New Certificate Fails with Unauthorized 403

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

This is a new domain I set up through GoDaddy yesterday. I have several other domains at GoDaddy and I do my own hosting with Apache so I have lots to compare it to.

All the needed directories have been established and the non-secure web address works fine at http://www.fotclibrary.org

The webserver is configured correctly. I just used a working virtualhost block from another domain and changed the necessary info. The IP address that fails 403 unauthorized is an Amazon address and I don't point to anything at Amazon.

Any ideas on why this one new certificate is failing?

Thanks

I renewed all my other certificates yesterday and that worked just fine as it always does.

My domain is: fotclibrary.org

I ran this command: certbot certonly --standalone -d fotclibrary.org -d www.fotclibrary.org

It produced this output:

The following errors were reported by the server:

Domain: www.fotclibrary.org
Type: unauthorized
Detail: 76.223.105.230: Invalid response from
http://www.fotclibrary.org/.well-known/acme-challenge/N1sYQLKkSzCa5gwm2x4ZF9G_YvbxPFxqxf1PVksFY4w:
403

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

My web server is (include version): Apache 2.4.46

The operating system my web server runs on is (include version): Windows 10

My hosting provider, if applicable, is: In-house server

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Cerbot is version 1.13.0

2

Certbot 1.13.0 is extremely old (current is 5.something), but certbot hasn't been supported on Windows for years--I'd strongly recommend you consider a client that's supported on Windows. But that isn't likely your problem.

That isn't the IP address that's being checked by letsdebug.net right now (it's coming up with 71.163.124.240). Have you changed your DNS entries since posting?

3

Thanks for your reply. That is what is stumping me. The address 71.163.124.240 is my IP address and goes to my web server. I checked the DNS on the new domain and it is exactly like my other domains. I spent hours on the phone with GoDaddy today and they don't have a clue. Ther server is configured correctly because its accessible. I just need to get the SSL certificate in place. Making a new one is about as easy as it gets.

4

I checked and you seem to have some access control that prevents access to the challenge.

In many cases, a default config in web servers restrict public access to folders and files beginning with a dot (.), this to prevent accessing .htaccess, .htpasswd and similiar files that could contain sensitive data.

Try checking your web server log (for 403 to the url acme-challenge) why its failing. It should specify the reason why its denying the request, and possible you can find whatever in the config is causing this.

If you have a shared server, you might need to use a special API at your web hotel to provision the HTTP challenges, since you share server with other's, and they obviously don't want you to be able to provision challenges for other domains that are on the same IP.

5

Do you still get cert failures that name the IP starting with 76?

I agree that is an AWS service. Note that GoDaddy uses AWS for various features (like domain forwarding). Possibly parking as well - not sure.

I don't see the 76 IP from other places like https://unboundtest.com , dnsviz.net or even tests using the Let's Encrypt staging system. See this Let's Debug detailed result: Let's Debug

It would be very odd indeed if the LE production system was seeing a different IP from GoDaddy DNS servers than all these other test sites we normally use (especially LE Staging)

6

As I said in my original message, I have several other domains on this server that work fine. I copied an existing virtualhost block and just changed the domain name parameters. The other specifications are all the same from VirtualHosts that work. I renewed all 16 of my SSL corticates yesterday and they all worked fine. I just need to create the new one ofr the new domain.

7

I just ran this again about 15 minutes ago and it worked. No changes were made on my end.

8

Why are you doing --standalone, when there is an Apache server listening on port 80?

curl -Ii http://fotclibrary.org/
HTTP/1.1 200 OK
Date: Sat, 16 May 2026 23:43:31 GMT
Server: Apache
Last-Modified: Thu, 14 May 2026 17:40:35 GMT
ETag: "53c-651ca97f96ffe"
Accept-Ranges: bytes
Content-Length: 1340
Content-Type: text/html

Doing so may require that you shutdown Apache while running certbot.