Renew unauthorized (authenticator:webroot) temporary challenges files cannot be created

g-orgo · January 29, 2024, 6:32pm

I ran this command: sudo certbot renew --dry-run

It produced this output:

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: provocah.com
  Type:   unauthorized
  Detail: 193.203.182.206: Invalid response from https://provocah.com/.well-known/acme-challenge/LQBltRcFv9e5adsEOytRrLJqIqIuiG2zMNlkaGUYxxE:
"<!DOCTYPE html>\r\n<html lang=\"en\">\r\n    <head>\r\n        <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\r"

My web server is (include version): open litespeed 1.7.18

The operating system my web server runs on is (include version): Ubuntu 22.04 64bit

My hosting provider, if applicable, is: Hostinger

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.21.0

Sup guys, i'm trying to renew an certificate i have and when i run sudo certbot renew --dry-run it gives me an error that seems to be it can't download the callenges from certbot.

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                                                               
Processing /etc/letsencrypt/renewal/provocah.com.conf                                                                                                         
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                                                               
Certificate is due for renewal, auto-renewing...                                                                                                              
Plugins selected: Authenticator webroot, Installer None                                                                                                       
Simulating renewal of an existing certificate for provocah.com and www.provocah.com                                                                           
Performing the following challenges:                                                                                                                          
http-01 challenge for provocah.com                                                                                                                            
http-01 challenge for www.provocah.com                                                                                                                        
Using the webroot path /usr/local/lsws/Example/html for all unmatched domains.                                                                                
Waiting for verification...                                                                                                                                   
Challenge failed for domain provocah.com                                                                                                                      
Challenge failed for domain www.provocah.com                                                                                                                  
http-01 challenge for provocah.com                                                                                                                            
http-01 challenge for www.provocah.com                                                                                                                        
                                                                                                                                                              
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:                                      
  Domain: provocah.com                                                                                                                                        
  Type:   unauthorized                                                                                                                                        
  Detail: 193.203.182.206: Invalid response from https://provocah.com/.well-known/acme-challenge/sWErRWETrr2mT53SNwKTXZaINkHwbB74djqZFmaje1c: "<!DOCTYPE html>
\r\n<html lang=\"en\">\r\n    <head>\r\n        <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\r"                               
                                                                                                                                                              
  Domain: www.provocah.com                                                                                                                                    
  Type:   unauthorized                                                                                                                                        
  Detail: 193.203.182.206: Invalid response from https://provocah.com/.well-known/acme-challenge/O164M-L81n7aVytV9ovj7_ujrgtzCRfbqgGPUQSmzKo: "<!DOCTYPE html>
\r\n<html lang=\"en\">\r\n    <head>\r\n        <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\r"                               
                                                                                                                                                              
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from t
he provided --webroot-path/-w and that files created there can be downloaded from the internet.                                                               
                                                                                                                                                              
Cleaning up challenges                                                                                                                                        
Failed to renew certificate provocah.com with error: Some challenges have failed.                                                                             
                                                                                                                                                              
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                                                               
All simulated renewals failed. The following certificates could not be renewed:                                                                               
  /etc/letsencrypt/live/provocah.com/fullchain.pem (failure)                                                                                                  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                                                               
1 renew failure(s), 0 parse failure(s)                                                                                                                        
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for 
more details.

Crawling around some repos in this forum i've found that may my port 80 isn't open but as i've configured Nginx on it it may be "busy" not closed... idk if that make sense, help me

rg305 · January 29, 2024, 8:45pm

There is something off with your nginx config.
It should return 404, but it doesn't:

curl -Ii4k https://provocah.com/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 29 Jan 2024 20:44:14 GMT
Content-Type: text/html
Content-Length: 22901
Last-Modified: Tue, 23 Jan 2024 22:20:24 GMT
Connection: keep-alive
ETag: "65b03ba8-5975"
Accept-Ranges: bytes

We should review the output of:

