# Renew failes 403 Forbidden for AuthType Basic

**URL:** <https://community.letsencrypt.org/t/renew-failes-403-forbidden-for-authtype-basic/79036>\
**Category:** Help\
**Created:** [December 2, 2018, 11:15pm UTC](https://community.letsencrypt.org/t/renew-failes-403-forbidden-for-authtype-basic/79036 "2018-12-02T23:15:44Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![maxhewitt](https://avatars.discourse-cdn.com/v4/letter/m/4491bb/32.png) [@maxhewitt](https://community.letsencrypt.org/u/maxhewitt)\
**Post date:** [December 2, 2018, 11:15pm UTC](https://community.letsencrypt.org/t/renew-failes-403-forbidden-for-authtype-basic/79036/1 "2018-12-02T23:15:44Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: [demo.texasschooltools.com](http://demo.texasschooltools.com)

I ran this command: /usr/local/sbin/certbot-auto renew --rsa-key-size 4096 --renew-hook "apachectl -k graceful"

It produced this output:

Domain: [demo.texasschooltools.com](http://demo.texasschooltools.com)  
Type: unauthorized  
Detail: Invalid response from  
[http://demo.texasschooltools.com/.well-known/acme-challenge/Ap5C2LnjA43GI1kATXG91sFPklHjfjpUgVM29His5m0:](http://demo.texasschooltools.com/.well-known/acme-challenge/Ap5C2LnjA43GI1kATXG91sFPklHjfjpUgVM29His5m0:)  
"\n\n403  
Forbidden\n\n

# Forbidden
\n\<p"

My web server is apache 2.2:

The operating system my web server runs on is Debian Wheezy:

My hosting provider, if applicable, is: self-hosted

I can login to a root shell on my machine: yes

I'm using a control panel to manage my site: no''

Hi guys,

I have letsencrypt set up on a debian wheezy, apache2.2 platform and renewals are coming up. Auths are failing for sites where I am restricting access (demo, development, stats), but appear to work fine for unrestricted sites.

Below is the apache2 config file for the demo site I'd like to tackle first:

> \<VirtualHost \*:80\>  
> ServerName [demo.texasschooltools.com](http://demo.texasschooltools.com)  
> Redirect / [https://demo.texasschooltools.com/](https://demo.texasschooltools.com/)  
> \</VirtualHost\>  
> \<VirtualHost \*:443\>  
> ServerName [demo.texasschooltools.com](http://demo.texasschooltools.com)  
> DocumentRoot "/var/www/demo"  
> php\_admin\_flag engine on  
> php\_admin\_value upload\_tmp\_dir /var/www/demo/upload  
> php\_flag display\_errors off  
> php\_admin\_value open\_basedir /var/www/demo/:/var/www/config/:/var/www/addons/:/var/www/tmp/:/var/www/upload/:/tmp/  
>   
> SSLEngine on  
> SSLProtocol -ALL -SSLv3 -SSLv2 +TLSv1  
> SSLHonorCipherOrder On  
> SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS  
> SSLCertificateKeyFile /etc/letsencrypt/live/multidomain/privkey.pem  
> SSLCertificateFile /etc/letsencrypt/live/multidomain/cert.pem  
> \</IfModule\>  
> LogFormat "%h %l %u %t "%r" %\>s %b "%{Referer}i" "%{User-agent}i"" combined  
> CustomLog "/var/log/apache2/demo/access.log" combined env=!dontlog  
> ErrorLog "/var/log/apache2/demo/error.log"  
> \<Directory "/var/www/demo"\>  
> Options -Indexes  
> AuthType Basic  
> AuthName "You have accessed a restricted site. Please log in."  
> AuthUserFile "/etc/apache2/authfiles/.htpasswd"  
> Require valid-user  
> AllowOverride All  
> Order allow,deny  
> Satisfy Any  
> DirectoryIndex index.html index.php login.php  
> \</Directory\>  
> \<Directory "/var/www/demo/.well-known/acme-challenge"\>  
> Options -Indexes  
> Order allow,deny  
> Allow from all  
> \</Directory\>  
> Include /etc/letsencrypt/options-ssl-apache.conf  
> SSLCertificateChainFile /etc/letsencrypt/live/multidomain/chain.pem  
> \</VirtualHost\>

I've used a watch and can verify that the authorization file is in fact being loaded to the ./well-known/acme-challenge folder. I have also tried placing a test.html file in that same folder and it cannot be accessed without the login name and password.

