Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
www.kreator.ch
I ran this command:
certbot-auto --apache certonly
It produced this output:
Domain: www.kreator.ch
Type: unauthorized
…
To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address.
My web server is (include version):
Apache 2.4.0 Tomcat/7.0.56
The operating system my web server runs on is (include version):
Debian GNU/Linux 8.9 (jessie)
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
N/A
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 0.30.2
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
Can you kindly clarify how to find out what validation method is used by my Certbot installation? I did not install Certbot on our server.
I think Letsencrypt has left its users partly hanging here, with no pointer to figuring out if anything at all needs to be done, and incomplete instructions in case something needs to be done. Having said that, Letsencrypt/Certbot looks like a great idea, but important changes like this need better support to the users.
Hi Juergen,
Thanks a lot for your support.
My DocumentRoot is /var/www/kreator.ch/public_html
So I executed the command:
certbot run -a webroot -i apache -w /var/www/kreator.ch/public_html -d www.kreator.ch -d kreator.ch
And received the same error message as with certbot-auto --apache certonly
Failed authorization procedure. kreator.ch (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://kreator.ch/.well-known/acme-challenge/jDFXP2qz5-9qbesIaGqK4BXSvARQ7HKq9OYwUxQ4SyQ: "Apache Tomcat/7.0.56 (Debian) - Error report<!--H1 {font-family:Tahoma,Arial,sans-serif;color:", www.kreator.ch (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.kreator.ch/.well-known/acme-challenge/UrBIhRsCf_dRBNYNdqAYMBaSSHAv6DvXRX4L9_yE_mE: "Apache Tomcat/7.0.56 (Debian) - Error report<!--H1 {font-family:Tahoma,Arial,sans-serif;color:"
You see: There are redirects http -> https. This is ok, Letsencrypt follows redirects and the redirects are ok (they add the complete path and filename). But your log says, that Letsencrypt tries to load the http - version, so Letsencrypt doesn't get a redirect.
Why?
And the Server is always:
Server: Apache/2.4.10 (Debian)
not
Apache Tomcat/7.0.56 (Debian)
So it looks that there are different servers running and answering.
<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request’s Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
ServerAdmin mathias.zajaczkowski@ubik.ch
ServerName kreator.ch
# stackoverflow.com/questions/4083221/how-to-redirect-all-http-requests-to-https/21798882#21798882
Redirect / https://www.kreator.ch
ServerAlias kreator.ch
DocumentRoot /var/www/kreator.ch/public_html
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf