Failed authorization procedure

[dieselfreak]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:regener8.cf

I ran this command:
certbot (manually stepping through the options)
It produced this output:
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for nextcloud.regener8.cf
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. nextcloud.regener8.cf (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://nextcloud.regener8.cf/.well-known/acme-challenge/JAoEqsahe1ZTfy3YXuXMXXSc4N7KA8_0K9Zr5FyoIHo [5.80.140.233]: “\n\n404 Not Found\n\n

Not Found

\n<p”

My web server is (include version):
Apache/2.4.18 (Ubuntu)

The operating system my web server runs on is (include version):

Ubuntu 16.04.5 LTS

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

certbot 0.21.1

[JuergenAuer]

Hi @dieselfreak

@dieselfreak

Performing the following challenges:
http-01 challenge for nextcloud.regener8.cf

checking your configuration ( https://check-your-website.server-daten.de/?q=nextcloud.regener8.cf ):

Your ip addresses:

Host	T	IP-Address	is auth.	∑ Queries	∑ Timeout
nextcloud.regener8.cf	C	regener8.duckdns.org	yes	1	0
	A	5.80.140.233	yes
www.nextcloud.regener8.cf		Name Error	yes	1	0

There is a CNAME entry nextcloud -> your duckdns.org ip address. Is this ip the ip your certbot is running?

@dieselfreak

certbot 0.21.1

Your certbot is very old. Perhaps you have used tls-sni-01 validation (port 443), that's not longer supported. So it may be the first time you use http-01 validation.

So Certbot creates a file in YourWebRoot/.well-known/acme-challenge with a random file name, Letsencrypt checks that file via port 80.

That looks good:

Domainname	Http-Status	redirect	Sec.	G
• http://nextcloud.regener8.cf/
5.80.140.233	200		0.110	H
• https://nextcloud.regener8.cf/
5.80.140.233	200		0.883	N
Certificate error: RemoteCertificateChainErrors
• http://nextcloud.regener8.cf/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
5.80.140.233	404		0.110	A
Not Found
Visible Content: Not Found The requested URL /.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de was not found on this server. Apache/2.4.18 (Ubuntu) Server at nextcloud.regener8.cf Port 80

Port 80 is open, checking a not existing file there is the expected result http status 404 - Not Found.

So try to find your DocumentRoot of your

Server: Apache/2.4.18 (Ubuntu)

then use it:

certbot run -a webroot -i apache -w yourDocumentRoot -d nextcloud.regener8.cf

If that doesn't work. First step - update your certbot.

Certbot

[dieselfreak]

Thank for response.

I ran:
certbot run -a webroot -i apache -w /var/www/html -d nextcloud.regener8.cf

I get the following:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer apache
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for nextcloud.regener8.cf
Using the webroot path /var/www/html for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. nextcloud.regener8.cf (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://nextcloud.regener8.cf/.well-known/acme-challenge/XTd4FpmXlgm4rYIIc5wqfYFBTS0JOTlZwMh9LY5cAyM [5.80.140.233]: “\n\n404 Not Found\n\n

Not Found

\n<p”

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: nextcloud.regener8.cf
  Type: unauthorized
  Detail: Invalid response from
  http://nextcloud.regener8.cf/.well-known/acme-challenge/XTd4FpmXlgm4rYIIc5wqfYFBTS0JOTlZwMh9LY5cAyM
  [5.80.140.233]: “\n\n404 Not
  Found\n\n

  Not Found

  \n<p”

  To fix these errors, please make sure that your domain name was
  entered correctly and the DNS A/AAAA record(s) for that domain
  contain(s) the right IP address.

[dieselfreak]

Sorry, I should have mentioned.
I also updated certbot:
certbot 0.31.0

Regards
D

[JuergenAuer]

@dieselfreak

/var/www/html

Then there are some options.

• This isn't your real webroot
• you have location definitions, so other directories are used
• this vHost isn't used, instead the standard vHost is used
• another instance answers, perhaps because of a wrong router forward

Create the two directories

yourDocumentRoot/.well-known/acme-challenge

there a file (file name 1234), then try to load that file via

http://nextcloud.regener8.cf/.well-known/acme-challenge/1234

[dieselfreak]

stupid question:
when u say yourdocumentroot:
will that be the root for apache2
/var/www/html
or for the site:
/var/www/nextcloud

[dieselfreak]

You sir I owe a Pint .

certbot run -a webroot -i apache -w /var/www/nextcloud -d nextcloud.regener8.cf

Certificate is now renewed and site up.
Very kind regards
D

[JuergenAuer]

@dieselfreak

will that be the root for apache2
/var/www/html
or for the site:
/var/www/nextcloud

Both is possible. Check your configuration files.

@dieselfreak

Certificate is now renewed and site up.

Happy to read that. Now you have a new Letsencrypt certificate:

CN=nextcloud.regener8.cf
	29.04.2019
	28.07.2019
expires in 90 days	nextcloud.regener8.cf - 1 entry