Failed renewal - error 403

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: lmcloud.hopto.org

I ran this command: sudo /etc/letsencrypt/renew.sh

It produced this output:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/lmcloud.hopto.org.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate for lmcloud.hopto.org
Performing the following challenges:
http-01 challenge for lmcloud.hopto.org
Waiting for verification...
Challenge failed for domain lmcloud.hopto.org
http-01 challenge for lmcloud.hopto.org

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: lmcloud.hopto.org
  Type:   unauthorized
  Detail: 79.116.0.44: Invalid response from https://lmcloud.hopto.org/.well-known/acme-challenge/nVtt632ZS9g--3xzwBp_S8vN0HscBO_HYuU_b_EwoAU: 403

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

My web server is (include version): Server version: Apache/2.4.38 (Raspbian)

The operating system my web server runs on is (include version): Raspbian GNU/Linux 10

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.27.0

===================================================

Hi, this is my first post and I've become quite desperate while trying to renew my certificate. First please note that I'm fairly new to SSL and website hosting, but I think that the issue is that the acme-challenge folder is not accesible. I'm posting down below some files that I think may be helpful.

apache *.conf file

NameVirtualHost *:80
<VirtualHost *:80>
   ServerName lmcloud.hopto.org
   Redirect permanent / https://lmcloud.hopto.org/
   # SSL Configuration
   Alias /.well-known/acme-challenge/ /var/www/owncloud/.well-known/acme-challenge/
   <Directory "/var/www/owncloud/.well-known/acme-challenge/">
            #Options Indexes FollowSymLinks Includes ExecCGI
            Options Indexes
            Require all granted
            AllowOverride all
            ForceType text/plain
            RedirectMatch 404 "^(?!/\.well-known/acme-challenge/[\w-]{43}$)"
   </Directory>
</VirtualHost>

<VirtualHost *:443>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        #ServerName www.example.com

        ServerAdmin lm_olano@hotmail.com
        ServerName lmcloud.hopto.org
        ServerAlias www.lmcloud.hopto.org
        DocumentRoot /var/www/owncloud


        # SSL Configuration
        Alias /.well-known/acme-challenge/ /var/www/owncloud/.well-known/acme-challenge/
        <Directory "/var/www/owncloud/.well-known/acme-challenge/">
                 #Options Indexes FollowSymLinks Includes ExecCGI
                 Options Indexes
                 Require all granted
                 AllowOverride all
                 ForceType text/plain
                 RedirectMatch 404 "^(?!/\.well-known/acme-challenge/[\w-]{43}$)"
        </Directory>

        Include /etc/apache2/ssl_rules/ssl_lmcloud.hopto.org

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf

        Alias /owncloud "/var/www/owncloud/"

        <Directory /var/www/owncloud/>
          Options +FollowSymlinks
          AllowOverride All

         <IfModule mod_dav.c>
          Dav off
         </IfModule>

         SetEnv HOME /var/www/owncloud
         SetEnv HTTP_HOME /var/www/owncloud
        </Directory>

</VirtualHost>

Any help would be greatly appreciated. Thanks in advance!

Luis

I think the redirection may be overriding the alias
OR
the alias fails to match the request correctly:

And my test of that seems to agree with me:

curl -Ii lmcloud.hopto.org/.well-known/acme-challenge/1234567890123456789012345678901234567890123
HTTP/1.1 301 Moved Permanently
Date: Sat, 28 May 2022 17:39:16 GMT
Server: Apache/2.4.38 (Raspbian)
Location: https://lmcloud.hopto.org/.well-known/acme-challenge/1234567890123456789012345678901234567890123
Content-Type: text/html; charset=iso-8859-1

Then the HTTPS server block should reply, since it has the exact same alias and directory...
But it fails to do so with permissions problem (403 forbidden) on all attempts:

curl -Iik https://lmcloud.hopto.org/.well-known/acme-challenge/1234567890123456789012345678901234567890123
HTTP/1.1 403 Forbidden
Date: Sat, 28 May 2022 17:42:45 GMT
Server: Apache/2.4.38 (Raspbian)
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
X-Robots-Tag: none
X-Frame-Options: SAMEORIGIN
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Set-Cookie: ocgcdlzs2fmk=mbcjcqe5sembe7esjclb7oco0p; path=/; secure; HttpOnly; SameSite=Strict
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: oc_sessionPassphrase=iyUbfqVAc3MsjHNN%2BIde8uyPrlewMe%2B2oi9SzCwTdm97XzlJc3L8YZu3SAMmxBUWQ3uvwl%2FrCX5w%2FZlKSfP9GWPRjeGZmC3eT60SVrujjSHo2FgQsSisqVjaH%2FQz0Seo; path=/; secure; HttpOnly; SameSite=Strict
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *
Content-Length: 6437
Content-Type: text/html; charset=UTF-8

curl -Iik https://lmcloud.hopto.org/.well-known/acme-challenge/NOT43WIDE
HTTP/1.1 403 Forbidden
Date: Sat, 28 May 2022 17:43:29 GMT
Server: Apache/2.4.38 (Raspbian)
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
X-Robots-Tag: none
X-Frame-Options: SAMEORIGIN
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Set-Cookie: ocgcdlzs2fmk=uapvlbccg0lh1nct118ubvg3jt; path=/; secure; HttpOnly; SameSite=Strict
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: oc_sessionPassphrase=tQ6wMCbeACscusrCucjmhjXsm9soIpwBApnG4ezJkS5e%2FX6GESHQacF6f%2Fo6rFm0QxqDaCySR1lWFSAQA1jmSLZ2BZryXR9zdsfvzbWDXSBrQWaoq5Tw8HIdk9ZDJsUE; path=/; secure; HttpOnly; SameSite=Strict
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *
Content-Length: 6437
Content-Type: text/html; charset=UTF-8

It never returns with 404 as expected.

2 Likes

Okay, I commented out the Redirect permanent line and the certificate got renewed seamlessly. I'm not sure if I fully understand the details behind, but I guess I'll leave it like this to prevent overriding the alias.

Thank you for your guidance :slightly_smiling_face:

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.