`nginx -T`

g-orgo · January 29, 2024, 9:34pm

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok                                                                                        
nginx: configuration file /etc/nginx/nginx.conf test is successful                                                                                      
# configuration file /etc/nginx/nginx.conf:                                                                                                             
user www-data;                                                                                                                                          
worker_processes auto;                                                                                                                                  
pid /run/nginx.pid;                                                                                                                                     
include /etc/nginx/modules-enabled/*.conf;                                                                                                              
                                                                                                                                                        
events {                                                                                                                                                
        worker_connections 768;                                                                                                                         
        # multi_accept on;                                                                                                                              
}                                                                                                                                                       
                                                                                                                                                        
http {                                                                                                                                                  
                                                                                                                                                        
        ##                                                                                                                                              
        # Basic Settings                                                                                                                                
        ##                                                                                                                                              
                                                                                                                                                        
        sendfile on;                                                                                                                                    
        tcp_nopush on;                                                                                                                                  
        types_hash_max_size 2048;                                                                                                                       
        # server_tokens off;                                                                                                                            
                                                                                                                                                        
        # server_names_hash_bucket_size 64;                                                                                                             
        # server_name_in_redirect off;                                                                                                                  
                                                                                                                                                        
        include /etc/nginx/mime.types;                                                                                                                  
        default_type application/octet-stream;                                                                                                          
                                                                                                                                                        
        ##                                                                                                                                              
        # SSL Settings                                                                                                                                  
        ##                                                                                                                                              
                                                                                                                                                        
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE                                                                      
        ssl_prefer_server_ciphers on;                                                                                                                   
                                                                                                                                                        
        ##                                                                                                                                              
        # Logging Settings                                                                                                                              
        ##                                                                                                                                              
                                                                                                                                                        
        access_log /var/log/nginx/access.log;                                                                                                           
        error_log /var/log/nginx/error.log;                                                                                                             
                                                                                                                                                        
        ##                                                                                                                                              
        # Gzip Settings                                                                                                                                 
        ##                                                                                                                                              
                                                                                                                                                        
        gzip on;                                                                                                                                        
                                                                                                                                                        
        # gzip_vary on;                                                                                                                                 
        # gzip_proxied any;                                                                                                                             
        # gzip_comp_level 6;                                                                                                                            
        # gzip_buffers 16 8k;                                                                                                                           
        # gzip_http_version 1.1;                                                                                                                        
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;          
                                                                                                                                                        
        ##                                                                                                                                              
        # Virtual Host Configs                                                                                                                          
        ##                                                                                                                                              
                                                                                                                                                        
        include /etc/nginx/conf.d/*.conf;                                                                                                               
        include /etc/nginx/sites-enabled/*;                                                                                                             
}                                                                                                                                                       
                                                                                                                                                        
                                                                                                                                                        
#mail {                                                                                                                                                 
#       # See sample authentication script at:                                                                                                          
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript                                                                                     
#                                                                                                                                                       
#       # auth_http localhost/auth.php;                                                                                                                 
#       # pop3_capabilities "TOP" "USER";                                                                                                               
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";                                                                                                      
#                                                                                                                                                       
#       server {                                                                                                                                        
#               listen     localhost:110;                                                                                                               
#               protocol   pop3;                                                                                                                        
#               proxy      on;                                                                                                                          
#       }                                                                                                                                               
#                                                                                                                                                       
#       server {                                                                                                                                        
#               listen     localhost:143;                                                                                                               
#               protocol   imap;                                                                                                                        
#               proxy      on;                                                                                                                          
#       }                                                                                                                                               
#}                                                                                                                                                      
                                                                                                                                                        
# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip2.conf:                                                                                
load_module modules/ngx_http_geoip2_module.so;                                                                                                          
                                                                                                                                                        
# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:                                                                          
load_module modules/ngx_http_image_filter_module.so;                                                                                                    
                                                                                                                                                        
# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:                                                                           
load_module modules/ngx_http_xslt_filter_module.so;                                                                                                     
                                                                                                                                                        
# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:                                                                                       
load_module modules/ngx_mail_module.so;                                                                                                                 
                                                                                                                                                        
# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:                                                                                     
load_module modules/ngx_stream_module.so;                                                                                                               
                                                                                                                                                        
# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip2.conf:                                                                              
load_module modules/ngx_stream_geoip2_module.so;                                                                                                        
                                                                                                                                                        
