# Http-01 challenge failed due to an unauthorized response when renewing the cert

**URL:** <https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909>\
**Category:** Help\
**Created:** [May 23, 2024, 4:06pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909 "2024-05-23T16:06:02Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![d-shiri](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/d-shiri/32/80227_2.png) [@d-shiri](https://community.letsencrypt.org/u/d-shiri)\
**Post date:** [May 23, 2024, 4:06pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/1 "2024-05-23T16:06:02Z")

</div>

Hi, I am having the follwoing issue would appreciate some help. the strange thing is it is been working for 2.5 years and suddenly it is not working.

My domain is: `drposture.app`

I ran this command: `sudo certbot --dry-run --apache certonly -d drposture.app`

It produced this output:

```nohighlight
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for drposture.app
Waiting for verification...
Challenge failed for domain drposture.app
http-01 challenge for drposture.app
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: drposture.app
   Type: unauthorized
   Detail: 2a01:4f8:1c17:df57::1: Invalid response from
   http://drposture.app/.well-known/acme-challenge/lUgPLeigw4B-N7oIeaPKhgq5sPqawnYmy9VguMidvPE:
   404

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

```

My web server is (include version): `Apache/2.4.41 (Ubuntu)`

The operating system my web server runs on is (include version): `Ubuntu 20.04.6 LTS`

My hosting provider, if applicable, is: hetzner

I can login to a root shell on my machine (yes or no, or I don't know): `yes`

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): `No`

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): `certbot 0.40.0`

**`apachectl -s` Info:**

```nohighlight
apachectl -S                                       
VirtualHost configuration:
*:443 is a NameVirtualHost
         default server api.drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:6)
         port 443 namevhost api.drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:6)
         port 443 namevhost bat.drposture.app (/etc/apache2/sites-enabled/bat.drposture.app-le-ssl.conf:2)
         port 443 namevhost batapi.drposture.app (/etc/apache2/sites-enabled/batapi.drposture.app-le-ssl.conf:2)
         port 443 namevhost cms.drposture.app (/etc/apache2/sites-enabled/cms.drposture.app-le-ssl.conf:2)
         port 443 namevhost qa.cms.drposture.app (/etc/apache2/sites-enabled/qa.cms.drposture.app-le-ssl.conf:2)
*:* is a NameVirtualHost
         default server drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:2)
         port * namevhost drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:2)
         port * namevhost drposture.app (/etc/apache2/sites-enabled/api.drposture.app.conf:1)
         port * namevhost drposture.app (/etc/apache2/sites-enabled/cms.drposture.app.conf:1)
         port * namevhost drposture.app (/etc/apache2/sites-enabled/drposture.app.conf:1)
         port * namevhost drposture.app (/etc/apache2/sites-enabled/qa.cms.drposture.app.conf:1)
*:80 is a NameVirtualHost
         default server api.drposture.app (/etc/apache2/sites-enabled/api.drposture.app.conf:5)
         port 80 namevhost api.drposture.app (/etc/apache2/sites-enabled/api.drposture.app.conf:5)
         port 80 namevhost drposture.app (/etc/apache2/sites-enabled/bat.drposture.app.conf:1)
         port 80 namevhost batapi.drposture.app (/etc/apache2/sites-enabled/batapi.drposture.app.conf:1)
         port 80 namevhost cms.drposture.app (/etc/apache2/sites-enabled/cms.drposture.app.conf:8)
         port 80 namevhost drposture.app (/etc/apache2/sites-enabled/drposture.app.conf:5)
                 alias www.drposture.app
         port 80 namevhost qa.cms.drposture.app (/etc/apache2/sites-enabled/qa.cms.drposture.app.conf:5)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex watchdog-callback: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/run/apache2/" mechanism=default 
Mutex mpm-accept: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
Define: ENABLE_USR_LIB_CGI_BIN
User: name="www-data" id=33
Group: name="www-data" id=33

```

**My apache conf:**

```nohighlight
<VirtualHost *:*>
    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
</VirtualHost>

<VirtualHost *:80>

    <Directory "/var/www/drposture.app/.well-known/acme-challenge/">
        Options None
        AllowOverride None
        Require all granted
    </Directory>
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:5500/
    ProxyPassReverse / http://127.0.0.1:5500/
   ServerName drposture.app
    ServerAlias www.drposture.app
    ErrorLog ${APACHE_LOG_DIR}drposture_app_conf-error.log
    CustomLog ${APACHE_LOG_DIR}drposture_app_conf-access.log common
RewriteEngine on
RewriteCond %{SERVER_NAME} =drposture.app [OR]
RewriteCond %{SERVER_NAME} =www.drposture.app
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

```

**drposture.app-le-ssl.conf**

```nohighlight
<IfModule mod_ssl.c>
<VirtualHost *:443>
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:5500/
    ProxyPassReverse / http://127.0.0.1:5500/
    ServerName drposture.app
    ServerAlias www.drposture.app
    ErrorLog ${APACHE_LOG_DIR}drposture_app_conf-error.log
    CustomLog ${APACHE_LOG_DIR}drposture_app_conf-access.log common
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.

# RewriteCond %{SERVER_NAME} =drposture.app [OR]
# RewriteCond %{SERVER_NAME} =www.drposture.app
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/www.drposture.app-0001/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.drposture.app-0001/privkey.pem
</VirtualHost>
</IfModule>

```

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [May 23, 2024, 4:17pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/2 "2024-05-23T16:17:31Z")

</div>

> [@d-shiri](#):
>
> `*:* is a NameVirtualHost`

That's weird.

Why are there `*:80` and `*:443` virtualhosts, which are normal, **and** a virtualhost for `*:*`? That's going to lead to problems.

---

<div class="post-metadata">

**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\
**Post date:** [May 23, 2024, 4:26pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/3 "2024-05-23T16:26:11Z")

</div>

As is this:

> [@d-shiri](#):
>
> ` <Directory "/var/www/drposture.app/.well-known/acme-challenge/">`

Hi @d-shiri Welcome and thanks for providing the info up front!  
I would expect to see something more like:

```nohighlight
<Directory "/var/www/drposture.app>

```

The validation servers know where to find **.well-known/acme-challenge/**

Your domain checks out for http challenge:

> **[Test result for drposture.app: OK](https://letsdebug.net/drposture.app/1974913)**
>
> 0 unique issue(s) detected

And DNS challenge:

> **[Test result for drposture.app: OK](https://letsdebug.net/drposture.app/1974915)**
>
> 0 unique issue(s) detected

First glance for me and I have to say I am not "proxy oriented" so I'll sit back and learn from other volunteers here.

---

<div class="post-metadata">

**Author:** ![d-shiri](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/d-shiri/32/80227_2.png) [@d-shiri](https://community.letsencrypt.org/u/d-shiri)\
**Post date:** [May 23, 2024, 4:30pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/4 "2024-05-23T16:30:21Z")

</div>

Thanks for the reply, I changed it. but still the same error.

---

<div class="post-metadata">

**Author:** ![d-shiri](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/d-shiri/32/80227_2.png) [@d-shiri](https://community.letsencrypt.org/u/d-shiri)\
**Post date:** [May 23, 2024, 4:31pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/5 "2024-05-23T16:31:28Z")

</div>

thanks for the reply. even when I delete that part the issue persists.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [May 23, 2024, 4:35pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/6 "2024-05-23T16:35:17Z")

</div>

You probably also want to remove the proxy pass stuff from your `*:80` vhosts.. That one should only redirect to HTTPS. But currently I don't see a HTTP to HTTPS redirect, not even for your main domain (thus not limited to the challenge).

Even better is to exclude the path `/.well-known/acme-challenge/` from the redirect.

---

<div class="post-metadata">

**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\
**Post date:** [May 23, 2024, 4:53pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/7 "2024-05-23T16:53:26Z")

</div>

> [@Osiris](#):
>
> exclude the path `/.well-known/acme-challenge/` from the redirect.

