# Raise errors.AuthorizationError('Some challenges have failed.')

**URL:** <https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219>\
**Category:** Help\
**Created:** [May 24, 2022, 1:21am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219 "2022-05-24T01:21:06Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![calexandre](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@calexandre](https://community.letsencrypt.org/u/calexandre)\
**Post date:** [May 24, 2022, 1:21am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/1 "2022-05-24T01:21:06Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:  
soalom.com.mx  
I ran this command:  
certbot --apache  
It produced this output:  
Detail: 38.124.201.39: Fetching [http://store.soalom.com.mx/.well-known/acme-challenge/CWpkAJjGoXQhT7ngEhMbNrpwpTCKmdesjbDXtvzV4Io:](http://store.soalom.com.mx/.well-known/acme-challenge/CWpkAJjGoXQhT7ngEhMbNrpwpTCKmdesjbDXtvzV4Io:) Error getting validation data  
My web server is (include version): apache  
The operating system my web server runs on is (include version): Rocky 8  
My hosting provider, if applicable, is: NONE  
I can login to a root shell on my machine (yes or no, or I don't know): yes  
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): NO  
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):certbot 1.27.0

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 24, 2022, 1:24am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/2 "2022-05-24T01:24:31Z")

</div>

Hi @calexandre, and welcome to the LE community forum 🙂

There is not enough information given for me to adequately help you.

I do see that you are using `Apache`.  
That has been known to allow inconsistent configurations.  
Configurations that might confuse `certbot --apache`.  
Without any other "clue", I would start there; Please show the output of:  
`apachectl -t -D DUMP_VHOSTS`

---

<div class="post-metadata">

**Author:** ![calexandre](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@calexandre](https://community.letsencrypt.org/u/calexandre)\
**Post date:** [May 24, 2022, 1:34am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/3 "2022-05-24T01:34:26Z")

</div>

Hello,  
following your suggestion the following appears:

Passing arguments to httpd using apachectl is no longer supported.  
You can only start/stop/restart httpd using this script.  
If you want to pass extra arguments to httpd, edit the  
/etc/sysconfig/httpd config file.

---

<div class="post-metadata">

**Author:** ![calexandre](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@calexandre](https://community.letsencrypt.org/u/calexandre)\
**Post date:** [May 24, 2022, 1:36am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/4 "2022-05-24T01:36:46Z")

</div>

using logs these not provide more information than I exposed here

---

<div class="post-metadata">

**Author:** ![calexandre](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@calexandre](https://community.letsencrypt.org/u/calexandre)\
**Post date:** [May 24, 2022, 1:38am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/5 "2022-05-24T01:38:31Z")

</div>

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:  
Domain: store.soalom.com.mx  
Type: connection  
Detail: 38.124.201.39: Fetching [http://store.soalom.com.mx/.well-known/acme-challenge/CWpkAJjGoXQhT7ngEhMbNrpwpTCKmdesjbDXtvzV4Io:](http://store.soalom.com.mx/.well-known/acme-challenge/CWpkAJjGoXQhT7ngEhMbNrpwpTCKmdesjbDXtvzV4Io:) Error getting validation data

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Some challenges have failed.  
Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [May 24, 2022, 1:38am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/6 "2022-05-24T01:38:40Z")

</div>

Is TCP port 80 open and can you connect to your website using standard http? If not, http validation of your domain is not going to work.

```nohighlight
curl http://store.soalom.com.mx
curl: (7) Failed to connect to store.soalom.com.mx port 80: No route to host

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 24, 2022, 1:45am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/7 "2022-05-24T01:45:48Z")

</div>

Check your NATting.

HTTP to port 80 fails [NOT GOOD]:

```nohighlight
curl -Ii store.soalom.com.mx
curl: (56) Recv failure: Connection reset by peer

```

HTTP to port 443 connects [NOT GOOD]:  
EDIT: THIS HTTP:443 ACCESS MIGHT BE A FALSE NEGATIVE

```nohighlight
curl -Ii store.soalom.com.mx:443
HTTP/1.1 400 Bad Request
Date: Tue, 24 May 2022 01:46:51 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Content-Length: 362
Connection: close
Content-Type: text/html; charset=iso-8859-1

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 24, 2022, 1:48am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/8 "2022-05-24T01:48:51Z")

</div>

Also, since you have and older version of `Apache` ("`2.4.6`"), try:  
`httpd -t -D DUMP_VHOSTS`

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [May 24, 2022, 1:53am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/9 "2022-05-24T01:53:04Z")

</div>

> [@rg305](#):
>
> HTTP to port 443 connects [NOT GOOD]:

I see port 443 server rejecting http. Does not help with the other issues, just noting.

```nohighlight
curl -i http://store.soalom.com.mx:443
HTTP/1.1 400 Bad Request
Date: Tue, 24 May 2022 01:51:16 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Content-Length: 362
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
Reason: You're speaking plain HTTP to an SSL-enabled server port.<br />
 Instead use the HTTPS scheme to access this URL, please.<br />
</p>
</body></html>

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 24, 2022, 1:54am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/10 "2022-05-24T01:54:15Z")

</div>

You beat me to the punch!  
I just edited my post about that.  
Since this actually connected and returned a cert:  
`openssl s_client -connect store.soalom.com.mx:443`

Never-the-less port 80 is the focus and the problem for now.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 24, 2022, 1:58am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/11 "2022-05-24T01:58:22Z")

</div>

Some progress seems to have been made:

```nohighlight
curl -Ii store.soalom.com.mx/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 301 Moved Permanently
Date: Tue, 24 May 2022 02:00:30 GMT
Server: Apache/2.4.37 (rocky) OpenSSL/1.1.1k
Location: https://store.soalom.com.mx/.well-known/acme-challenge/Test_File-1234
Content-Type: text/html; charset=iso-8859-1

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 24, 2022, 1:59am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/12 "2022-05-24T01:59:34Z")

</div>

But this is rather strange:

```nohighlight
curl -Ii store.soalom.com.mx
HTTP/1.1 301 Moved Permanently
Server: Apache/2.4.37 (rocky) OpenSSL/1.1.1k

curl -Ii store.soalom.com.mx:443
HTTP/1.1 400 Bad Request
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16

```

So, I repeat myself:

> [@rg305](#):
>
> Check your NATting.

> [@rg305](#):
>
> Also, since you have and older version of `Apache` (" `2.4.6` "), try:  
> `httpd -t -D DUMP_VHOSTS`

---

<div class="post-metadata">

**Author:** ![calexandre](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@calexandre](https://community.letsencrypt.org/u/calexandre)\
**Post date:** [May 24, 2022, 2:16am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/14 "2022-05-24T02:16:15Z")

</div>

hello all, thank you for your answers and help.  
To perform some tests I changed the ip addresses between servers, and I have made some port redirects to verify that the problem does not remain in the firewall, some servers already had certificates, maybe that shows rare behaviors, tomorrow I'll continue with tests.

Thank you again

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 24, 2022, 3:13am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/15 "2022-05-24T03:13:35Z")

</div>

You should be using the LE staging environment for testing.  
Once all tests are concluded, then switch to production LE environment.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 23, 2022, 3:13am UTC](https://community.letsencrypt.org/t/raise-errors-authorizationerror-some-challenges-have-failed/178219/16 "2022-06-23T03:13:35Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.