So my question is, how do I properly set up the Directory for the .well-known/acme-challenge folder so that it is unrestricted?

I've tried adding several versions of .htaccess (and enabling AllowOverride), with no luck.

Any ideas where I might be going wrong?

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [December 2, 2018, 11:20pm UTC](https://community.letsencrypt.org/t/renew-failes-403-forbidden-for-authtype-basic/79036/2 "2018-12-02T23:20:29Z")

</div>

One way could be just to address it directly in your port 80 handler:

```apache
<VirtualHost *:80>
        ServerName demo.texasschooltools.com
        DocumentRoot /var/www/demo/
        RewriteEngine On
        RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/
        RewriteRule (.*) https://demo.texasschooltools.com$1
</VirtualHost>

```

---

<div class="post-metadata">

**Author:** ![maxhewitt](https://avatars.discourse-cdn.com/v4/letter/m/4491bb/32.png) [@maxhewitt](https://community.letsencrypt.org/u/maxhewitt)\
**Post date:** [December 3, 2018, 12:14am UTC](https://community.letsencrypt.org/t/renew-failes-403-forbidden-for-authtype-basic/79036/3 "2018-12-03T00:14:03Z")

</div>

> [@\_az](#):
>
> DocumentRoot /var/www/demo/ RewriteEngine On RewriteCond %{REQUEST\_URI} !^/.well-known/acme-challenge/ RewriteRule (.\*) [https://demo.texasschooltools.com$1](https://demo.texasschooltools.com$1)

Still no dice. I changed the 80 handler to what you've got and I still get a 403 Forbidden error trying to access the [http://demo.texasschooltools.com/.well-known/acme-challenge/test.html](http://demo.texasschooltools.com/.well-known/acme-challenge/test.html) page.

I removed all .htaccess files in the webroot, and in the acme-challenge folders, just to make sure they aren't affecting anything. Any other ideas?

---

<div class="post-metadata">

**Author:** ![maxhewitt](https://avatars.discourse-cdn.com/v4/letter/m/4491bb/32.png) [@maxhewitt](https://community.letsencrypt.org/u/maxhewitt)\
**Post date:** [December 3, 2018, 12:24am UTC](https://community.letsencrypt.org/t/renew-failes-403-forbidden-for-authtype-basic/79036/4 "2018-12-03T00:24:07Z")

</div>

Out of curiosity, I changed the folder permissions for the .well-known folder (and subfolders) to 777 and viola! I have access to the test.html file now. So....what SHOULD the permissions be for that folder?

> chmod 777 -R /var/www/demo/.well-known

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [December 3, 2018, 12:44am UTC](https://community.letsencrypt.org/t/renew-failes-403-forbidden-for-authtype-basic/79036/5 "2018-12-03T00:44:17Z")

</div>

The permission of directories should generally be 0755.

403 isn’t related to your basic auth (which would be 401), something else is causing that.

Perhaps try putting this in the port 80 one as well:

```apache
Alias /.well-known/acme-challenge/ /var/www/acme

```

and seeing if using a different directory avoids the problem.

---

<div class="post-metadata">

**Author:** ![maxhewitt](https://avatars.discourse-cdn.com/v4/letter/m/4491bb/32.png) [@maxhewitt](https://community.letsencrypt.org/u/maxhewitt)\
**Post date:** [December 3, 2018, 1:57am UTC](https://community.letsencrypt.org/t/renew-failes-403-forbidden-for-authtype-basic/79036/6 "2018-12-03T01:57:24Z")

</div>

Thanks \_az. I think it mustve been related to the folder permissions. Everything works fine now and some of the folders in other secured websites did not have the same issues that I resolved with the update to the config file for the demo site.

So, one point to remember, check the folder permissions on .well-known (and its subfolders) and set to 0755 if all else fails. After making this chmod for all of my .well-known folders (various websites), renewal worked just fine and certs are now extended.

I’ll take a look at the Alias option yet, but I’d done some reading both for and against that workaround.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [January 2, 2019, 1:57am UTC](https://community.letsencrypt.org/t/renew-failes-403-forbidden-for-authtype-basic/79036/7 "2019-01-02T01:57:37Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.