# Issue with certbot renew and mail

**URL:** <https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738>\
**Category:** Help\
**Created:** [December 10, 2018, 8:17pm UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738 "2018-12-10T20:17:51Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![mtstedman](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mtstedman](https://community.letsencrypt.org/u/mtstedman)\
**Post date:** [December 10, 2018, 8:17pm UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/1 "2018-12-10T20:17:51Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: [gossiptrendspot.com](http://gossiptrendspot.com)

I ran this command: certbot renew --renew-hook “service nginx reload” --renew-hook “service postfix reload” --renew-hook “service dovecot restart”

It produced this output:

* * *

Processing /etc/letsencrypt/renewal/gossiptrendspot.com.conf

* * *

Cert is due for renewal, auto-renewing…  
Plugins selected: Authenticator webroot, Installer None  
Renewing an existing certificate  
Performing the following challenges:  
http-01 challenge for [autodiscover.gossiptrendspot.com](http://autodiscover.gossiptrendspot.com)  
http-01 challenge for [gossiptrendspot.com](http://gossiptrendspot.com)  
http-01 challenge for [imap.gossiptrendspot.com](http://imap.gossiptrendspot.com)  
http-01 challenge for [smtp.gossiptrendspot.com](http://smtp.gossiptrendspot.com)  
http-01 challenge for [www.gossiptrendspot.com](http://www.gossiptrendspot.com)  
http-01 challenge for [mail.gossiptrendspot.com](http://mail.gossiptrendspot.com)  
Waiting for verification…  
Cleaning up challenges  
Attempting to renew cert ([gossiptrendspot.com](http://gossiptrendspot.com)) from /etc/letsencrypt/renewal/gossiptrendspot.com.conf produced an unexpected error: Failed authorization procedure. [mail.gossiptrendspot.com](http://mail.gossiptrendspot.com) (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://mail.gossiptrendspot.com/.well-known/acme-challenge/u2P9e1uH8loqWgVOzQNjxstox7kh58-4IzbmG622jBc:](http://mail.gossiptrendspot.com/.well-known/acme-challenge/u2P9e1uH8loqWgVOzQNjxstox7kh58-4IzbmG622jBc:) “\r\n404 Not Found\r\n\<body bgcolor=“white”\>\r\n

# 404 Not Found
\r\n
* * *
”. Skipping.

All renewal attempts failed. The following certs could not be renewed:  
/etc/letsencrypt/live/gossiptrendspot.com/fullchain.pem (failure)

* * *

1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

- The following errors were reported by the server:

My web server is (include version): nginx/1.14.0

The operating system my web server runs on is (include version): Ununto 18.04

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [December 10, 2018, 8:31pm UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/2 "2018-12-10T20:31:43Z")

</div>

Hi,

> [@mtstedman](#):
>
> certbot renew --renew-hook “service nginx reload” --renew-hook “service postfix reload” --renew-hook “service dovecot restart”

I believe you used the wrong hook....  
If you want to reload all services after successful renewal, you should use `post-hook` for renewal....

Thank you

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 10, 2018, 8:37pm UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/3 "2018-12-10T20:37:12Z")

</div>

Firstly, I applaud you for even trying `--renew-hook` multiple times (had never thought of doing that).  
Has this worked in the past?

> [@mtstedman](#):
>
> certbot renew  
> --renew-hook “service nginx reload”  
> --renew-hook “service postfix reload”  
> --renew-hook “service dovecot restart”

---

<div class="post-metadata">

**Author:** ![mtstedman](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mtstedman](https://community.letsencrypt.org/u/mtstedman)\
**Post date:** [December 10, 2018, 10:23pm UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/4 "2018-12-10T22:23:36Z")

</div>

@rg305 Yea, you can add as many renew-hook’s as you need:

> <https://stackoverflow.com/questions/42300579/letsencrypt-certbot-multiple-renew-hooks>

