Put some file with a known name (say “test.txt”) into .well-known/acme-challenge/ and try accessing it from your browser, just like you would with any file. Watch your webserver access/error logs to see what’s happening. There might be something wrong with your server configuration preventing files from being accessed (for example some deny rule for anything starting with a dot). Once you figure what that is and fix it - continue with certbot.
That depends which browser I use - hence asking if you have something which is checking user type - probably to give different content to mobile compared with desktop users.
You may need to add
<LocationMatch "/.well-known/acme-challenge/*">
Header set Content-Type "text/plain"
</LocationMatch>
into your apache config to ensure you just provide a plain text response (since letsencrypt will effectively be using something like curl - and hence getting a 404 error currently).
I tried to add it in .htaccess but then my web site doesn’t respond anymore :
“Additionally, a 500 Internal Server Error error was encountered while trying to use an ErrorDocument to handle the request.”
Sorry, I wasn’t suggesting that you add that to the .htaccess, it’s not in the correct format - so would give a 500 error.
I was asking if something else within your .htaccess could be causing an issue.
Is the above your complete .htaccess ? and I assume that the lines with a “>” at the start are what you have placed on here to make it visible - and not what was in the original file ? (as they shouldn’t be there )
yeah I just read that it was forbidden to add it htaccess file
I tried in httpd.conf with no success, maybe I’m putting it in the wrong place I’m investigating
For the “>” it’s just the editor
If you just temporarily rename the .htaccess file, can you then reach that test location with curl ? (that would show if it was a redirect in your htaccess causing the issue )
Here you are calling for a certificate to be generated and it’s using that --webroot location of /var/www/html that you just created above in Apache2.
Remember it’s in test mode so you should get a response like this
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/mail.mydomain.com/fullchain.pem. Your cert
will expire on 2016-09-11. To obtain a new or tweaked version of
this certificate in the future, simply run certbot-auto again. To
non-interactively renew *all* of your certificates, run
"certbot-auto renew"
Remember of course to substitute your domain name and email address above and you can also change your default RSA key size to 2048
if that then works, then simply remove --test-cert and it will generate your live key
I may be wrong but that looks to me like modifying the default config on an Ubuntu system, rather than a CentOS one, so may need a little modification to work.
That is right, it’s for Ubuntu, I did see OP is using CentOS but it should work for his Apache I hope. He may need to modify slightly for CentOS, the basic jist is all there.
Looks like it hits your CakePHP rewrite. Are you sure the file exists? When running the command, you can actually check what's happening in the directory. Open another session and use something like this in the terminal:
That’s definitely failing on the acme challenge. Your command line to generate the cert looks all spot on, you were correct to change mail.mydomain.com to your own domain name, sorry I forgot to mention that.
Can you post your apache .conf file for this site?
- hence asking if you have something which is checking user type - probably to give different content to mobile compared with desktop users.