# Failed authorization procedure. Error getting validation data

**URL:** <https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921>\
**Category:** Server\
**Created:** [October 4, 2018, 2:28pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921 "2018-10-04T14:28:14Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![fxleblanc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fxleblanc/32/26547_2.png) [@fxleblanc](https://community.letsencrypt.org/u/fxleblanc)\
**Post date:** [October 4, 2018, 2:28pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/1 "2018-10-04T14:28:14Z")

</div>

Hi, trying to setup certbot using apache2 with debian 8. Having some troubles passing the webroot challenge.

OS: Debian 8.11(Jessie)  
Cerbot version: 0.10.2  
Apache config: [https://pastebin.com/nh4t9gmR](https://pastebin.com/nh4t9gmR)  
Domain: [http://www.fxleblanc.ca](http://www.fxleblanc.ca)  
Command: sudo certbot certonly -a webroot -w /var/www/html/ -i apache --staging  
Error log: [https://pastebin.com/5N0ZzRiy](https://pastebin.com/5N0ZzRiy)

At first, I thought it was having trouble accessing the acme-challenge directory, so I tried adding a test.html file:

[http://168.235.108.155/.well-known/acme-challenge/test.html](http://168.235.108.155/.well-known/acme-challenge/test.html)

I can access it so I don’t think that’s the problem.

Any help is appreciated.

Regards,

Félix

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [October 4, 2018, 2:34pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/2 "2018-10-04T14:34:15Z")

</div>

Let’s Encrypt won’t access an IP address URL. 😧

`http://168.235.108.155/.well-known/acme-challenge/test.html` won’t work.

`http://example.net/.well-known/acme-challenge/test.html` will.

Can you change it to redirect to a hostname, or not redirect at all?

---

<div class="post-metadata">

**Author:** ![fxleblanc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fxleblanc/32/26547_2.png) [@fxleblanc](https://community.letsencrypt.org/u/fxleblanc)\
**Post date:** [October 4, 2018, 2:36pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/3 "2018-10-04T14:36:40Z")

</div>

Right. Should I change that at the DNS level(I use [Gandi.net](http://Gandi.net)) or in my apache configuration?

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [October 4, 2018, 2:40pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/4 "2018-10-04T14:40:25Z")

</div>

It looks like it’s using Gandi’s web forwarding service, so you’d have to change it in Gandi’s control panel somewhere.

Can you turn off the forwarding service and change it to a regular `A` record?

---

<div class="post-metadata">

**Author:** ![fxleblanc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fxleblanc/32/26547_2.png) [@fxleblanc](https://community.letsencrypt.org/u/fxleblanc)\
**Post date:** [October 4, 2018, 2:43pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/5 "2018-10-04T14:43:50Z")

</div>

Yes. I just entered the following A record:

\*.fxleblanc.ca 1800 IN A 168.235.108.155

It seems it still changes the hostname to the ip

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [October 4, 2018, 9:14pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/6 "2018-10-04T21:14:01Z")

</div>

Hi,

Now your domain is not resolved correctly. (No IP is found)  
Could you please try to stop the web-forwarding service (if you haven’t) and add the following records to Gandi’s Control Panel?

```
www.fxleblanc.ca 1800 IN A 168.235.108.155
fxleblanc.ca 1800 IN A 168.235.108.155

```

(Gandi might pre-populated the domain for you, you might need to use

```
www 1800 IN A 168.235.108.155
@ 1800 IN A 168.235.108.155 

```

if things do not work out)

After you added those DNS records, please wait a few minutes and try to visit the following links to check if the changes are in effect.  
[https://www.whatsmydns.net/#A/fxleblanc.ca](https://www.whatsmydns.net/#A/fxleblanc.ca)  
[https://www.whatsmydns.net/#A/www.fxleblanc.ca](https://www.whatsmydns.net/#A/www.fxleblanc.ca)

Thank you

---

<div class="post-metadata">

**Author:** ![fxleblanc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fxleblanc/32/26547_2.png) [@fxleblanc](https://community.letsencrypt.org/u/fxleblanc)\
**Post date:** [October 5, 2018, 12:34pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/7 "2018-10-05T12:34:40Z")

</div>

Hi, it worked :). Thanks for your help. It worked with these lines:

```auto
www 1800 IN A 168.235.108.155
@ 1800 IN A 168.235.108.155

```

I assume that www refers to www.fxleblanc.ca and @ to \*.fxleblanc.ca. How do you know if your DNS provider is using one syntax or the other?