---

<div class="post-metadata">

**Author:** ![mtstedman](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mtstedman](https://community.letsencrypt.org/u/mtstedman)\
**Post date:** [December 10, 2018, 10:26pm UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/5 "2018-12-10T22:26:48Z")

</div>

@stevenzhu --renew-hook only runs on a successful renewal. If I used post-hook it would reboot nginx every time the command is run, whether it attempts a renewal or not:

> [@Certbot pre and post hooks](https://community.letsencrypt.org/t/certbot-pre-and-post-hooks/53501):
>
> H…

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 10, 2018, 10:29pm UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/6 "2018-12-10T22:29:59Z")

</div>

Please show:  
`cerbot --version`  
`certbot certificates`  
then each of the corresponding certificate renewal conf files:  
[start with the one that covers “mail.gossip…”]  
`/etc/letsencrypt/renewal/{cert-name}.conf`

---

<div class="post-metadata">

**Author:** ![mtstedman](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mtstedman](https://community.letsencrypt.org/u/mtstedman)\
**Post date:** [December 10, 2018, 11:00pm UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/7 "2018-12-10T23:00:44Z")

</div>

I also double checked the DNS just to be sure, it does have an A-record configured, and nothing has changed with the config since the initial application.

Version: certbot 0.26.1  
Renewal:

* * *

Found the following certs:  
Certificate Name: [gossiptrendspot.com](http://gossiptrendspot.com)  
Domains: [gossiptrendspot.com](http://gossiptrendspot.com) [autodiscover.gossiptrendspot.com](http://autodiscover.gossiptrendspot.com) [imap.gossiptrendspot.com](http://imap.gossiptrendspot.com) [mail.gossiptrendspot.com](http://mail.gossiptrendspot.com) [smtp.gossiptrendspot.com](http://smtp.gossiptrendspot.com) [www.gossiptrendspot.com](http://www.gossiptrendspot.com)  
Expiry Date: 2018-12-05 15:50:41+00:00 (INVALID: EXPIRED)  
Certificate Path: /etc/letsencrypt/live/gossiptrendspot.com/fullchain.pem  
Private Key Path: /etc/letsencrypt/live/gossiptrendspot.com/privkey.pem

* * *

---

<div class="post-metadata">

**Author:** ![mtstedman](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mtstedman](https://community.letsencrypt.org/u/mtstedman)\
**Post date:** [December 10, 2018, 11:45pm UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/8 "2018-12-10T23:45:16Z")

</div>

It’s weird this alone worked:

```
certbot --nginx certonly -n -d mail.gossiptrendspot.com

```

but the multi-domain is still throwing a 404 \ can’t auth with

```
certbot renew

```

certbot --nginx certonly -n -d [mail.gossiptrendspot.com](http://mail.gossiptrendspot.com)  
Saving debug log to /var/log/letsencrypt/letsencrypt.log  
Plugins selected: Authenticator nginx, Installer nginx  
Obtaining a new certificate  
Performing the following challenges:  
tls-sni-01 challenge for [mail.gossiptrendspot.com](http://mail.gossiptrendspot.com)  
Waiting for verification…  
Cleaning up challenges

IMPORTANT NOTES:

- Congratulations! Your certificate and chain have been saved at:  
/etc/letsencrypt/live/mail.gossiptrendspot.com/fullchain.pem  
Your key file has been saved at:  
/etc/letsencrypt/live/mail.gossiptrendspot.com/privkey.pem  
Your cert will expire on 2019-03-10. To obtain a new or tweaked  
version of this certificate in the future, simply run certbot  
again. To non-interactively renew _all_ of your certificates, run  
“certbot renew”

- If you like Certbot, please consider supporting our work by:

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 11, 2018, 12:20am UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/9 "2018-12-11T00:20:55Z")

</div>

Can you also show the renewal configs?:

