Please fill out the fields below so we can help you better.
My domain is: xx.xx
I ran this command: ./letsencrypt-auto certonly --webroot -d xx.xx
It produced this output: Success
I ran this command: ./letsencrypt-auto --dry-run renew
It produced this output: Failure
My operating system is (include version): Ubuntu 16.04
My web server is (include version): apache2 (latest)
My hosting provider, if applicable, is: local
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no
Output:
1: $$$$$ FIRST COMMAND $$$$$ Issuing works just fine
su@host:/usr/local/letsencrypt# ./letsencrypt-auto certonly --webroot -d xx.xx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Cert not yet due for renewal
You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/xx.xx.conf)
What would you like to do?
-------------------------------------------------------------------------------
1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for xx.xx
Select the webroot for xx.xx:
-------------------------------------------------------------------------------
1: Enter a new webroot
-------------------------------------------------------------------------------
Press 1 [enter] to confirm the selection (press 'c' to cancel): /var/www/xx.xx
Press 1 [enter] to confirm the selection (press 'c' to cancel): 1
Input the webroot for xx.xx: (Enter 'c' to cancel):/var/www/xx.xx
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0002_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0002_csr-certbot.pem
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/xx.xx/fullchain.pem. Your cert will
expire on 2017-07-09. To obtain a new or tweaked version of this
certificate in the future, simply run letsencrypt-auto again. To
non-interactively renew *all* of your certificates, run
"letsencrypt-auto renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
2: $$$$$ SECOND COMMAND $$$$$ Renewal does not work
su@host:/usr/local/letsencrypt# ./letsencrypt-auto --dry-run renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/xx.xx.conf
-------------------------------------------------------------------------------
Cert not due for renewal, but simulating renewal for dry run
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for xx.xx
Waiting for verification...
Cleaning up challenges
Attempting to renew cert from /etc/letsencrypt/renewal/xx.xx.conf produced an unexpected error: Failed authorization procedure. xx.xx (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://xx.xx/.well-known/acme-challenge/vAshSjnqR3b24lwWiemy_IeVBX2wvlDztxchKAKcMVI: "<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML
4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
". Skipping.<TITLE>Not Found</TITLE>
-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/yy.yy.conf
-------------------------------------------------------------------------------
Cert not due for renewal, but simulating renewal for dry run
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for yy.yy
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits), not saving to file
Creating CSR: not saving to file
-------------------------------------------------------------------------------
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/yy.yy/fullchain.pem
-------------------------------------------------------------------------------
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates below have not been saved.)
The following certs were successfully renewed:
/etc/letsencrypt/live/yy.yy/fullchain.pem (success)
The following certs could not be renewed:
/etc/letsencrypt/live/xx.xx/fullchain.pem (failure)
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates above have not been saved.)
1 renew failure(s), 0 parse failure(s)
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: xx.xx
Type: unauthorized
Detail: Invalid response from
http://xx.xx/.well-known/acme-challenge/vAshSjnqR3b24lwWiemy_IeVBX2wvlDztxchKAKcMVI:
"<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML
4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Not Found</TITLE>
"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
su@host:/usr/local/letsencrypt#
- No .htaccess
- Same configuration between yy.yy and xx.xx - Please take a look at yy.yy/.well-known as well - same behavior
- Forced 443 however the .well-known folders are available on both 443 and 80 which redirects to 443
- 0755 on .well-known
- issue occurs with both root and www-data as owners
No idea how to debug this further. Here is the output of the log: ~removed~
Any help would be greatly appreciated!
Thank you very much for your time.
Cheers,
IonutZ
I’ll look more into it and post back. Thanks for checking!
