# Problem with renewing certificates

**URL:** <https://community.letsencrypt.org/t/problem-with-renewing-certificates/81733>\
**Category:** Help\
**Created:** [January 6, 2019, 12:51pm UTC](https://community.letsencrypt.org/t/problem-with-renewing-certificates/81733 "2019-01-06T12:51:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![oleg\_antonov](https://avatars.discourse-cdn.com/v4/letter/o/74df32/32.png) [@oleg\_antonov](https://community.letsencrypt.org/u/oleg_antonov)\
**Post date:** [January 6, 2019, 12:51pm UTC](https://community.letsencrypt.org/t/problem-with-renewing-certificates/81733/1 "2019-01-06T12:51:59Z")

</div>

My domain is: [partcatalog.ru](http://partcatalog.ru)

I ran this command:  
./letsencrypt-auto renew

It produced this output:

> Processing /etc/letsencrypt/renewal/partcatalog.ru.conf
> 
> * * *
> 
> Cert is due for renewal, auto-renewing...  
> Plugins selected: Authenticator apache, Installer apache  
> Renewing an existing certificate  
> Performing the following challenges:  
> http-01 challenge for [partcatalog.ru](http://partcatalog.ru)  
> Waiting for verification...  
> Cleaning up challenges  
> Attempting to renew cert ([partcatalog.ru](http://partcatalog.ru)) from /etc/letsencrypt/renewal/partcatalog.ru.conf produced an unexpected error: Failed authorization procedure. [partcatalog.ru](http://partcatalog.ru) (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://partcatalog.ru/.well-known/acme-challenge/IlAXbhDd3Su72SFWzXJy9j96-8sGW1pvUIcS5GFkUus:](http://partcatalog.ru/.well-known/acme-challenge/IlAXbhDd3Su72SFWzXJy9j96-8sGW1pvUIcS5GFkUus:) "\n\n404 Not Found\n\n
> 
> # Not Found
> \n\<p". Skipping.

My web server is (include version):  
Apache

The operating system my web server runs on is (include version):  
Debian 7

I can login to a root shell on my machine:  
Yes

I'm using a control panel to manage my site:  
No

I understand that an error occurs when confirming domain rights.  
I created folders at: /var/www/partcatalog.ru/.well-known/acme-challenge  
Exposed permission level 755  
What text should I place and where can the system check my domain? Or do you need to add some information in DNS?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 6, 2019, 1:37pm UTC](https://community.letsencrypt.org/t/problem-with-renewing-certificates/81733/2 "2019-01-06T13:37:12Z")

</div>

Hi @oleg_antonov

> [@oleg\_antonov](#):
>
> My domain is: [partcatalog.ru](http://partcatalog.ru)

I see, you have already checked your domain via [partcatalog.ru - Make your website better - DNS, redirects, mixed content, certificates](https://check-your-website.server-daten.de/?q=partcatalog.ru) :

There is one problem:

* * *

| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://partcatalog.ru/](http://partcatalog.ru/) | | | | |
| 5.44.103.11 | 302 | [https://partcatalog.ru/](https://partcatalog.ru/) | 0.047 | A |
| | | | | |
| • [http://www.partcatalog.ru/](http://www.partcatalog.ru/) | | | | |
| 5.44.103.11 | 302 | [https://www.partcatalog.ru/](https://www.partcatalog.ru/) | 0.047 | A |
| | | | | |
| • [https://partcatalog.ru/](https://partcatalog.ru/) | | | | |
| 5.44.103.11 | 200 | | 1.423 | N |
| Certificate error: RemoteCertificateChainErrors | | | | |
| | | | | |
| • [https://www.partcatalog.ru/](https://www.partcatalog.ru/) | | | | |
| 5.44.103.11 | 200 | | 1.360 | N |
| Certificate error: RemoteCertificateNameMismatch, RemoteCertificateChainErrors | | | | |
| | | | | |
| • [http://partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 5.44.103.11 | 302 | [https://partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](https://partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | 0.064 | A |
| | | | | |
| • [http://www.partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://www.partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 5.44.103.11 | 302 | [https://www.partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](https://www.partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | 0.043 | A |
| | | | | |
| • [https://partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](https://partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | 200 | | 1.267 | N |
| Certificate error: RemoteCertificateChainErrors | | | | |
| | | | | |
| • [https://www.partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](https://www.partcatalog.ru/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | 200 | | 1.266 | N |
| Certificate error: RemoteCertificateNameMismatch, RemoteCertificateChainErrors | | | | |

* * *

The redirect http -\> https is ok, Letsencrypt ignores the wrong certificate. But checking a not existing file

```nohighlight
https://www.partcatalog.ru/.well-known/acme-challenge/1234

```

your server sends a http status 200 (ok), not the expected status 404 (not found).

So it looks there are other redirects or a misconfiguration. Ah - loading the url manual, there is a big 404, so it's only the wrong http status.

> I created folders at: /var/www/partcatalog.ru/.well-known/acme-challenge

That's good, now create there a file (file name 1234 with random content) and try to load this file via

```nohighlight
http://partcatalog.ru/.well-known/acme-challenge/1234

```

If this works, you have found your correct webroot, so you can use

```nohighlight
./letsencrypt-auto run -a webroot -i apache -w /var/www/partcatalog.ru -d partcatalog.ru

```

to create a new certificate.

---

<div class="post-metadata">

**Author:** ![oleg\_antonov](https://avatars.discourse-cdn.com/v4/letter/o/74df32/32.png) [@oleg\_antonov](https://community.letsencrypt.org/u/oleg_antonov)\
**Post date:** [January 6, 2019, 3:02pm UTC](https://community.letsencrypt.org/t/problem-with-renewing-certificates/81733/3 "2019-01-06T15:02:49Z")

</div>

> [@JuergenAuer](#):
>
> ./letsencrypt-auto run -a webroot -i apache -w /var/www/partcatalog.ru -d [partcatalog.ru](http://partcatalog.ru)

Thank you very much! It all worked.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 6, 2019, 3:32pm UTC](https://community.letsencrypt.org/t/problem-with-renewing-certificates/81733/4 "2019-01-06T15:32:38Z")

</div>

Yep, now it works.

But if you want, you can create one certificate with two names:

```auto
-d partcatalog.ru -d www.partcatalog.ru

```

Your current certificate has only one domain name, but www has a dns entry.

Different countries, different people. Some people add always www, some people add never www.

If you use one certificate with two domain names, both versions work.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [February 5, 2019, 3:32pm UTC](https://community.letsencrypt.org/t/problem-with-renewing-certificates/81733/5 "2019-02-05T15:32:43Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.