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [October 5, 2018, 4:33pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/8 "2018-10-05T16:33:48Z")

</div>

> [@fxleblanc](#):
>
> How do you know if your DNS provider is using one syntax or the other?

Normally it would be using the @ and www....  
(I actually have no idea how those providers choose in between... But I believe that's the only two wide spread syntax for DNS Management(in a user friendly interface)

Glad it works!

Thank you

---

<div class="post-metadata">

**Author:** ![fxleblanc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fxleblanc/32/26547_2.png) [@fxleblanc](https://community.letsencrypt.org/u/fxleblanc)\
**Post date:** [October 5, 2018, 7:12pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/9 "2018-10-05T19:12:46Z")

</div>

It works in staging but for some reason, when I remove the --staging flag, it doesn’t work. It gives me the following error:

[https://pastebin.com/TdZnRY59](https://pastebin.com/TdZnRY59)

Apache config:  
[https://pastebin.com/dg1TMz34](https://pastebin.com/dg1TMz34)

Command:  
sudo certbot certonly -a webroot -w /var/www/html/ -d www.fxleblanc.ca --pre-hook “systemctl stop apache2” --post-hook “systemctl start apache2”

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 5, 2018, 7:37pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/10 "2018-10-05T19:37:49Z")

</div>

Hi @fxleblanc

> [@fxleblanc](#):
>
> It works in staging but for some reason, when I remove the --staging flag, it doesn’t work. It gives me the following error

your command

> [@fxleblanc](#):
>
> sudo certbot certonly -a webroot -w /var/www/html/ -d www.fxleblanc.ca --pre-hook “systemctl stop apache2” --post-hook “systemctl start apache2”

is "special": If you use the webroot as authenticator, you need a running webserver. So your pre-hook and your post-hook is wrong.

Remove both.

"Connection refused" - you have stopped your webserver.

---

<div class="post-metadata">

**Author:** ![fxleblanc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fxleblanc/32/26547_2.png) [@fxleblanc](https://community.letsencrypt.org/u/fxleblanc)\
**Post date:** [October 5, 2018, 8:06pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/11 "2018-10-05T20:06:22Z")

</div>

Good to know. Thanks. I remove the hooks:

sudo certbot certonly -a webroot -w /var/www/html/ -d www.fxleblanc.ca

and it regenerates the certificates and chain but when I go to the https url([https://www.fxleblanc.ca](https://www.fxleblanc.ca)), it says it’s an insecure connection. I’m guessing it has to do with my apache config:

[https://pastebin.com/dg1TMz34](https://pastebin.com/dg1TMz34)

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 5, 2018, 8:08pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/12 "2018-10-05T20:08:36Z")

</div>

If you use the

> [@fxleblanc](#):
>
> certonly

option, you have to install the certificate manual. There is the Fake LE - Certificate installed (from the test system).

---

<div class="post-metadata">

**Author:** ![fxleblanc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fxleblanc/32/26547_2.png) [@fxleblanc](https://community.letsencrypt.org/u/fxleblanc)\
**Post date:** [October 5, 2018, 8:15pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/13 "2018-10-05T20:15:31Z")

</div>

Where’s the Fake LE certificate? I currently use the generated full chain and private key in my config:

SSLCertificateFile /etc/letsencrypt/live/www.fxleblanc.ca/fullchain.pem  
SSLCertificateKeyFile /etc/letsencrypt/live/www.fxleblanc.ca/privkey.pem

Maybe it has something to do with the fact that I reference only the full chain and privkey. There’s 4 files in the /etc/letsencrypt/live/www.fxleblanc.ca/ directory. Which one(s) should I reference in my apache config?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 5, 2018, 8:20pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/14 "2018-10-05T20:20:44Z")

</div>

> [@fxleblanc](#):
>
> Where’s the Fake LE certificate?

