I am not sure where to start with this one? I don't usually post to forums preferring to figure the problem out from help online. However, having spent all day on this, I need your help please. Please read below for the outline overview of my problem domain.
My domain is:
webmail.f4g.tech
I ran this command:
sudo certbot certonly --apache -d webmail.f4g.tech --dry-run
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for webmail.f4g.tech
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. webmail.f4g.tech (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://webmail.f4g.tech/.well-known/acme-challenge/sTXtEJlY784o7_OaoE2CZRKxqeaRms3mlVh5y8kf5dQ [2a01:4f8:c0c:302a::2]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: webmail.f4g.tech
Type: unauthorized
Detail: Invalid response from
http://webmail.f4g.tech/.well-known/acme-challenge/sTXtEJlY784o7_OaoE2CZRKxqeaRms3mlVh5y8kf5dQ
[2a01:4f8:c0c:302a::2]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
2.0//EN\">\n<html><head>\n<title>404 Not
Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
My web server is (include version):
Server version: Apache/2.4.18 (Ubuntu)
The operating system my web server runs on is (include version):
Ubuntu 16.04.3 LTS
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 0.31.0
Do you have any kind of proxying in front of Apache, that might be what's keeping certbot from figuring out how to modify your Apache configuration to respond to the challenges? The reason I ask is that your server sends a header of Server: Bob's House which is kind of amusing and not what I'd expect for Apache. But if it's actually Apache answering but with some kind of modified Server header then that might not actually be related.
Hi @petercooperjr . Haha! It is indeed a modified server header.
I might need to remove a recently added AAAA DNS record, which is referenced in the error. However, I must say, that the apache vh conf file specifies ipv4:
<VirtualHost 94.130.72.29:443>
Also, I notice this redirect in Roundcube .htaccess:
RewriteRule ^(?!installer|.well-known/|[a-zA-Z0-9]{16})(.?[^.]+) $ - [F]
I take this to mean .well-known is banned?
I saw nothing wrong with your IPv6 (AAAA record) in my testing. As you indicate, I think something is amiss in your apache configuration. Hence the command I mentioned.
VirtualHost configuration:
[2a01:4f8:c0c:302a::2]:80 ip6.f4g.tech (/etc/apache2/sites-enabled/ip6.f4g.tech.conf:1)
94.130.72.29:80 is a NameVirtualHost
default server trikaya.f4g.tech (/etc/apache2/sites-enabled/trikaya.f4g.tech-le-ssl.conf:2)
port 80 namevhost trikaya.f4g.tech (/etc/apache2/sites-enabled/trikaya.f4g.tech-le-ssl.conf:2)
alias www.trikaya.f4g.tech
port 80 namevhost webmail.f4g.tech (/etc/apache2/sites-enabled/webmail.f4g.tech-le-ssl.conf:1)
94.130.72.29:443 webmail.f4g.tech (/etc/apache2/sites-enabled/webmail.f4g.tech-le-ssl.conf:8)
*:443 is a NameVirtualHost
default server demo.f4g.tech (/etc/apache2/sites-enabled/demo.f4g.tech-le-ssl.conf:2)
port 443 namevhost demo.f4g.tech (/etc/apache2/sites-enabled/demo.f4g.tech-le-ssl.conf:2)
port 443 namevhost f4g.tech (/etc/apache2/sites-enabled/f4g-le-ssl.conf:11)
alias www.f4g.tech
port 443 namevhost groundsourcesolutions.co.uk (/etc/apache2/sites-enabled/groundss.co.uk-ssl.conf:1)
alias www.groundsourcesolutions.co.uk
port 443 namevhost cloud.f4g.tech (/etc/apache2/sites-enabled/nextcloud2-le-ssl.conf:2)
port 443 namevhost trikaya.f4g.tech (/etc/apache2/sites-enabled/trikaya.f4g.tech-le-ssl.conf:14)
alias www.trikaya.f4g.tech
port 443 namevhost waterseekers.co.uk (/etc/apache2/sites-enabled/waterseekers.co.uk-le-ssl.conf:2)
alias www.waterseekers.co.uk
*:80 is a NameVirtualHost
default server bob.f4g.tech (/etc/apache2/sites-enabled/000-default.conf:1)
port 80 namevhost bob.f4g.tech (/etc/apache2/sites-enabled/000-default.conf:1)
port 80 namevhost 100.f4g.tech (/etc/apache2/sites-enabled/100.f4g.tech.conf:1)
port 80 namevhost avatar.net (/etc/apache2/sites-enabled/avatar.net.conf:1)
alias www.avatar.net
port 80 namevhost demo.f4g.tech (/etc/apache2/sites-enabled/demo.f4g.tech.conf:2)
port 80 namevhost f4g.tech (/etc/apache2/sites-enabled/f4g-le-ssl.conf:3)
alias www.f4g.tech
port 80 namevhost groundsourcesolutions.co.uk (/etc/apache2/sites-enabled/groundsourcesolutions.co.uk.conf:1)
alias www.groundsourcesolutions.co.uk
port 80 namevhost ip6.f4g.tech (/etc/apache2/sites-enabled/ip6.f4g.tech.conf:19)
alias ip6.f4g.tech
port 80 namevhost manchesterroadsurgery.org.uk (/etc/apache2/sites-enabled/manchesterroadsurgery.org.uk.conf:2)
alias www.manchesterroadsurgery.org.uk
port 80 namevhost cloud.f4g.tech (/etc/apache2/sites-enabled/nextcloud2.conf:1)
port 80 namevhost numerology.f4g.tech (/etc/apache2/sites-enabled/numerology.f4g.tech.conf:1)
alias www.numerology.f4g.tech
port 80 namevhost map.waterseekers.co.uk (/etc/apache2/sites-enabled/waterseekers-map.co.uk.conf:1)
alias borehole-map.waterseekers.co.uk
port 80 namevhost waterseekers.co.uk (/etc/apache2/sites-enabled/waterseekers.co.uk.conf:3)
alias www.waterseekers.co.uk
port 80 namevhost waterwelldrilling.waterseekers.co.uk (/etc/apache2/sites-enabled/waterwelldrilling.conf:2)
port 80 namevhost web.f4g.tech (/etc/apache2/sites-enabled/web.f4g.tech.conf:1)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/lock/apache2" mechanism=fcntl
Mutex mpm-accept: using_defaults
Mutex watchdog-callback: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex ssl-stapling: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
Define: MODSEC_2.5
Define: MODSEC_2.9
Define: ENABLE_USR_LIB_CGI_BIN
Define: F4G=/var/www/f4g.tech/
User: name="www-data" id=33
Group: name="www-data" id=33
It's as I suspected. All of the port 80 named vhost configurations have been disabled, so apache has no idea which vhost to use at times. Let's fix one as a sample.
It shouldn't after enabling the new webmail.f4g.tech.conf (unless they point to the same webroot folder, in which case it's expected, but I doubt it will happen).
