Error on renewal certificate


#1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
perfekti.mx
I ran this command:
./certbot renew
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log


Processing /etc/letsencrypt/renewal/perfekti.mx.conf


Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for perfekti.mx
Waiting for verification…
Cleaning up challenges
Attempting to renew cert (perfekti.mx) from /etc/letsencrypt/renewal/perfekti.mx.conf produced an unexpected error: Failed authorization procedure. perfekti.mx (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://perfekti.mx/.well-known/acme-challenge/AClrJIioj1SMIKvCPLCrKAmlPL1fAN4URi_hsaFcWWo: “\n\n404 Not Found\n\n

Not Found

\n<p”. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/perfekti.mx/fullchain.pem (failure)

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/perfekti.mx/fullchain.pem (failure)


1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

My web server is (include version):
Server version: Apache/2.4.25 (Debian)
Server built: 2017-09-19T18:58:57
The operating system my web server runs on is (include version):
NAME=“Debian GNU/Linux”
VERSION_ID=“9”
VERSION=“9 (stretch)”
My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):
Yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):No


#2

What’s this show?

apachectl -t -D DUMP_VHOSTS

and

curl ifconfig.me

#3

apachectl -t -D DUMP_VHOSTS
AH00112: Warning: DocumentRoot [/var/www/html/dictaminacion] does not exist
VirtualHost configuration:
10.0.0.17:80 perfekti.mx (/etc/apache2/apache2.conf:165)
*:443 perfekti.mx (/etc/apache2/sites-enabled/000-default-le-ssl.conf:2)
*:80 perfekti.mx (/etc/apache2/sites-enabled/000-default.conf:1)

curl ifconfig.me
189.216.247.253


#4

I found the issue, there was a wrong VirtualHost on apache conf, I remove it and I renwe the cert succesfully


#5

Hi @edgarhammer

but not complete. You have two ip addresses, your www - version has a different ip (checked with my online tool https://check-your-website.server-daten.de/?q=perfekti.mx ):


Domainname Http-Status redirect Sec. G
http://perfekti.mx/
189.216.247.253 301 https://perfekti.mx/ 0.366 A
http://www.perfekti.mx/
200.57.117.54 200 0.686 H
https://perfekti.mx/
189.216.247.253 200 9.023 A
https://www.perfekti.mx/
200.57.117.54 200 7.180 N
Certificate error: RemoteCertificateNameMismatch

And your www-version has the wrong certificate.

CN=vexi.mx
15.10.2018
13.01.2019
vexi.mx - 1 entry

So if a visitor uses your www - version, he can’t see your page.

  • Remove the www dns entry (not really good)
  • create a certificate with the www domain name (better)
  • create one certificate with both domain names (www + non-www)

#6

Thanks a lot, we will check the other domain