# configuration file /etc/nginx/mime.types:                                                                                                             
                                                                                                                                                        
types {                                                                                                                                                 
    text/html                             html htm shtml;                                                                                               
    text/css                              css;                                                                                                          
    text/xml                              xml;                                                                                                          
    image/gif                             gif;                                                                                                          
    image/jpeg                            jpeg jpg;                                                                                                     
    application/javascript                js;                                                                                                           
    application/atom+xml                  atom;                                                                                                         
    application/rss+xml                   rss;                                                                                                          
                                                                                                                                                        
    text/mathml                           mml;                                                                                                          
    text/plain                            txt;                                                                                                          
    text/vnd.sun.j2me.app-descriptor      jad;                                                                                                          
    text/vnd.wap.wml                      wml;                                                                                                          
    text/x-component                      htc;                                                                                                          
                                                                                                                                                        
    image/png                             png;                                                                                                          
    image/tiff                            tif tiff;                                                                                                     
    image/vnd.wap.wbmp                    wbmp;                                                                                                         
    image/x-icon                          ico;                                                                                                          
    image/x-jng                           jng;                                                                                                          
    image/x-ms-bmp                        bmp;                                                                                                          
    image/svg+xml                         svg svgz;                                                                                                     
    image/webp                            webp;                                                                                                         
                                                                                                                                                        
    application/font-woff                 woff;                                                                                                         
    application/java-archive              jar war ear;                                                                                                  
    application/json                      json;                                                                                                         
    application/mac-binhex40              hqx;                                                                                                          
    application/msword                    doc;                                                                                                          
    application/pdf                       pdf;                                                                                                          
    application/postscript                ps eps ai;                                                                                                    
    application/rtf                       rtf;                                                                                                          
    application/vnd.apple.mpegurl         m3u8;                                                                                                         
    application/vnd.ms-excel              xls;                                                                                                          
    application/vnd.ms-fontobject         eot;                                                                                                          
    application/vnd.ms-powerpoint         ppt;                                                                                                          
    application/vnd.wap.wmlc              wmlc;                                                                                                         
    application/vnd.google-earth.kml+xml  kml;                                                                                                          
    application/vnd.google-earth.kmz      kmz;                                                                                                          
    application/x-7z-compressed           7z;                                                                                                           
    application/x-cocoa                   cco;                                                                                                          
    application/x-java-archive-diff       jardiff;                                                                                                      
    application/x-java-jnlp-file          jnlp;                                                                                                         
    application/x-makeself                run;                                                                                                          
    application/x-perl                    pl pm;                                                                                                        
    application/x-pilot                   prc pdb;                                                                                                      
    application/x-rar-compressed          rar;                                                                                                          
    application/x-redhat-package-manager  rpm;                                                                                                          
    application/x-sea                     sea;                                                                                                          
    application/x-shockwave-flash         swf;                                                                                                          
    application/x-stuffit                 sit;                                                                                                          
    application/x-tcl                     tcl tk;                                                                                                       
    application/x-x509-ca-cert            der pem crt;                                                                                                  
    application/x-xpinstall               xpi;                                                                                                          
    application/xhtml+xml                 xhtml;                                                                                                        
    application/xspf+xml                  xspf;                                                                                                         
    application/zip                       zip;                                                                                                          
                                                                                                                                                        
    application/octet-stream              bin exe dll;                                                                                                  
    application/octet-stream              deb;                                                                                                          
    application/octet-stream              dmg;                                                                                                          
    application/octet-stream              iso img;                                                                                                      
    application/octet-stream              msi msp msm;                                                                                                  
                                                                                                                                                        
    application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;                                                                    
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet          xlsx;                                                                    
    application/vnd.openxmlformats-officedocument.presentationml.presentation  pptx;                                                                    
                                                                                                                                                        
    audio/midi                            mid midi kar;                                                                                                 
    audio/mpeg                            mp3;                                                                                                          
    audio/ogg                             ogg;                                                                                                          
    audio/x-m4a                           m4a;                                                                                                          
    audio/x-realaudio                     ra;                                                                                                           
                                                                                                                                                        