> [@rg305](#):
>
> then each of the corresponding certificate renewal conf files:  
> [start with the one that covers “mail.gossip…”]  
> `/etc/letsencrypt/renewal/{cert-name}.conf`

List them:  
`ls -l /etc/letsencrypt/renewal/*.conf`  
Then show them:  
`less /etc/letsencrypt/renewal/{whatever-your-files-are-named}.conf`

---

<div class="post-metadata">

**Author:** ![mtstedman](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mtstedman](https://community.letsencrypt.org/u/mtstedman)\
**Post date:** [December 11, 2018, 12:42am UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/10 "2018-12-11T00:42:33Z")

</div>

Here is the list (there’s 2 additional now from testing the mail, and having to get the site back up while trying to debug)

```
-rw-r--r-- 1 root root 577 Dec 10 19:42 /etc/letsencrypt/renewal/gossiptrendspot.com-0001.conf 
-rw-r--r-- 1 root root 1004 Sep 6 16:50 /etc/letsencrypt/renewal/gossiptrendspot.com.conf
-rw-r--r-- 1 root root 577 Dec 10 23:54 /etc/letsencrypt/renewal/mail.gossiptrendspot.com.conf

```

And here’s the config of the one having renewal issues (gossiptrendspot.com.conf). I can post the config of the ones I just created to get the site back up as well if it will help:

```
# renew_before_expiry = 30 days
version = 0.26.1
archive_dir = /etc/letsencrypt/archive/gossiptrendspot.com
cert = /etc/letsencrypt/live/gossiptrendspot.com/cert.pem
privkey = /etc/letsencrypt/live/gossiptrendspot.com/privkey.pem
chain = /etc/letsencrypt/live/gossiptrendspot.com/chain.pem
fullchain = /etc/letsencrypt/live/gossiptrendspot.com/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = b24b626a560b41212e7d8c38cd9d63a0
rsa_key_size = 2048
authenticator = webroot
webroot_path = /var/www/gossiptrendspot.com/htdocs,
server = https://acme-v02.api.letsencrypt.org/directory
[[webroot_map]]
autodiscover.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
imap.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
mail.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
smtp.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
www.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 11, 2018, 12:56am UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/11 "2018-12-11T00:56:31Z")

</div>

As you can see, they all used the same webroot when they were issued:

> [@mtstedman](#):
>
> ```
> # Options used in the renewal process
> webroot_path = /var/www/gossiptrendspot.com/htdocs
> [[webroot_map]] 
> autodiscover.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs 
> gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs 
> imap.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs 
> mail.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs 
> smtp.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs 
> www.gossiptrendspot.com = /var/www/gossiptrendspot.com/htdocs
> ```

But do they all still use that same (document)root?  
Please show:  
`grep -Eri 'root|server_name|server_alias|listen' /etc/nginx/`

---

<div class="post-metadata">

**Author:** ![mtstedman](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mtstedman](https://community.letsencrypt.org/u/mtstedman)\
**Post date:** [December 11, 2018, 1:09am UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/12 "2018-12-11T01:09:04Z")

</div>

Ahh I think that found it for me TY very much, I didn’t re-list the names in the nginx config for the mail subdomains when I re-wrote the server configuration after the cert was applied for, since I wasn’t running a reverse proxy on the mail server.

