I ran this command: sudo /usr/local/bin/certbot-auto --apache
It produced this output: challenge failed for domain… all 4 domains
My web server is (include version): apache 2
The operating system my web server runs on is (include version): raspbian jesse
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): not sure, just installed today so assuming its most recent version
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
confirmed the DNS A record is pointing to the correct IP address. the site works when queried without using the secure HTTPS tag. im running 2 sites on the same server via virtual hosts config. trying to get certificates for www.bobsberriesfl.com and bobsberriesfl.com along with www.clemonsac.com and clemonsac.com. same error is generated for all 4.
forgive my ignorance, im new to this. just been fighting with it for hours and cant figure out what im missing? maybe something in the server config? i assume that was all done by the install.
$ apachectl -S
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1. Set the 'ServerName' directive globally to suppress this message
VirtualHost configuration:
*:80 is a NameVirtualHost
default server www.clemonsac.com (/etc/apache2/sites-enabled/000-default.conf:2)
port 80 namevhost www.clemonsac.com (/etc/apache2/sites-enabled/000-default.conf:2)
alias clemonsac.com
wild alias *.clemonsac.com
port 80 namevhost www.bobsberriesfl.com (/etc/apache2/sites-enabled/000-default.conf:55)
alias bobsberriesfl.com
wild alias *.bobsberriesfl.com
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex default: dir="/var/lock/apache2" mechanism=fcntl
Mutex watchdog-callback: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33 not_used
Group: name="www-data" id=33 not_used
Jabba@HanSolo:/etc/apache2/mods-enabled $ sudo /usr/local/bin/certbot-auto --apache
/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/cryptography/hazmat/bindings/openssl/binding.py:163: CryptographyDeprecationWarning: OpenSSL version 1.0.1 is no longer supported by the OpenSSL project, please upgrade. The next version of cryptography will drop support for it.
utils.CryptographyDeprecationWarning
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter ‘c’ to cancel): 1 2
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for bobsberriesfl.com
http-01 challenge for www.bobsberriesfl.com
Enabled Apache rewrite module
Waiting for verification…
Challenge failed for domain bobsberriesfl.com
Challenge failed for domain www.bobsberriesfl.com
http-01 challenge for bobsberriesfl.com
http-01 challenge for www.bobsberriesfl.com
Cleaning up challenges
Some challenges have failed.
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
So after a ton of reading what i gather is certbot is trying to create a file in my web directory so that it can test to see that i own the directory. for whatever reason, certbot isnt authorized to modify the directory and so it cannot place the key there for it to verify. am i on the right track here?
That's what would happen with --webroot, but with --apache, Certbot is trying to reconfigure your Apache server temporarily so that requests for a specific path are handled specially. You could look at the log in /var/log/apache2/error.log and /var/log/letsencrypt/letsencrypt.log to see more about what Certbot was trying to do and what happened.
<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
# ServerName bobsberriesfl.com
ServerName www.clemonsac.com
ServerAlias clemonsac.com *.clemonsac.com
ServerAdmin info@clemonsac.com
DocumentRoot /var/www/clemonsac.com/
<Directory />
Options FollowSymLinks
AllowOverride None
Order Deny,Allow
Deny from All
</Directory>
<Directory /var/www/clemonsac.com>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order Allow,Deny
Allow from All
</Directory>
# <Location /server-status>
# SetHandler server-status
# Order Allow,deny
# Deny from all
# Allow from clemonsac.com
# </Location>
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
# LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
Include conf-available/serve-cgi-bin.conf
</VirtualHost>
<VirtualHost *:80>
ServerName www.bobsberriesfl.com
ServerAlias bobsberriesfl.com *.bobsberriesfl.com
ServerAdmin info@bobsberriesfl.com
DocumentRoot /var/www/bobsberriesfl.com/
<Directory />
Options FollowSymLinks
AllowOverride None
Order Deny,Allow
Deny from All
</Directory>
