We have been having issues with certbot and the creation/renewal of SSL certificates for a while now on one of our development server.
Seeing as we ran into issues every time we had to renew in the past few months, and that this time I simply couldn’t get it to work, I decided to remove every certificate we had, clean a few things up and generate a new one to hopefully get it to work flawlessly once and for all. Unfortunately, as you might’ve guessed from my presence in these forums, things didn’t go according to plans.
I am running into the same issues as we were having previously, which is that every certificate creation or renewal ends results in the “unauthorized” error. I’ve scoured the Internet looking for answers or clues, but alas, I still cannot get it to work.
Here are some of the things I have tried:
- Creating a file in the different
/.well-known/acme-challengedirectories and checking if it can be reached from a browser - it works, as you can see here: http://demo.bpdl.eckidev.com/.well-known/acme-challenge/test - Shutting off Apache and trying to run the commands with
--standalone - Running certbot for one domain at a time (one certificate each). Ran into the same issue, obviously.
Here is the classic information form; with a --dry-run to avoid running into the limits overtime with all of my testing. I’ve also added an Apache configuration at the bottom; every domain has the same config, with only the domain, directories and user names changing.
My domain is: bpdl.eckidev.com (as well as the following: david.bpdl.eckidev.com, demo.bpdl.eckidev.com, emile.bpdl.eckidev.com, jd.bpdl.eckidev.com, pa.bpdl.eckidev.com)
I ran this command: certbot certonly --dry-run --apache -d bpdl.eckidev.com -d david.bpdl.eckidev.com -d demo.bpdl.eckidev.com -d emile.bpdl.eckidev.com -d jd.bpdl.eckidev.com -d pa.bpdl.eckidev.com
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Starting new HTTPS connection (1): acme-staging-v02.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for bpdl.eckidev.com
http-01 challenge for david.bpdl.eckidev.com
http-01 challenge for jd.bpdl.eckidev.com
http-01 challenge for pa.bpdl.eckidev.com
http-01 challenge for demo.bpdl.eckidev.com
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. demo.bpdl.eckidev.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://demo.bpdl.eckidev.com/.well-known/acme-challenge/H59PQEdc2ASbknzDz0x4p41szNu1sB_0kPjKQPdxjcU [165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p", bpdl.eckidev.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://bpdl.eckidev.com/.well-known/acme-challenge/Pc4MQOzm09KjVcV6S6B-t6aV_qecYYkfcXMcWOuad0A [165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p", jd.bpdl.eckidev.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://jd.bpdl.eckidev.com/.well-known/acme-challenge/1irJPXAnysDSBqFTD1SgWB6ApHZwYYUM4PgM_wOBA5I [165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p", david.bpdl.eckidev.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://david.bpdl.eckidev.com/.well-known/acme-challenge/OzyJI2jfrQiZK44r5Xsw4JNWMaZCcoP9p-X_J2EKAAc [165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p", pa.bpdl.eckidev.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://pa.bpdl.eckidev.com/.well-known/acme-challenge/7suTBGYDsDUcHW_maNiW_EpSaioMDp4_C6XQHkoZ5Mc [165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: demo.bpdl.eckidev.com
Type: unauthorized
Detail: Invalid response from
http://demo.bpdl.eckidev.com/.well-known/acme-challenge/H59PQEdc2ASbknzDz0x4p41szNu1sB_0kPjKQPdxjcU
[165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
2.0//EN\">\n<html><head>\n<title>404 Not
Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
Domain: bpdl.eckidev.com
Type: unauthorized
Detail: Invalid response from
http://bpdl.eckidev.com/.well-known/acme-challenge/Pc4MQOzm09KjVcV6S6B-t6aV_qecYYkfcXMcWOuad0A
[165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
2.0//EN\">\n<html><head>\n<title>404 Not
Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
Domain: jd.bpdl.eckidev.com
Type: unauthorized
Detail: Invalid response from
http://jd.bpdl.eckidev.com/.well-known/acme-challenge/1irJPXAnysDSBqFTD1SgWB6ApHZwYYUM4PgM_wOBA5I
[165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
2.0//EN\">\n<html><head>\n<title>404 Not
Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
Domain: david.bpdl.eckidev.com
Type: unauthorized
Detail: Invalid response from
http://david.bpdl.eckidev.com/.well-known/acme-challenge/OzyJI2jfrQiZK44r5Xsw4JNWMaZCcoP9p-X_J2EKAAc
[165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
2.0//EN\">\n<html><head>\n<title>404 Not
Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
Domain: pa.bpdl.eckidev.com
Type: unauthorized
Detail: Invalid response from
http://pa.bpdl.eckidev.com/.well-known/acme-challenge/7suTBGYDsDUcHW_maNiW_EpSaioMDp4_C6XQHkoZ5Mc
[165.227.41.202]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
2.0//EN\">\n<html><head>\n<title>404 Not
Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
My web server is: Apache/2.4.18
The operating system my web server runs on is: Ubuntu 16.04.4
My hosting provider, if applicable, is: Digital Ocean droplet
I can login to a root shell on my machine: yes
I’m using a control panel to manage my site: no
The version of my client is: certbot 0.31.0
Here is an Apache VirtualHost configuration (others follow the same pattern, as stated above):
<VirtualHost *:80>
DocumentRoot /home/emile/emile.bpdl.eckidev.com/public_html/
</VirtualHost>
<VirtualHost *:80 *:443>
ServerName emile.bpdl.eckidev.com
AssignUserId emile emile
ServerAdmin dev@eckinox.ca
Define PROJECT_PATH "/home/emile/emile.bpdl.eckidev.com/"
LogLevel warn ssl:warn
Include conf-available/website.conf
# Commented those lines when removing the old certificates
#Include /etc/letsencrypt/options-ssl-apache.conf
#SSLCertificateFile /etc/letsencrypt/live/emile.bpdl.eckidev.com/fullchain.pem
#SSLCertificateKeyFile /etc/letsencrypt/live/emile.bpdl.eckidev.com/privkey.pem
</VirtualHost>
And here is the content of the website.conf, which is included in the VirtualHost:
RewriteEngine On
ErrorLog ${PROJECT_PATH}/logs/apache.error.log
CustomLog ${PROJECT_PATH}/logs/apache.access.log combined
DirectoryIndex index.html index.php
DocumentRoot "${PROJECT_PATH}/public_html/"
<Directory "${PROJECT_PATH}/public_html/">
Options Indexes FollowSymLinks
Options -MultiViews -Indexes
AllowOverride All
Require all granted
</Directory>
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/rss+xml application/rdf+xml
AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
AddOutputFilterByType DEFLATE application/x-font
AddOutputFilterByType DEFLATE application/x-font-opentype
AddOutputFilterByType DEFLATE application/x-font-otf
AddOutputFilterByType DEFLATE application/x-font-truetype
AddOutputFilterByType DEFLATE application/x-font-ttf
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE application/xhtml+xml application/xml
AddOutputFilterByType DEFLATE font/otf font/ttf font/eot font/opentype
AddOutputFilterByType DEFLATE image/svg+xml image/x-icon
AddOutputFilterByType DEFLATE application/json
AddOutputFilterByType DEFLATE text/css text/html text/javascript text/plain text/xml text/cache-manifest
</IfModule>
<ifModule mod_headers.c>
Header always set X-Content-Type-Options nosniff
# Cache control
<FilesMatch "\.(jpg|jpeg|png|gif|css|js|swf|ico|bmp|eot|woff|woff2|ttf|svg|ogv|mp4|webm)$">
Header set Cache-Control "max-age=1209600, public"
</FilesMatch>
# Allows font from CDN to load flawlessly
<FilesMatch "\.(eot|ttf|otf|woff|woff2|svg)$">
Header set Access-Control-Allow-Origin "*"
</FilesMatch>
</ifModule>
Although I’m not the one who originally setup this server and those configurations, I’ve looked over everything and cannot for the life of me find the source of the problems. I’ve set up multiple websites and web apps in the past without any issues.
Thanks in advance for your help,
Émile
