Hi all,
I’m having some problems issuing certs for my domain. I recently moved the site from an older server to a new server. The old server was running on ubuntu 14.04 with apache and using the let’s encrypt software to issue certs - I had a perfectly working cert issued for my site.
My new server is running ubuntu 16.04, uses nginx and uses certbot to issue certs. when doing a dry run for new certs, I keep getting authorization failures, but I’m not sure why as I can browse to the directory manually, the permissions are set for 755 and I don’t see anything in my nginx config that would prevent proper access.
In addition to the above, my site sites behind cloudflare. I have a cloudflare issue cert, which I turned off until I can get my issues sorted out with certbot.
site url in question: teistebrito.com
Here’s the command I’m running:
certbot certonly --email certs@mysite.com --text --renew-by-default --agree-tos --webroot -w /path/to/site/public_html -d teistebrito.com -d www.teistebrito.com --dry-run
which then outputs the following:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for teistebrito.com
http-01 challenge for www.teistebrito.com
Using the webroot path /path/to/site/public_html for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Unable to clean up challenge directory /path/to/site/public_html/.well-known/acme-challenge
Failed authorization procedure. www.teistebrito.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.teistebrito.com/.well-known/acme-challenge/D0CwPvOEQUjMJGCGF39uT7LmRQ150-3OuGZlMrUVzsc: "<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>ngin"
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: www.teistebrito.com
Type: unauthorized
Detail: Invalid response from
http://www.teistebrito.com/.well-known/acme-challenge/D0CwPvOEQUjMJGCGF39uT7LmRQ150-3OuGZlMrUVzsc:
"<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>ngin"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
I manually created the /acme-challenge directory and put a test index.html file within said directory. you can browse to it from a browser: http://teistebrito.com/.well-known/acme-challenge/
here’s the info from the letsencrypt.log file in /var/log:
2017-06-18 23:37:19,860:DEBUG:certbot.reporter:Reporting to user: The following errors were reported by the server:
Domain: www.teistebrito.com
Type: unauthorized
Detail: Invalid response from http://www.teistebrito.com/.well-known/acme-challenge/D0CwPvOEQUjMJGCGF39uT7LmRQ150-3OuGZlMrUVzsc: "<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>ngin"
To fix these errors, please make sure that your domain name was entered correctly and the DNS A record(s) for that domain contain(s) the right IP address.
2017-06-18 23:37:19,860:INFO:certbot.auth_handler:Cleaning up challenges
2017-06-18 23:37:19,861:DEBUG:certbot.plugins.webroot:Removing /path/to/site/public_html/.well-known/acme-challenge/h9oep-03WkA_ondXUgvD_5aeydn5yUN1HyhkXmg00oU
2017-06-18 23:37:19,861:DEBUG:certbot.plugins.webroot:Removing /path/to/site/public_html/.well-known/acme-challenge/D0CwPvOEQUjMJGCGF39uT7LmRQ150-3OuGZlMrUVzsc
2017-06-18 23:37:19,861:INFO:certbot.plugins.webroot:Unable to clean up challenge directory /path/to/site/public_html/.well-known/acme-challenge
2017-06-18 23:37:19,862:DEBUG:certbot.plugins.webroot:Error was: [Errno 39] Directory not empty: '/path/to/site/public_html/.well-known/acme-challenge'
2017-06-18 23:37:19,863:DEBUG:certbot.main:Exiting abnormally:
Traceback (most recent call last):
File "/usr/bin/certbot", line 11, in <module>
load_entry_point('certbot==0.11.1', 'console_scripts', 'certbot')()
File "/usr/lib/python2.7/dist-packages/certbot/main.py", line 882, in main
return config.func(config, plugins)
File "/usr/lib/python2.7/dist-packages/certbot/main.py", line 659, in obtain_cert
action, _ = _auth_from_available(le_client, config, domains, certname, lineage)
File "/usr/lib/python2.7/dist-packages/certbot/main.py", line 108, in _auth_from_available
lineage = le_client.obtain_and_enroll_certificate(domains, certname)
File "/usr/lib/python2.7/dist-packages/certbot/client.py", line 294, in obtain_and_enroll_certificate
certr, chain, key, _ = self.obtain_certificate(domains)
File "/usr/lib/python2.7/dist-packages/certbot/client.py", line 265, in obtain_certificate
self.config.allow_subset_of_names)
File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 77, in get_authorizations
self._respond(resp, best_effort)
File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 134, in _respond
self._poll_challenges(chall_update, best_effort)
File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 198, in _poll_challenges
raise errors.FailedChallenges(all_failed_achalls)
FailedChallenges: Failed authorization procedure. www.teistebrito.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.teistebrito.com/.well-known/acme-challenge/D0CwPvOEQUjMJGCGF39uT7LmRQ150-3OuGZlMrUVzsc: "<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>ngin"
here’s my nginx vhost config:
server {
listen 80;
listen [::]:80;
server_name teistebrito.com;
root /path/to/site/public_html;
index index.php index.html index.htm index.nginx-debian.html;
# Logs
access_log /logs/access.log;
error_log /logs/error.log warn;
# server_name teistebrito.com;
location / {
autoindex on;
try_files $uri $uri/ =404;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php7.0-fpm.sock;
}
location ~ /\.ht {
deny all;
}
}
does anyone have any ideas what’s going on here? any help is greatly appreciated!