Absolutely! And I would also recommend excluding it from the proxy:

```nohighlight
# challenge requests should not be proxied
    <Location "/.well-known/acme-challenge/">
        ProxyPass !
    </Location>

```

I dont know how to use a proxy, but I do know how NOT to use one

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [May 23, 2024, 4:54pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/8 "2024-05-23T16:54:11Z")

</div>

> [@Rip](#):
>
> And I would also recommend excluding it from the proxy

If you don't redirect that path to HTTPS and don't have the proxy stuff in your HTTP vhost, this isn't necessary 🙂

---

<div class="post-metadata">

**Author:** ![d-shiri](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/d-shiri/32/80227_2.png) [@d-shiri](https://community.letsencrypt.org/u/d-shiri)\
**Post date:** [May 23, 2024, 5:03pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/9 "2024-05-23T17:03:13Z")

</div>

Ok thanks, @Rip & @Osiris  
I will make the changes and report the result here. I need to do it in an hour because I hit the hourly limit. 😃

---

<div class="post-metadata">

**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\
**Post date:** [May 23, 2024, 5:05pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/10 "2024-05-23T17:05:36Z")

</div>

You should be using the staging server which has more generous limits while testing... then get your cert from production. 😀

---

<div class="post-metadata">

**Author:** ![d-shiri](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/d-shiri/32/80227_2.png) [@d-shiri](https://community.letsencrypt.org/u/d-shiri)\
**Post date:** [May 23, 2024, 5:20pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/11 "2024-05-23T17:20:37Z")

</div>

using the staging server I can test again. thanks for the tip 🙂  
I commented out all the unusual stuff and ended up with this:

```nohighlight
#<VirtualHost *:*>
# RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
#</VirtualHost>
#
<VirtualHost *:80>

    <Directory "/var/www/drposture.app">
        Options None
        AllowOverride None
        Require all granted
    </Directory>
    <Location "/.well-known/acme-challenge/">
        ProxyPass !
    </Location>
# ProxyPreserveHost On
# ProxyPass / http://127.0.0.1:5500/
# ProxyPassReverse / http://127.0.0.1:5500/
     ServerName drposture.app
     DocumentRoot /var/www/drposture.app
# ServerAlias www.drposture.app
# ErrorLog ${APACHE_LOG_DIR}drposture_app_conf-error.log
# CustomLog ${APACHE_LOG_DIR}drposture_app_conf-access.log common
#RewriteEngine on
#RewriteCond %{SERVER_NAME} =drposture.app [OR]
#RewriteCond %{SERVER_NAME} =www.drposture.app
#RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

```

but still not working ☹

---

<div class="post-metadata">

**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\
**Post date:** [May 23, 2024, 5:28pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/12 "2024-05-23T17:28:12Z")

</div>

> [@d-shiri](#):
>
> ```nohighlight
> <Location "/.well-known/acme-challenge/">
> ProxyPass !
> </Location>
> 
> ```

Since you commented out the proxy configuration as @Osiris suggested, you can completely remove this block.

---

<div class="post-metadata">

**Author:** ![d-shiri](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/d-shiri/32/80227_2.png) [@d-shiri](https://community.letsencrypt.org/u/d-shiri)\
**Post date:** [May 23, 2024, 5:39pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/13 "2024-05-23T17:39:08Z")

</div>

> [@Osiris](#):
>
> exclude the path `/.well-known/acme-challenge/` from the redirect.

still did not work. maybe something more fundamental is wrong

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [May 23, 2024, 5:41pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/14 "2024-05-23T17:41:15Z")

</div>

> [@d-shiri](#):
>
> maybe something more fundamental is wrong

Well, your site is still not redirecting HTTP to HTTPS in general, so I concur that something more fundamental is not entirely correct.

Could you post the output from `apachectl -t -D DUMP_VHOSTS` again?

---

<div class="post-metadata">

**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\
**Post date:** [May 23, 2024, 5:43pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/15 "2024-05-23T17:43:56Z")

</div>

OK so maybe you should place a "testfile" in the place where the validation servers will be looking and check to see if it is publicly available:

```nohighlight
echo "test" > /var/www/drposture.app/.well-known/acme-challenge/testfile
curl http://drposture.app/.well-known/acme-challenge/testfile

```

This might shed some light on a possible issue - might not. Worth a try to be sure..

