Issue with certbot renew and mail

mtstedman · December 10, 2018, 8:17pm

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: gossiptrendspot.com

I ran this command: certbot renew --renew-hook “service nginx reload” --renew-hook “service postfix reload” --renew-hook “service dovecot restart”

It produced this output:

Processing /etc/letsencrypt/renewal/gossiptrendspot.com.conf

Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for autodiscover.gossiptrendspot.com
http-01 challenge for gossiptrendspot.com
http-01 challenge for imap.gossiptrendspot.com
http-01 challenge for smtp.gossiptrendspot.com
http-01 challenge for www.gossiptrendspot.com
http-01 challenge for mail.gossiptrendspot.com
Waiting for verification…
Cleaning up challenges
Attempting to renew cert (gossiptrendspot.com) from /etc/letsencrypt/renewal/gossiptrendspot.com.conf produced an unexpected error: Failed authorization procedure. mail.gossiptrendspot.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://mail.gossiptrendspot.com/.well-known/acme-challenge/u2P9e1uH8loqWgVOzQNjxstox7kh58-4IzbmG622jBc: “\r\n404 Not Found\r\n<body bgcolor=“white”>\r\n

404 Not Found

\r\n

”. Skipping.

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/gossiptrendspot.com/fullchain.pem (failure)

1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

The following errors were reported by the server:

Domain: mail.gossiptrendspot.com
Type: unauthorized
Detail: Invalid response from
http://mail.gossiptrendspot.com/.well-known/acme-challenge/u2P9e1uH8loqWgVOzQNjxstox7kh58-4IzbmG622jBc:
“\r\n404 Not Found\r\n<body
bgcolor=“white”>\r\n

404 Not
Found
\r\n
”
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

My web server is (include version): nginx/1.14.0

The operating system my web server runs on is (include version): Ununto 18.04

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No

stevenzhu · December 10, 2018, 8:31pm

Hi,

I believe you used the wrong hook....
If you want to reload all services after successful renewal, you should use post-hook for renewal....

Thank you

rg305 · December 10, 2018, 8:37pm

Firstly, I applaud you for even trying --renew-hook multiple times (had never thought of doing that).
Has this worked in the past?

mtstedman · December 10, 2018, 10:23pm

@rg305 Yea, you can add as many renew-hook’s as you need:

mtstedman · December 10, 2018, 10:26pm

@stevenzhu --renew-hook only runs on a successful renewal. If I used post-hook it would reboot nginx every time the command is run, whether it attempts a renewal or not:

rg305 · December 10, 2018, 10:29pm

Please show:
cerbot --version
certbot certificates
then each of the corresponding certificate renewal conf files:
[start with the one that covers “mail.gossip…”]
/etc/letsencrypt/renewal/{cert-name}.conf

mtstedman · December 10, 2018, 11:00pm

I also double checked the DNS just to be sure, it does have an A-record configured, and nothing has changed with the config since the initial application.

Version: certbot 0.26.1
Renewal:

Found the following certs:
Certificate Name: gossiptrendspot.com
Domains: gossiptrendspot.com autodiscover.gossiptrendspot.com imap.gossiptrendspot.com mail.gossiptrendspot.com smtp.gossiptrendspot.com www.gossiptrendspot.com
Expiry Date: 2018-12-05 15:50:41+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/gossiptrendspot.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/gossiptrendspot.com/privkey.pem

mtstedman · December 10, 2018, 11:45pm

It’s weird this alone worked:

certbot --nginx certonly -n -d mail.gossiptrendspot.com

but the multi-domain is still throwing a 404 \ can’t auth with

certbot renew

certbot --nginx certonly -n -d mail.gossiptrendspot.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for mail.gossiptrendspot.com
Waiting for verification…
Cleaning up challenges

IMPORTANT NOTES:

Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/mail.gossiptrendspot.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/mail.gossiptrendspot.com/privkey.pem
Your cert will expire on 2019-03-10. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew all of your certificates, run
“certbot renew”
If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

rg305 · December 11, 2018, 12:20am

Can you also show the renewal configs?:

List them:
ls -l /etc/letsencrypt/renewal/*.conf
Then show them:
less /etc/letsencrypt/renewal/{whatever-your-files-are-named}.conf

mtstedman · December 11, 2018, 12:42am

Here is the list (there’s 2 additional now from testing the mail, and having to get the site back up while trying to debug)

-rw-r--r-- 1 root root  577 Dec 10 19:42 /etc/letsencrypt/renewal/gossiptrendspot.com-0001.conf 
-rw-r--r-- 1 root root 1004 Sep  6 16:50 /etc/letsencrypt/renewal/gossiptrendspot.com.conf
-rw-r--r-- 1 root root  577 Dec 10 23:54 /etc/letsencrypt/renewal/mail.gossiptrendspot.com.conf

And here’s the config of the one having renewal issues (gossiptrendspot.com.conf). I can post the config of the ones I just created to get the site back up as well if it will help:

