# Failed authorization procedure via DNS **URL:** \ **Category:** Help\ **Created:** [January 10, 2018, 1:23am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954 "2018-01-10T01:23:21Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![burgoyn1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/burgoyn1/32/19205_2.png) [@burgoyn1](https://community.letsencrypt.org/u/burgoyn1)\ **Post date:** [January 10, 2018, 1:23am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954/1 "2018-01-10T01:23:21Z")
I have lets encrypt setup and working, but I am wanting to renew the certificate and I am getting the following error: > Attempting to renew cert (\*) from \*.conf produced an unexpected error: Failed authorization procedure. \* (dns-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect TXT record "textstring" found at \_acme-challenge.\*. Skipping. Due to our setup I can not do tls-sni or http verification, only DNS. I can provide more information or logs if need be but I am at a loss. I have checked our DNS and can confirm the txt files are there and correct. When I check the logs they are coming back as a 403 error. The renewal has worked before, but not anymore. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 10, 2018, 1:32am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954/2 "2018-01-10T01:32:07Z")
Redacting your domain and error message makes it super hard to help you. Please provide as many of the following details as you know: > Please fill out the fields below so we can help you better. Note: you **must** provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. > > My domain is: > > I ran this command: > > It produced this output: > > My web server is (include version): > > The operating system my web server runs on is (include version): > > My hosting provider, if applicable, is: > > I can login to a root shell on my machine (yes or no, or I don't know): > > I'm using a control panel to manage my site (no, or provide the name and version of the control panel): ---
**Author:** ![burgoyn1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/burgoyn1/32/19205_2.png) [@burgoyn1](https://community.letsencrypt.org/u/burgoyn1)\ **Post date:** [January 10, 2018, 1:38am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954/3 "2018-01-10T01:38:26Z")
My domain is: [crowdcontent.com](http://crowdcontent.com) I ran this command: certbot renew --config-dir=/home/servers/certbot/config --work-dir=/home/servers/certbot/work --logs-dir=/home/servers/certbot/logs --manual-auth-hook /home/servers/ssl\_authenticator.sh --manual-cleanup-hook /home/servers/ssl\_cleanup.sh --preferred-challenges dns --dry-run It produced this output: Attempting to renew cert ([crowdcontent.com](http://crowdcontent.com)) from /home/servers/certbot/config/renewal/crowdcontent.com.conf produced an unexpected error: Failed authorization procedure. [crowdcontent.com](http://crowdcontent.com) (dns-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect TXT record “3r6soJfsXwcKs7F704nUelDJnlo4CeHESbJxA1sNN4c” found at \_acme-challenge.crowdcontent.com, **same for all subdomains** Skipping. My web server is (include version): haproxy 1.8.3 The operating system my web server runs on is (include version): Ubuntu 16.04.3 Have full access to the server, root, reboots, etc. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 10, 2018, 1:45am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954/4 "2018-01-10T01:45:34Z")
> [@burgoyn1](#): > > ssl\_authenticator.sh This script creates the TXT record(s) with the passed [`CERTBOT_VALIDATION`](http://letsencrypt.readthedocs.io/en/latest/using.html#hooks) environment variable, then? Are we able to see the script (remove any credentials as required)? edit: Also, does this happen without `--dry-run`? ---
**Author:** ![burgoyn1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/burgoyn1/32/19205_2.png) [@burgoyn1](https://community.letsencrypt.org/u/burgoyn1)\ **Post date:** [January 10, 2018, 1:51am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954/5 "2018-01-10T01:51:05Z")
That ssl\_authenticator.sh script is an empty bash file, as certbot would not run before without it. Just ran certbot without it and it produced the same result. Yes, same thing happens without `--dry-run`. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 10, 2018, 1:56am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954/6 "2018-01-10T01:56:18Z")
Right. So, `certbot renew` is a non-interactive command. The reason it will not run without passing the `auth-hook` scripts is that Certbot needs to be able to update your TXT records automatically with new challenge values. That is what the hooks are for. The initial TXT records you created are most likely no longer valid. In the _best_ case, they only authorize you to issue certificates for the domain for 30 days. After that time (or earlier), the value of the challenge changes, and the TXT records must be updated to a new challenge value. The way you are calling `certbot renew` does not do this, because your empty scripts are meant to be updating the TXT records, but they do nothing. If you wish to do the manual DNS challenge again (interactively, rather than non-interactively), then you need to run `certbot certonly` using the same parameters that you used the first time. `certbot renew` doesn’t do what you want. ---
**Author:** ![burgoyn1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/burgoyn1/32/19205_2.png) [@burgoyn1](https://community.letsencrypt.org/u/burgoyn1)\ **Post date:** [January 10, 2018, 1:57am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954/7 "2018-01-10T01:57:22Z")
Yea, I just realised that. Been a long day. Going to try something then let you know if that worked. ---
**Author:** ![burgoyn1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/burgoyn1/32/19205_2.png) [@burgoyn1](https://community.letsencrypt.org/u/burgoyn1)\ **Post date:** [January 10, 2018, 2:09am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954/8 "2018-01-10T02:09:18Z")
Yup, it was me not thinking. I got it now, thanks for your help and explanation. Missed the stuff about the TXT records changing after 30 days. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [February 9, 2018, 2:09am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure-via-dns/49954/9 "2018-02-09T02:09:19Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.