# Failed authorization procedure

**URL:** <https://community.letsencrypt.org/t/failed-authorization-procedure/107394>\
**Category:** Help\
**Created:** [November 28, 2019, 9:19am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure/107394 "2019-11-28T09:19:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![da9l](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/da9l/32/35631_2.png) [@da9l](https://community.letsencrypt.org/u/da9l)\
**Post date:** [November 28, 2019, 9:19am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure/107394/1 "2019-11-28T09:19:27Z")

</div>

Im trying to install a certificate on a subdomain but keeps getting “Failed authorization procedure.”

* * *

My domain is:  
en.furusjoenrundt.no

I ran this command:  
sudo certbot --apache -d en.furusjoenrundt.no

It produced this output:  
Saving debug log to /var/log/letsencrypt/letsencrypt.log  
Plugins selected: Authenticator apache, Installer apache  
Obtaining a new certificate  
Performing the following challenges:  
http-01 challenge for en.furusjoenrundt.no  
Waiting for verification…  
Cleaning up challenges  
Failed authorization procedure. en.furusjoenrundt.no (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [https://www.furusjoenrundt.no/404.shtml](https://www.furusjoenrundt.no/404.shtml) [35.176.138.189]: “\n\<html lang=“nb-NO” \>\n\n\<meta charset=“UTF-8”\>\n\<meta name=“viewport” content=“width=device-width”\>\n\<!-- WP\_H”

IMPORTANT NOTES:

- The following errors were reported by the server:

My web server is (include version):  
Apache/2.4.29

The operating system my web server runs on is (include version):  
Ubuntu 18.04  
My hosting provider, if applicable, is:  
Amazon AWS

I can login to a root shell on my machine (yes or no, or I don’t know):  
Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):  
No

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): certbot 0.31.0

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [November 28, 2019, 9:45am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure/107394/2 "2019-11-28T09:45:57Z")

</div>

Hi @da9l

> [@da9l](#):
>
> My domain is:  
> [en.mydomain.com](http://en.mydomain.com)

your domain name is required.

---

<div class="post-metadata">

**Author:** ![da9l](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/da9l/32/35631_2.png) [@da9l](https://community.letsencrypt.org/u/da9l)\
**Post date:** [November 28, 2019, 9:48am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure/107394/3 "2019-11-28T09:48:48Z")

</div>

Updated to original domain

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [November 28, 2019, 9:57am UTC](https://community.letsencrypt.org/t/failed-authorization-procedure/107394/4 "2019-11-28T09:57:19Z")

</div>

> [@da9l](#):
>
> I ran this command:  
> sudo certbot --apache -d en.furusjoenrundt.no

There are some different errors. Checking your domain via [https://check-your-website.server-daten.de/?q=en.furusjoenrundt.no](https://check-your-website.server-daten.de/?q=en.furusjoenrundt.no)

You have ipv4 and ipv6:

| Host | T | IP-Address | is auth. | ∑ Queries | ∑ Timeout |
| --- | --- | --- | --- | --- | --- |
| en.furusjoenrundt.no | A | 35.176.138.189 London/England/United Kingdom (GB) - Amazon Technologies Inc. Hostname: [ec2-35-176-138-189.eu-west-2.compute.amazonaws.com](http://ec2-35-176-138-189.eu-west-2.compute.amazonaws.com) | yes | 1 | 0 |
| | AAAA | 2a02:1660:4104:630c:62:50:189:186 Førde/Sogn og Fjordane/Norway (NO) - Enivest AS | yes | | |
| www.en.furusjoenrundt.no | A | 62.50.189.186 Bygstad/Sogn og Fjordane/Norway (NO) - ENIVEST | | | |
| Hostname: web.igt.no | yes | 1 | 0 | | |
| | AAAA | 2a02:1660:4104:630c:62:50:189:186 Førde/Sogn og Fjordane/Norway (NO) - Enivest AS | yes | | |

Amazon versus a place in Norway.

And different http answers:

| K | [https://en.furusjoenrundt.no/](https://en.furusjoenrundt.no/) 35.176.138.189, Status 301 |
| --- | --- |
| | |
| | [https://en.furusjoenrundt.no/](https://en.furusjoenrundt.no/) 2a02:1660:4104:630c:62:50:189:186, Status 200 |
| | configuration problem - different ip addresses with different status |
| K | [http://en.furusjoenrundt.no/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://en.furusjoenrundt.no/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) 35.176.138.189, Status 404 |
| | |
| | [http://en.furusjoenrundt.no/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://en.furusjoenrundt.no/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) 2a02:1660:4104:630c:62:50:189:186, Status 301 |
| | configuration problem - different ip addresses with different status |

Letsencrypt prefers ipv6, so that's critical, if only ipv4 works as expected.

The url check has additional problems, redirect to /404.shtml is always critical.

But first you have to fix your different http answers ipv4 / ipv6.

- Remove your ipv6 (or, better)
- use the ipv6 of your amazon ipv4, if there is one.

Then recheck the domain to see, if that error is gone.

---

<div class="post-metadata">

**Author:** ![da9l](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/da9l/32/35631_2.png) [@da9l](https://community.letsencrypt.org/u/da9l)\
**Post date:** [November 28, 2019, 1:05pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure/107394/5 "2019-11-28T13:05:29Z")

</div>

Removing the ipv6 record worked and the SSL-certificate is now installed successfully.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [December 28, 2019, 1:05pm UTC](https://community.letsencrypt.org/t/failed-authorization-procedure/107394/6 "2019-12-28T13:05:30Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.