# renew_before_expiry = 30 days
version = 0.26.1
archive_dir = /etc/letsencrypt/archive/gossiptrendspot.com
cert = /etc/letsencrypt/live/gossiptrendspot.com/cert.pem
privkey = /etc/letsencrypt/live/gossiptrendspot.com/privkey.pem
chain = /etc/letsencrypt/live/gossiptrendspot.com/chain.pem
fullchain = /etc/letsencrypt/live/gossiptrendspot.com/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = b24b626a560b41212e7d8c38cd9d63a0
rsa_key_size = 2048
authenticator = webroot
webroot_path = /var/www/gossiptrendspot.com/htdocs,
server = https://acme-v02.api.letsencrypt.org/directory
[[webroot_map]]
autodiscover.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
imap.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
mail.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
smtp.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
www.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs

rg305 · December 11, 2018, 12:56am

As you can see, they all used the same webroot when they were issued:

But do they all still use that same (document)root?
Please show:
grep -Eri 'root|server_name|server_alias|listen' /etc/nginx/

mtstedman · December 11, 2018, 1:09am

Ahh I think that found it for me TY very much, I didn’t re-list the names in the nginx config for the mail subdomains when I re-wrote the server configuration after the cert was applied for, since I wasn’t running a reverse proxy on the mail server.

/etc/nginx/fastcgi.conf:fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
/etc/nginx/fastcgi.conf:fastcgi_param  DOCUMENT_ROOT      $document_root;
/etc/nginx/fastcgi.conf:fastcgi_param  SERVER_NAME        $server_name;
/etc/nginx/scgi_params:scgi_param  DOCUMENT_ROOT      $document_root;
/etc/nginx/scgi_params:scgi_param  SERVER_NAME        $server_name;
/etc/nginx/fastcgi_params:fastcgi_param  DOCUMENT_ROOT      $document_root;
/etc/nginx/fastcgi_params:fastcgi_param  SERVER_NAME        $server_name;
/etc/nginx/nginx.conf:  # server_names_hash_bucket_size 64;
/etc/nginx/nginx.conf:  # server_name_in_redirect off;
/etc/nginx/nginx.conf:#         listen     localhost:110;
/etc/nginx/nginx.conf:#         listen     localhost:143;
/etc/nginx/uwsgi_params:uwsgi_param  DOCUMENT_ROOT      $document_root;
/etc/nginx/uwsgi_params:uwsgi_param  SERVER_NAME        $server_name;
/etc/nginx/sites-available/default:     listen 80 default_server;
/etc/nginx/sites-available/default:     listen [::]:80 default_server;
/etc/nginx/sites-available/default:     # listen 443 ssl default_server;
/etc/nginx/sites-available/default:     # listen [::]:443 ssl default_server;
/etc/nginx/sites-available/default:     root /var/www/html;
/etc/nginx/sites-available/default:     server_name _;
/etc/nginx/sites-available/default:     # deny access to .htaccess files, if Apache's document root
/etc/nginx/sites-available/gossiptrendspot.com: server_name gossiptrendspot.com www.gossiptrendspot.com;
/etc/nginx/sites-available/gossiptrendspot.com: root /var/www/gossiptrendspot.com/htdocs;
/etc/nginx/sites-available/gossiptrendspot.com: listen 80;
/etc/nginx/sites-available/gossiptrendspot.com: listen 443 ssl;

Gunna test out a fresh build that I think will fix the issue.

rg305 · December 11, 2018, 5:21am

From that I see:

/etc/nginx/sites-available/gossiptrendspot.com: 
     server_name gossiptrendspot.com www.gossiptrendspot.com;
     root /var/www/gossiptrendspot.com/htdocs;

/etc/nginx/sites-available/default:
     server_name _;
     root /var/www/html;

So, the only names that are using the document root that matches the webroot are:
gossiptrendspot.com
www.gossiptrendspot.com

All other names are grabbed by the default to /var/www/html

I think this can be fixed in the /etc/letsencrypt/renewal/*.conf files, in the [[webroot_map]] section.

Try changing:
[[webroot_map]]
autodiscover.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
imap.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
mail.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
smtp.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
www.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs

To:
[[webroot_map]]
autodiscover.gossiptrendspot.com = /var/www/html
gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
imap.gossiptrendspot.com = /var/www/html
mail.gossiptrendspot.com = /var/www/html
smtp.gossiptrendspot.com = /var/www/html
www.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs

system · January 10, 2019, 5:25am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Certbot Renewal Error Help	4	446	January 6, 2023
Certbot renew failure Help	13	925	November 24, 2019
Certificate renew Help	6	512	May 12, 2023
Help needed, cant renew certbot Help	4	162	June 15, 2024
Certbot renew giving error Help	15	1891	August 26, 2021

Issue with certbot renew and mail

404 Not Found

404 Not Found

Related topics

404 Not
Found