    video/3gpp                            3gpp 3gp;                                                                                                     
    video/mp2t                            ts;                                                                                                           
    video/mp4                             mp4;                                                                                                          
    video/mpeg                            mpeg mpg;                                                                                                     
    video/quicktime                       mov;                                                                                                          
    video/webm                            webm;                                                                                                         
    video/x-flv                           flv;                                                                                                          
    video/x-m4v                           m4v;                                                                                                          
    video/x-mng                           mng;                                                                                                          
    video/x-ms-asf                        asx asf;                                                                                                      
    video/x-ms-wmv                        wmv;                                                                                                          
    video/x-msvideo                       avi;                                                                                                          
}                                                                                                                                                       
                                                                                                                                                        
# configuration file /etc/nginx/sites-enabled/provocah.com:                                                                                             
root /var/www/html;                                                                                                                                     
server {                                                                                                                                                
        listen 80;                                                                                                                                      
        server_name provocah.com www.provocah.com;                                                                                                      
                                                                                                                                                        
#       location /.well-known/acme-challenge/ {                                                                                                         
#               root /var/www/certbot;                                                                                                                  
#       }                                                                                                                                               
                                                                                                                                                        
        return 301 https://$server_name$request_uri;                                                                                                    
}                                                                                                                                                       
                                                                                                                                                        
server {                                                                                                                                                
        listen 443 ssl;                                                                                                                                 
        listen [::]:443 ssl;                                                                                                                            
        server_name provocah.com www.provocah.com;                                                                                                      
                                                                                                                                                        
        ssl_certificate /etc/letsencrypt/live/provocah.com/fullchain.pem;                                                                               
        ssl_certificate_key /etc/letsencrypt/live/provocah.com/privkey.pem;                                                                             
                                                                                                                                                        
#       ssl_protocols TLSv1 TLSv1.1 TLSv1.2;                                                                                                            
#       ssl_prefer_server_ciphers on;                                                                                                                   
#       ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;                                                                                                     
                                                                                                                                                        
        location / {                                                                                                                                    
                try_files $uri $uri/ /index.html;                                                                                                       
        }                                                                                                                                               
                                                                                                                                                        
        location /v1/ {                                                                                                                                 
                proxy_pass https://localhost:3000/v1/;                                                                                                  
                proxy_http_version 1.1;                                                                                                                 
                proxy_set_header Upgrade $http_upgrade;                                                                                                 
                proxy_set_header Connection 'upgrade';                                                                                                  
                proxy_set_header Host $host;                                                                                                            
                proxy_cache_bypass $http_upgrade;                                                                                                       
        }                                                                                                                                               
                                                                                                                                                        
#       location /.well-known/acme-challenge/ {                                                                                                         
#               root /var/www/certbot;                                                                                                                  
#       }                                                                                                                                               
                                                                                                                                                        
}

rg305 · January 29, 2024, 9:44pm

g-orgo:

#       location /.well-known/acme-challenge/ {                                                                                                         
#               root /var/www/certbot;                                                                                                                  
#       }                                                                                                                                               
                                                                                                                                                        
#       location /.well-known/acme-challenge/ {                                                                                                         
#               root /var/www/certbot;                                                                                                                  
#       }

Why did you remove those lines from your config?

g-orgo · January 29, 2024, 9:46pm

It seems to not work as intent, but i will active them and try to renew again to show you the results of it

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                                                               
Processing /etc/letsencrypt/renewal/provocah.com.conf                                                                                                         
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                                                               
Certificate is due for renewal, auto-renewing...                                                                                                              
Plugins selected: Authenticator webroot, Installer None                                                                                                       
Simulating renewal of an existing certificate for provocah.com and www.provocah.com                                                                           
Performing the following challenges:                                                                                                                          
http-01 challenge for provocah.com                                                                                                                            
http-01 challenge for www.provocah.com                                                                                                                        
Using the webroot path /usr/local/lsws/Example/html for all unmatched domains.                                                                                
Waiting for verification...                                                                                                                                   
Challenge failed for domain provocah.com                                                                                                                      
Challenge failed for domain www.provocah.com                                                                                                                  
http-01 challenge for provocah.com                                                                                                                            
http-01 challenge for www.provocah.com                                                                                                                        
                                                                                                                                                              
