCertificateFile /etc/letsencrypt/live/woe.fr/cert.pem > SSLCertificateKeyFile /etc/letsencrypt/live/woe.fr/privkey.pem > SSLCertificateChainFile /etc/letsencrypt/live/woe.fr/chain.pem > SSLVerifyClient None > /VirtualHost\> > VirtualHost \*:443\> > ServerName [forum.woe.fr](http://forum.woe.fr) > DocumentRoot /var/woe/fofo/www/ > CustomLog ${APACHE\_LOG\_DIR}/access/accessfofo.log combined > ErrorLog ${APACHE\_LOG\_DIR}/error/errorfofo.log > SSLEngine on > SSLCertificateFile /etc/letsencrypt/live/woe.fr/cert.pem > SSLCertificateKeyFile /etc/letsencrypt/live/woe.fr/privkey.pem > SSLCertificateChainFile /etc/letsencrypt/live/woe.fr/chain.pem > SSLVerifyClient None > /VirtualHost\> ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 12, 2017, 3:29pm UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/16 "2017-01-12T15:29:01Z")
With regards to the VirtualHost sections: yes. But you still have multiple double `ServerName`/`ServerAlias` directives. That is not necessary, even unwanted I guess. IMO you should give your “default” configuration files some stupid ServerName (localhost) with a non-usefull DocumentRoot. Apache will use that VirtualHost as a “default” when someone connects to your server without providing a useful hostname. Then, you’d put your `woe.fr` VirtualHost sections in separate configuration files. woe.fr.conf, forum.woe.fr.conf, admin.woe.fr.conf. That way, `certbot` will understand it better. (Unless they bunked that bug already… 😛) ---
**Author:** ![pidow](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@pidow](https://community.letsencrypt.org/u/pidow)\ **Post date:** [January 13, 2017, 6:12am UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/17 "2017-01-13T06:12:18Z")
Thx a lot Osiris,i have create with using /certbot -certonly i must use this command for each subdomaine. I have try to put all with comma, but not work °° So hope renew was easy now 😄 ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [February 12, 2017, 6:19am UTC](https://community.letsencrypt.org/t/error-https-activate-for-sub-domain-name/25544/18 "2017-02-12T06:19:42Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.