Failed authorization procedure

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:regener8.cf

I ran this command:
certbot (manually stepping through the options)
It produced this output:
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for nextcloud.regener8.cf
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. nextcloud.regener8.cf (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://nextcloud.regener8.cf/.well-known/acme-challenge/JAoEqsahe1ZTfy3YXuXMXXSc4N7KA8_0K9Zr5FyoIHo [5.80.140.233]: “\n\n404 Not Found\n\n

Not Found

\n<p”

My web server is (include version):
Apache/2.4.18 (Ubuntu)

The operating system my web server runs on is (include version):

Ubuntu 16.04.5 LTS

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

certbot 0.21.1

Hi @dieselfreak

checking your configuration ( https://check-your-website.server-daten.de/?q=nextcloud.regener8.cf ):

Your ip addresses:

Host T IP-Address is auth. ∑ Queries ∑ Timeout
nextcloud.regener8.cf C regener8.duckdns.org yes 1 0
A 5.80.140.233 yes
www.nextcloud.regener8.cf Name Error yes 1 0

There is a CNAME entry nextcloud -> your duckdns.org ip address. Is this ip the ip your certbot is running?

Your certbot is very old. Perhaps you have used tls-sni-01 validation (port 443), that's not longer supported. So it may be the first time you use http-01 validation.

So Certbot creates a file in YourWebRoot/.well-known/acme-challenge with a random file name, Letsencrypt checks that file via port 80.

That looks good:

Domainname Http-Status redirect Sec. G
http://nextcloud.regener8.cf/
5.80.140.233 200 0.110 H
https://nextcloud.regener8.cf/
5.80.140.233 200 0.883 N
Certificate error: RemoteCertificateChainErrors
http://nextcloud.regener8.cf/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
5.80.140.233 404 0.110 A
Not Found
Visible Content: Not Found The requested URL /.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de was not found on this server. Apache/2.4.18 (Ubuntu) Server at nextcloud.regener8.cf Port 80

Port 80 is open, checking a not existing file there is the expected result http status 404 - Not Found.

So try to find your DocumentRoot of your

Server: Apache/2.4.18 (Ubuntu)

then use it:

certbot run -a webroot -i apache -w yourDocumentRoot -d nextcloud.regener8.cf

If that doesn't work. First step - update your certbot.

Thank for response.

I ran:
certbot run -a webroot -i apache -w /var/www/html -d nextcloud.regener8.cf

I get the following:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer apache
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for nextcloud.regener8.cf
Using the webroot path /var/www/html for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. nextcloud.regener8.cf (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://nextcloud.regener8.cf/.well-known/acme-challenge/XTd4FpmXlgm4rYIIc5wqfYFBTS0JOTlZwMh9LY5cAyM [5.80.140.233]: “\n\n404 Not Found\n\n

Not Found

\n<p”

IMPORTANT NOTES:

Sorry, I should have mentioned.
I also updated certbot:
certbot 0.31.0

Regards
D

Then there are some options.

  • This isn't your real webroot
  • you have location definitions, so other directories are used
  • this vHost isn't used, instead the standard vHost is used
  • another instance answers, perhaps because of a wrong router forward

Create the two directories

yourDocumentRoot/.well-known/acme-challenge

there a file (file name 1234), then try to load that file via

http://nextcloud.regener8.cf/.well-known/acme-challenge/1234

stupid question:
when u say yourdocumentroot:
will that be the root for apache2
/var/www/html
or for the site:
/var/www/nextcloud

You sir I owe a Pint .

certbot run -a webroot -i apache -w /var/www/nextcloud -d nextcloud.regener8.cf

Certificate is now renewed and site up.
Very kind regards
D

1 Like

Both is possible. Check your configuration files.

Happy to read that. Now you have a new Letsencrypt certificate:

CN=nextcloud.regener8.cf
	29.04.2019
	28.07.2019
expires in 90 days	nextcloud.regener8.cf - 1 entry

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.