Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
trustserv.de
I ran this command:
certbot renewq
It produced this output:
root@srv1:/etc/apache2/sites-enabled# certbot --dry-run renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/trustserv.de.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer None
Running pre-hook command: /etc/letsencrypt/renewal-hooks/pre/stopservices.sh
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for trustserv.de
http-01 challenge for www.trustserv.de
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (trustserv.de) from /etc/letsencrypt/renewal/trustserv.de.conf produced an unexpected error: Failed authorization procedure. trustserv.de (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from https://trustserv.de/.well-known/acme-challenge/K40tMPkbKI8ANGSewFkDRVKXlwQSHVJVgTaL8jaGlm0 [185.207.106.7]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p", www.trustserv.de (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from https://www.trustserv.de/.well-known/acme-challenge/hNg-RshhyIe45wIJ9KpGXAmf7eyM7SKbBQQAu4Aw68c [185.207.106.7]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p". Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/trustserv.de/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates below have not been saved.)
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/trustserv.de/fullchain.pem (failure)
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates above have not been saved.)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Running post-hook command: /etc/letsencrypt/renewal-hooks/post/restart_services.sh
1 renew failure(s), 0 parse failure(s)
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: trustserv.de
Type: unauthorized
Detail: Invalid response from
https://trustserv.de/.well-known/acme-challenge/K40tMPkbKI8ANGSewFkDRVKXlwQSHVJVgTaL8jaGlm0
[185.207.106.7]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
2.0//EN\">\n<html><head>\n<title>404 Not
Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
Domain: www.trustserv.de
Type: unauthorized
Detail: Invalid response from
https://www.trustserv.de/.well-known/acme-challenge/hNg-RshhyIe45wIJ9KpGXAmf7eyM7SKbBQQAu4Aw68c
[185.207.106.7]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
2.0//EN\">\n<html><head>\n<title>404 Not
Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
My web server is (include version):
apache 2.x
The operating system my web server runs on is (include version):
debian 10
My hosting provider, if applicable, is:
netcup
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): certbot 0.31
I have multiple subdomains. I have to renew the certificates all the time with certonly and i really want to have this somehow automated. Can someone please help me to get that working with just “certbot renew” without all that hacking around?
When i create the file it is complaining about, i can access it. So it is for sure not a “easy” configuration problem. I noticed that certbot does something with /var/lib/letsencrypt and manipulates my apache2 conf files. I guess the problem is somehow related to that.
The conf of the main page is:
<VirtualHost *:80>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</IfModule>
ServerName trustserv.de
ServerAlias www.trustserv.de
</VirtualHost>
The conf of the ssl page is:
<IfModule mod_ssl.c>
<VirtualHost *:443>
#Include global.conf
ServerAdmin some@mydomain.de
DocumentRoot /home/website/public
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
Include /etc/apache2/ssl.conf
# HTTP Strict Transport Security Header.
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set Content-Security-Policy "default-src 'self' https://trustserv.de; script-src 'self' 'sha256-nP0EI9B9ad8IoFUti2q7EQBabcE5MS5v0nkvRfUbYnM=' https://trustserv.de; img-src 'self' https://trustserv.de; style-src-elem 'self'; style-src 'self' https://trustserv.de"
Header set Access-Control-Allow-Origin "*"
<Directory "/">
Options None
AllowOverride All
<RequireAny>
Require all granted
</RequireAny>
</Directory>
#<IfModule alias_module>
# Alias /.well-known/acme-challenge/ /home/website/public/.well-known/acme-challenge/
#</IfModule>
</VirtualHost>
</IfModule>