---

<div class="post-metadata">

**Author:** ![d-shiri](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/d-shiri/32/80227_2.png) [@d-shiri](https://community.letsencrypt.org/u/d-shiri)\
**Post date:** [May 23, 2024, 7:41pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/16 "2024-05-23T19:41:38Z")

</div>

> [@Osiris](#):
>
> apachectl -t -D DUMP\_VHOSTS

```nohighlight
[drposture /etc/apache2/sites-available]# apachectl -t -D DUMP_VHOSTS
VirtualHost configuration:
*:443 is a NameVirtualHost
         default server api.drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:6)
         port 443 namevhost api.drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:6)
         port 443 namevhost bat.drposture.app (/etc/apache2/sites-enabled/bat.drposture.app-le-ssl.conf:2)
         port 443 namevhost batapi.drposture.app (/etc/apache2/sites-enabled/batapi.drposture.app-le-ssl.conf:2)
         port 443 namevhost cms.drposture.app (/etc/apache2/sites-enabled/cms.drposture.app-le-ssl.conf:2)
         port 443 namevhost qa.cms.drposture.app (/etc/apache2/sites-enabled/qa.cms.drposture.app-le-ssl.conf:2)
*:* is a NameVirtualHost
         default server drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:2)
         port * namevhost drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:2)
         port * namevhost drposture.app (/etc/apache2/sites-enabled/api.drposture.app.conf:1)
         port * namevhost drposture.app (/etc/apache2/sites-enabled/cms.drposture.app.conf:1)
         port * namevhost drposture.app (/etc/apache2/sites-enabled/qa.cms.drposture.app.conf:1)
*:80 is a NameVirtualHost
         default server api.drposture.app (/etc/apache2/sites-enabled/api.drposture.app.conf:5)
         port 80 namevhost api.drposture.app (/etc/apache2/sites-enabled/api.drposture.app.conf:5)
         port 80 namevhost drposture.app (/etc/apache2/sites-enabled/bat.drposture.app.conf:1)
         port 80 namevhost batapi.drposture.app (/etc/apache2/sites-enabled/batapi.drposture.app.conf:1)
         port 80 namevhost cms.drposture.app (/etc/apache2/sites-enabled/cms.drposture.app.conf:8)
         port 80 namevhost drposture.app (/etc/apache2/sites-enabled/drposture.app.conf:5)
         port 80 namevhost qa.cms.drposture.app (/etc/apache2/sites-enabled/qa.cms.drposture.app.conf:5)

```

---

<div class="post-metadata">

**Author:** ![d-shiri](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/d-shiri/32/80227_2.png) [@d-shiri](https://community.letsencrypt.org/u/d-shiri)\
**Post date:** [May 23, 2024, 7:43pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/17 "2024-05-23T19:43:36Z")

</div>

> [@Rip](#):
>
> `curl http://drposture.app/.well-known/acme-challenge/testfile`

```nohighlight
curl -I http://drposture.app/.well-known/acme-challenge/test-file

HTTP/1.1 404 Not Found
Date: Thu, 23 May 2024 19:43:11 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Type: text/html; charset=iso-8859-1

```

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [May 23, 2024, 7:57pm UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/18 "2024-05-23T19:57:31Z")

</div>

> [@d-shiri](#):
>
> ```nohighlight
> *:* is a NameVirtualHost
> default server drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:2)
> port * namevhost drposture.app (/etc/apache2/sites-enabled/api.drposture.app-le-ssl.conf:2)
> port * namevhost drposture.app (/etc/apache2/sites-enabled/api.drposture.app.conf:1)
> port * namevhost drposture.app (/etc/apache2/sites-enabled/cms.drposture.app.conf:1)
> port * namevhost drposture.app (/etc/apache2/sites-enabled/qa.cms.drposture.app.conf:1)
> 
> ```

This is still there.

---

<div class="post-metadata">

**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\
**Post date:** [May 24, 2024, 1:07am UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/19 "2024-05-24T01:07:06Z")

</div>

> [@d-shiri](#):
>
> ```nohighlight
> curl -I http://drposture.app/.well-known/acme-challenge/test-file
> 
> HTTP/1.1 404 Not Found
> 
> ```

This suggests there is something wrong with the paths.

```nohighlight
ls /var/www/drposture.app/.well-known/acme-challenge

```

Should show the file. If not there will be some digging to do.  
And BTW you have a bunch of certificates for a bunch of subdomains, and many recent. So I am wondering what is the difference.. or what has been possibly changed.

And checking the certificate transparency logs:

> **[crt.sh | drposture.app](https://crt.sh/?q=drposture.app)**
>
> Free CT Log Certificate Search Tool from Sectigo (formerly Comodo CA)

Shows certificates issued as recently as a couple days ago. (yesterday)

How is your configuration different for **drposture.app** than **www.drposture.app** or **batapi.drposture.app**  
They should be combined into a single cert or a wildcard certificate.  
What gives here.. ??

> [@Osiris](#):
>
> Could you post the output from `apachectl -t -D DUMP_VHOSTS` again?

Please do this and lets fix the issue.

---

<div class="post-metadata">

**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\
**Post date:** [May 24, 2024, 1:32am UTC](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909/20 "2024-05-24T01:32:52Z")

</div>

Supplemental information.

This is the presently being served certificate [crt.sh | 13052872281](https://crt.sh/?id=13052872281) by

This one is "It's all good. We have not detected any issues."

- [SSL Checker](https://decoder.link/sslchecker/api.drposture.app/443)

These 2 "Doesn't match Common Name or/and SANs"

- [SSL Checker](https://decoder.link/sslchecker/www.drposture.app/443)
- [SSL Checker](https://decoder.link/sslchecker/drposture.app/443)

### Edit: this is what I see for each of those domain names using `curl -k -i`

```nohighlight
$ curl -k -i https://api.drposture.app/
HTTP/1.1 404 Not Found
Date: Fri, 24 May 2024 02:24:45 GMT
Server: Kestrel
Content-Length: 0

```

```nohighlight
$ curl -k -i https://www.drposture.app/
HTTP/1.1 404 Not Found
Date: Fri, 24 May 2024 02:24:47 GMT
Server: Kestrel
Content-Length: 0

```

```nohighlight
$ curl -k -i https://drposture.app/
HTTP/1.1 404 Not Found
Date: Fri, 24 May 2024 02:24:50 GMT
Server: Kestrel
Content-Length: 0

```

@d-shiri you stated

> [@d-shiri](#):
>
> My web server is (include version): `Apache/2.4.41 (Ubuntu)`

Yet I see **Server: Kestrel** for all those domain names.

Edit again:  
All 3 domain names map to the same IPv4 Address

```nohighlight
$ nslookup drposture.app hydrogen.ns.hetzner.com.
Server: hydrogen.ns.hetzner.com.
Address: 213.133.100.98#53

Name: drposture.app
Address: 49.12.242.201

```

```nohighlight
$ nslookup www.drposture.app hydrogen.ns.hetzner.com.
Server: hydrogen.ns.hetzner.com.
Address: 213.133.100.98#53

Name: www.drposture.app
Address: 49.12.242.201

```

```nohighlight
$ nslookup api.drposture.app hydrogen.ns.hetzner.com.
Server: hydrogen.ns.hetzner.com.
Address: 213.133.100.98#53

Name: api.drposture.app
Address: 49.12.242.201

```

Yet for HTTP not HTTP **S** I see Apache, but not all 3 domain names respond the same (which may or may not be an issue; I suspect at least **www** would be an issue.)

```nohighlight
$ curl -k -i http://api.drposture.app/.well-known/acme-challenge/sometestfile
HTTP/1.1 301 Moved Permanently
Date: Fri, 24 May 2024 02:53:50 GMT
Server: Apache/2.4.41 (Ubuntu)
Location: https://api.drposture.app/.well-known/acme-challenge/sometestfile
Content-Length: 356
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://api.drposture.app/.well-known/acme-challenge/sometestfile">here</a>.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at api.drposture.app Port 80</address>
</body></html>

```

```nohighlight
$ curl -k -i http://www.drposture.app/.well-known/acme-challenge/sometestfile
HTTP/1.1 301 Moved Permanently
Date: Fri, 24 May 2024 02:53:55 GMT
Server: Apache/2.4.41 (Ubuntu)
Location: https://www.drposture.app/.well-known/acme-challenge/sometestfile
Content-Length: 356
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://www.drposture.app/.well-known/acme-challenge/sometestfile">here</a>.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at www.drposture.app Port 80</address>
</body></html>

```

```nohighlight
$ curl -k -i http://drposture.app/.well-known/acme-challenge/sometestfile
HTTP/1.1 404 Not Found
Date: Fri, 24 May 2024 02:53:59 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 275
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at drposture.app Port 80</address>
</body></html>

```

[Next page](https://community.letsencrypt.org/t/http-01-challenge-failed-due-to-an-unauthorized-response-when-renewing-the-cert/218909.md?page=2)