```
/etc/nginx/fastcgi.conf:fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
/etc/nginx/fastcgi.conf:fastcgi_param DOCUMENT_ROOT $document_root;
/etc/nginx/fastcgi.conf:fastcgi_param SERVER_NAME $server_name;
/etc/nginx/scgi_params:scgi_param DOCUMENT_ROOT $document_root;
/etc/nginx/scgi_params:scgi_param SERVER_NAME $server_name;
/etc/nginx/fastcgi_params:fastcgi_param DOCUMENT_ROOT $document_root;
/etc/nginx/fastcgi_params:fastcgi_param SERVER_NAME $server_name;
/etc/nginx/nginx.conf: # server_names_hash_bucket_size 64;
/etc/nginx/nginx.conf: # server_name_in_redirect off;
/etc/nginx/nginx.conf:# listen localhost:110;
/etc/nginx/nginx.conf:# listen localhost:143;
/etc/nginx/uwsgi_params:uwsgi_param DOCUMENT_ROOT $document_root;
/etc/nginx/uwsgi_params:uwsgi_param SERVER_NAME $server_name;
/etc/nginx/sites-available/default: listen 80 default_server;
/etc/nginx/sites-available/default: listen [::]:80 default_server;
/etc/nginx/sites-available/default: # listen 443 ssl default_server;
/etc/nginx/sites-available/default: # listen [::]:443 ssl default_server;
/etc/nginx/sites-available/default: root /var/www/html;
/etc/nginx/sites-available/default: server_name _;
/etc/nginx/sites-available/default: # deny access to .htaccess files, if Apache's document root
/etc/nginx/sites-available/gossiptrendspot.com: server_name gossiptrendspot.com www.gossiptrendspot.com;
/etc/nginx/sites-available/gossiptrendspot.com: root /var/www/gossiptrendspot.com/htdocs;
/etc/nginx/sites-available/gossiptrendspot.com: listen 80;
/etc/nginx/sites-available/gossiptrendspot.com: listen 443 ssl;

```

Gunna test out a fresh build that I think will fix the issue.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 11, 2018, 5:21am UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/13 "2018-12-11T05:21:06Z")

</div>

From that I see:

```
/etc/nginx/sites-available/gossiptrendspot.com: 
     server_name gossiptrendspot.com www.gossiptrendspot.com;
     root /var/www/gossiptrendspot.com/htdocs;

/etc/nginx/sites-available/default:
     server_name _;
     root /var/www/html;
```

So, the only names that are using the document root that matches the webroot are:  
[gossiptrendspot.com](http://gossiptrendspot.com)  
[www.gossiptrendspot.com](http://www.gossiptrendspot.com)

All other names are grabbed by the default to `/var/www/html`

I think this can be fixed in the `/etc/letsencrypt/renewal/*.conf` files, in the `[[webroot_map]]` section.

Try changing:  
[[webroot\_map]]  
[autodiscover.gossiptrendspot.com](http://autodiscover.gossiptrendspot.com) = /var/www/gossiptrendspot.com/htdocs  
[gossiptrendspot.com](http://gossiptrendspot.com) = /var/www/gossiptrendspot.com/htdocs  
[imap.gossiptrendspot.com](http://imap.gossiptrendspot.com) = /var/www/gossiptrendspot.com/htdocs  
[mail.gossiptrendspot.com](http://mail.gossiptrendspot.com) = /var/www/gossiptrendspot.com/htdocs  
[smtp.gossiptrendspot.com](http://smtp.gossiptrendspot.com) = /var/www/gossiptrendspot.com/htdocs  
[www.gossiptrendspot.com](http://www.gossiptrendspot.com) = /var/www/gossiptrendspot.com/htdocs

To:  
[[webroot\_map]]  
[autodiscover.gossiptrendspot.com](http://autodiscover.gossiptrendspot.com) = /var/www/html  
[gossiptrendspot.com](http://gossiptrendspot.com) = /var/www/gossiptrendspot.com/htdocs  
[imap.gossiptrendspot.com](http://imap.gossiptrendspot.com) = /var/www/html  
[mail.gossiptrendspot.com](http://mail.gossiptrendspot.com) = /var/www/html  
[smtp.gossiptrendspot.com](http://smtp.gossiptrendspot.com) = /var/www/html  
[www.gossiptrendspot.com](http://www.gossiptrendspot.com) = /var/www/gossiptrendspot.com/htdocs

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [January 10, 2019, 5:25am UTC](https://community.letsencrypt.org/t/issue-with-certbot-renew-and-mail/79738/14 "2019-01-10T05:25:29Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.