I’m trying to get two SSL ceritificates for two domains one the same IP. I’m using Apache with SNI. For the first domain, i have installed LetsEncrypt and it is working good. But i’m unable to install for the second domain.
Here is my output:
certbot-auto --apache -d secondomain.lt -d www.secondomain.lt
Requesting root privileges to run certbot...
/home/xxx/.local/share/letsencrypt/bin/letsencrypt --apache -d secondomain.lt -d www.secondomain.lt
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for secondomain.lt
tls-sni-01 challenge for www.secondomain.lt
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. secondomain.lt (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 67cc4c1fe331239df2aa886179bc93dc.b4bbdafbb67f49e154341cb15ec9e11c.acme.invalid from 194.135.80.160:443. Received 2 certificate(s), first certificate had names "firstdomain.lt, www.firstdomain.lt", www.secondomain.lt (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 4552aaa93d0d91647a353631c6c75cd0.9bdde20c003a29a31af8dbdf42a81113.acme.invalid from 194.135.80.160:443. Received 2 certificate(s), first certificate had names "firstdomain.lt, www.firstdomain.lt"
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: secondomain.lt
Type: unauthorized
Detail: Incorrect validation certificate for tls-sni-01 challenge.
Requested
67cc4c1fe331239df2aa886179bc93dc.b4bbdafbb67f49e154341cb15ec9e11c.acme.invalid
from 194.135.80.160:443. Received 2 certificate(s), first
certificate had names "firstdomain.lt, www.firstdomain.lt"
Domain: www.secondomain.lt
Type: unauthorized
Detail: Incorrect validation certificate for tls-sni-01 challenge.
Requested
4552aaa93d0d91647a353631c6c75cd0.9bdde20c003a29a31af8dbdf42a81113.acme.invalid
from 194.135.80.160:443. Received 2 certificate(s), first
certificate had names "firstdomain.lt, www.firstdomain.lt"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
Please fill out the stuff below and accurately (you would be suprised how many people don’t have a WWW domain in DNS and try to get a certificate for it)
Please fill out the fields below so we can help you better.
That's not true. certbot will temporary install the self signed challenge certificate and will revert the Apache configuration to remove that temporary certificate when it exits. So everything you see on the "outside" when certbot isn't running, doesn't say anything about the tls-sni-01 challenge. Also, you'd need to SPECIFICALLY request that SPECIFIC hostname to get that temporary certificate anyway. Please read on how the challenge works if you don't actually know it so you'll refrain from giving ill-advised help (although you mean well, I know!)
@BigBug Most of the time these errors will present when one of two situations are in place (or both at the same time ):
You have multiple <VirtualHost *:80> sections in one Apache configuration file. certbot. At this moment (a change in the code is in progress!), certbot requires just one<VirtualHost *:80> section per file. Note: it is valid to have one vhost section for multiple hostnames by using ServerAlias besides the ServerName directive. certbot should be able to detect the hostname(s) in ServerAlias.
Your <VirtualHost> sections have mixed syntax. Most of the time, the following syntax is the most complient: <VirtualHost *:80>. But sometimes servers have a mix of <VirtualHost 1.2.3.4:80> (with an IP address) or <VirtualHost *> (not specifying a port number). That can interfere with certbots temporary certificate presentation. My advice would be: only use the <VirtualHost *:80> syntax, unless you're using IP based virtual hosting (and of course <VirtualHost *:443> for HTTPS.
This will use the apache plugin to install the certificate (it will copy your existing configuration file into a new one with -le-ssl after the current filename) and use the webroot plugin for authentication.
):
