Failed : Type: unauthorized

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:www.live.turn2web.com

I ran this command:sudo certbot --apache -d live.turn2web.com -d www.live.turn2web.com -v

It produced this output:

root@localhost:/etc/apache2/sites-enabled# sudo certbot --apache -d live.turn2web.com -d www.live.turn2web.com -v
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Requesting a certificate for live.turn2web.com and www.live.turn2web.com
Performing the following challenges:
http-01 challenge for live.turn2web.com
http-01 challenge for www.live.turn2web.com
Waiting for verification...
Challenge failed for domain live.turn2web.com
Challenge failed for domain www.live.turn2web.com
http-01 challenge for live.turn2web.com
http-01 challenge for www.live.turn2web.com

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: live.turn2web.com
Type: unauthorized
Detail: During secondary validation: 172.232.102.26: Invalid response from http://live.turn2web.com/.well-known/acme-challenge/Um3RDtVDzdsOCR4XjPwaXLY04wSvqC0ftB3gL2rQ6xE: 404

Domain: www.live.turn2web.com
Type: unauthorized
Detail: 172.232.102.26: Invalid response from http://www.live.turn2web.com/.well-known/acme-challenge/t96wjmMkOHQQuV5-vKBa4LVfvccYFcBWSsIGB_L4tDo: 404

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):

apache2 -v

Server version: Apache/2.4.52 (Ubuntu)
Server built: 2024-04-10T17:45:18

The operating system my web server runs on is (include version):
Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-105-generic x86_64)

My hosting provider, if applicable, is:Godady

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

~# certbot --version
certbot 1.21.0

Other Logs from Lets Encrypt:

Server: nginx
Date: Sat, 04 May 2024 05:58:18 GMT
Content-Type: application/json
Content-Length: 1200
Connection: keep-alive
Boulder-Requester: 1387711836
Cache-Control: public, max-age=0, no-cache
Link: https://acme-v02.api.letsencrypt.org/directory;rel="index"
Replay-Nonce: R8tUGx_Z0GgxcbNav4SRPkHW0OWLHnbmCz2jhyVtONetrdSiby4
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
"identifier": {
"type": "dns",
"value": "www.sites.turn2web.com"
},
"status": "invalid",
"expires": "2024-05-11T05:58:12Z",
"challenges": [
{
"type": "http-01",
"status": "invalid",
"error": {
"type": "urn:ietf:params:acme:error:unauthorized",
"detail": "During secondary validation: 172.232.102.26: Invalid response from http://www.sites.turn2web.com/.well-known/acme-challenge/sv4PoBG2Ztyca6lUWjet5AbYCfeWxScDwlQXVFwoN3Y: 404",
"status": 403
},
"url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/346468212517/FYEzjQ",
"token": "sv4PoBG2Ztyca6lUWjet5AbYCfeWxScDwlQXVFwoN3Y",
"validationRecord": [
{
"url": "http://www.sites.turn2web.com/.well-known/acme-challenge/sv4PoBG2Ztyca6lUWjet5AbYCfeWxScDwlQXVFwoN3Y",
"hostname": "www.sites.turn2web.com",
"port": "80",
"addressesResolved": [
"172.232.102.26"
],
"addressUsed": "172.232.102.26",
"resolverAddrs": [
"A:10.0.12.88:30554",
"AAAA:10.0.12.88:30554"
]
}
],
"validated": "2024-05-04T05:58:16Z"
}
]
}
2024-05-04 05:58:18,229:DEBUG:acme.client:Storing nonce: R8tUGx_Z0GgxcbNav4SRPkHW0OWLHnbmCz2jhyVtONetrdSiby4
2024-05-04 05:58:18,230:INFO:certbot._internal.auth_handler:Challenge failed for domain sites.turn2web.com
2024-05-04 05:58:18,230:INFO:certbot._internal.auth_handler:Challenge failed for domain www.sites.turn2web.com
2024-05-04 05:58:18,231:INFO:certbot._internal.auth_handler:http-01 challenge for sites.turn2web.com
2024-05-04 05:58:18,231:INFO:certbot._internal.auth_handler:http-01 challenge for www.sites.turn2web.com
2024-05-04 05:58:18,231:DEBUG:certbot._internal.display.obj:Notifying user:
Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: sites.turn2web.com
Type: unauthorized
Detail: During secondary validation: 172.232.102.26: Invalid response from http://sites.turn2web.com/.well-known/acme-challenge/BRzLNPu99HQ0iZquVONGCd24PQ1Hm_QIiAv1w85ABuw: 404

Domain: www.sites.turn2web.com
Type: unauthorized
Detail: During secondary validation: 172.232.102.26: Invalid response from http://www.sites.turn2web.com/.well-known/acme-challenge/sv4PoBG2Ztyca6lUWjet5AbYCfeWxScDwlQXVFwoN3Y: 404

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

1 Like

Done !!;

Issue : The HA proxy has two apaches configured for high availability , I stop one apache , Problem resolved.

Glad you sorted that @rajaneeshm

But, do you have HAproxy setup as an SSL terminating Load Balancer? Because in that case HAproxy has the cert and terminates the HTTPS connection from the client (browser). It can talk to your Apache using HTTP (not needing a cert). If HAproxy and Apaches are on same system there is no real need to use HTTPS between them.

There are lots of ways to configure such systems. And, maybe your choice works best for you. Just thought I'd describe this as often people don't understand all the options.

This blog describes one way to setup such a system.

3 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.