<Directory /var/www/bobsberriesfl.com>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order Allow,Deny
Allow from all
</Directory>
# <Location server-status>
# SetHandler server-status
# Order Allow,Deny
# Allow from bobsberriesfl.com
# </Location>
# LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
Include conf-available/serve-cgi-bin.conf
</VirtualHost>
<virtualHost *:443>
ServerName www.bobsberriesfl.com:443
serverAlias bobsberriesfl.com:443, *.bobsberriesfl.com:443
Serveradmin info@bobsberriesfl.com
DocumentRoot /var/www/bobsberriesfl.com/
<Directory />
Options FollowSymLinks
AllowOverride None
Order Deny,Allow
Deny from All
</Directory>
<Directory /var/www/bobsberriesfl.com>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order Allow,Deny
Allow from All
</Directory>
# LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
Include conf-available/serve-cgi-bin.conf
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
Jabba@HanSolo:/var/log $ sudo apache2
[Fri Feb 21 20:03:08.741135 2020] [core:warn] [pid 2850] AH00111: Config variable ${APACHE_LOCK_DIR} is not defined
[Fri Feb 21 20:03:08.741564 2020] [core:warn] [pid 2850] AH00111: Config variable ${APACHE_PID_FILE} is not defined
[Fri Feb 21 20:03:08.741722 2020] [core:warn] [pid 2850] AH00111: Config variable ${APACHE_RUN_USER} is not defined
[Fri Feb 21 20:03:08.741769 2020] [core:warn] [pid 2850] AH00111: Config variable ${APACHE_RUN_GROUP} is not defined
[Fri Feb 21 20:03:08.741886 2020] [core:warn] [pid 2850] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Fri Feb 21 20:03:08.800019 2020] [core:warn] [pid 2850:tid 1995632640] AH00111: Config variable ${APACHE_RUN_DIR} is not defined
[Fri Feb 21 20:03:08.802727 2020] [core:warn] [pid 2850:tid 1995632640] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Fri Feb 21 20:03:08.804486 2020] [core:warn] [pid 2850:tid 1995632640] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Fri Feb 21 20:03:08.804599 2020] [core:warn] [pid 2850:tid 1995632640] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Fri Feb 21 20:03:08.805611 2020] [core:warn] [pid 2850:tid 1995632640] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Fri Feb 21 20:03:08.805716 2020] [core:warn] [pid 2850:tid 1995632640] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Fri Feb 21 20:03:08.806767 2020] [core:warn] [pid 2850:tid 1995632640] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Fri Feb 21 20:03:08.806868 2020] [core:warn] [pid 2850:tid 1995632640] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
AH00526: Syntax error on line 74 of /etc/apache2/apache2.conf:
Invalid Mutex directory in argument file:${APACHE_LOCK_DIR}
Jabba@HanSolo:/var/log $
{APACHE_LOCK_DIR} is not defined
{APACHE_PID_FILE} is not defined
{APACHE_RUN_USER} is not defined
{APACHE_RUN_GROUP} is not defined
{APACHE_LOG_DIR} is not defined
{APACHE_RUN_DIR} is not defined
Invalid Mutex directory in argument file:{APACHE_LOCK_DIR}
Yeah.
Try adding three back ticks before and after your posted text (on separate lines).
Like:
```
stuff stuff stuff
ooo lots of unformatted stuffs
```
im not sure why none of that is defined, hasnt presented a problem until now i guess. damn things been running for 3 years or something with no issues.
My takeaway there is that I only see “root” 3 times; all others are “jabba jabba”.
I think cerbot runs as “root”…
combined with no Apache global variables found…
And I think cerbot doesn’t know what to do or doesn’t have sufficient access to the location it needs.
We can tackle those one at a time.
I would start with the access.
But not by giving certbot access to that folder.
I would create a new dedicated folder for certbot to use for challenge files.
That’s what would happen with --webroot, but with --apache, Certbot is trying to reconfigure your Apache server temporarily so that requests for a specific path are handled specially. You could look at the log in /var/log/apache2/error.log and /var/log/letsencrypt/letsencrypt.log to see more about what Certbot was trying to do and what happened.
[/quote]
is there an easy way to paste that log from putty into here? its really long and im not sure how to copy text from there.
To that end, I would create something like: /ACMEchallenges/
Ensure that "root" has full permissions to it.
Then add a location "redirect" to steer all authentication requests to that folder.
$ apachectl -S