I see the Fake LE:

![ca](https://global.discourse-cdn.com/letsencrypt/original/3X/3/5/35ec8b582470c7a1307d83f0dc5904c337c5b38a.png)

> [@fxleblanc](#):
>
> SSLCertificateFile /etc/letsencrypt/live/www.fxleblanc.ca/fullchain.pem  
> SSLCertificateKeyFile /etc/letsencrypt/live/www.fxleblanc.ca/privkey.pem

These are symlinks. Perhaps they point to the wrong certificate. Check your certificates with

```nohighlight
certbot certificates

```

perhaps delete three (`certbot delete ...`) - but first make a backup of the folder.

PS: Now I see the new productive certificate:

[https://transparencyreport.google.com/https/certificates?cert\_search\_auth=&cert\_search\_cert=&cert\_search=include\_expired:false;include\_subdomains:false;domain:www.fxleblanc.ca&lu=cert\_search](https://transparencyreport.google.com/https/certificates?cert_search_auth=&cert_search_cert=&cert_search=include_expired:false;include_subdomains:false;domain:www.fxleblanc.ca&lu=cert_search)

---

<div class="post-metadata">

**Author:** ![fxleblanc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fxleblanc/32/26547_2.png) [@fxleblanc](https://community.letsencrypt.org/u/fxleblanc)\
**Post date:** [October 5, 2018, 8:39pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/15 "2018-10-05T20:39:31Z")

</div>

Great. The site works now. Turns out, I just needed to restart apache2 after deleting all the certs and getting a new one.

Thanks

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 5, 2018, 8:41pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/16 "2018-10-05T20:41:13Z")

</div>

Yep, now I see the correct certificate.

![correct](https://global.discourse-cdn.com/letsencrypt/original/3X/f/c/fcacbdd39140f22f73f4a5fc6e5b32e0ac1c7824.png)

😉

---

<div class="post-metadata">

**Author:** ![fxleblanc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fxleblanc/32/26547_2.png) [@fxleblanc](https://community.letsencrypt.org/u/fxleblanc)\
**Post date:** [October 5, 2018, 8:42pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/17 "2018-10-05T20:42:45Z")

</div>

Quick question. Do you use a special plugin in firefox to get the certificate hierarchy in your screenshots or is it something different?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 5, 2018, 8:54pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/18 "2018-10-05T20:54:22Z")

</div>

> [@fxleblanc](#):
>
> Do you use a special plugin in firefox to get the certificate hierarchy in your screenshots or is it something different?

This is the normal Windows-Firefox.

Click the certificate

![step-1](https://global.discourse-cdn.com/letsencrypt/original/3X/8/f/8f4dededb390f2532bbcfba3a380bdee6cd9911d.png)

Then use \>.

![step-2](https://global.discourse-cdn.com/letsencrypt/original/3X/7/6/76d42ee96a2b28b26a9bf6233d2d20aa58900382.png)

There the link at the end.

![step-3](https://global.discourse-cdn.com/letsencrypt/original/3X/b/b/bb43338c43fc3b01dd44176d96fba56f9175834f.png)

There you see the FireFox page informations, there you can see the certificate.

![step-4](https://global.discourse-cdn.com/letsencrypt/original/3X/8/0/80a82cca1c3a5edfb24a082e6767c53ebce12929.png)

There select "Details".

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [November 4, 2018, 8:54pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-error-getting-validation-data/73921/19 "2018-11-04T20:54:27Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.