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:                                      
  Domain: provocah.com                                                                                                                                        
  Type:   unauthorized                                                                                                                                        
  Detail: 193.203.182.206: Invalid response from https://provocah.com/.well-known/acme-challenge/OcNvceQ67gNHBiJ_Fsqll56TbH8hbqlcK4HvWdVz98w: 404             
                                                                                                                                                              
  Domain: www.provocah.com                                                                                                                                    
  Type:   unauthorized                                                                                                                                        
  Detail: 193.203.182.206: Invalid response from https://provocah.com/.well-known/acme-challenge/ahw1-XATGPZgAHRBWYYx03zzkauJTDZVPdU1amh2IZc: 404             
                                                                                                                                                              
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from t
he provided --webroot-path/-w and that files created there can be downloaded from the internet.                                                               
                                                                                                                                                              
Cleaning up challenges                                                                                                                                        
Failed to renew certificate provocah.com with error: Some challenges have failed.                                                                             
                                                                                                                                                              
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                                                               
All simulated renewals failed. The following certificates could not be renewed:                                                                               
  /etc/letsencrypt/live/provocah.com/fullchain.pem (failure)                                                                                                  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                                                               
1 renew failure(s), 0 parse failure(s)                                                                                                                        
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for 
more details.

rg305 · January 29, 2024, 9:49pm

I don't think you enabled both of them.

That would have been HTTP.

Let's review the new config file:

`nginx -T`

g-orgo · January 29, 2024, 9:50pm

May i forget to return it?

root@provocah:~# nginx -T                                                                                                                                    
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok                                                                                             
nginx: configuration file /etc/nginx/nginx.conf test is successful                                                                                           
# configuration file /etc/nginx/nginx.conf:                                                                                                                  
user www-data;                                                                                                                                               
worker_processes auto;                                                                                                                                       
pid /run/nginx.pid;                                                                                                                                          
include /etc/nginx/modules-enabled/*.conf;                                                                                                                   
                                                                                                                                                             
events {                                                                                                                                                     
        worker_connections 768;                                                                                                                              
        # multi_accept on;                                                                                                                                   
}                                                                                                                                                            
                                                                                                                                                             
http {                                                                                                                                                       
                                                                                                                                                             
        ##                                                                                                                                                   
        # Basic Settings                                                                                                                                     
        ##                                                                                                                                                   
                                                                                                                                                             
        sendfile on;                                                                                                                                         
        tcp_nopush on;                                                                                                                                       
        types_hash_max_size 2048;                                                                                                                            
        # server_tokens off;                                                                                                                                 
                                                                                                                                                             
        # server_names_hash_bucket_size 64;                                                                                                                  
        # server_name_in_redirect off;                                                                                                                       
                                                                                                                                                             
        include /etc/nginx/mime.types;                                                                                                                       
        default_type application/octet-stream;                                                                                                               
                                                                                                                                                             
        ##                                                                                                                                                   
        # SSL Settings                                                                                                                                       
        ##                                                                                                                                                   
                                                                                                                                                             
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE                                                                           
        ssl_prefer_server_ciphers on;                                                                                                                        
                                                                                                                                                             
        ##                                                                                                                                                   
        # Logging Settings                                                                                                                                   
        ##                                                                                                                                                   
                                                                                                                                                             
        access_log /var/log/nginx/access.log;                                                                                                                
        error_log /var/log/nginx/error.log;                                                                                                                  
                                                                                                                                                             
        ##                                                                                                                                                   
        # Gzip Settings                                                                                                                                      
        ##                                                                                                                                                   
                                                                                                                                                             
        gzip on;                                                                                                                                             
                                                                                                                                                             
        # gzip_vary on;                                                                                                                                      
        # gzip_proxied any;                                                                                                                                  
        # gzip_comp_level 6;                                                                                                                                 
        # gzip_buffers 16 8k;                                                                                                                                
        # gzip_http_version 1.1;                                                                                                                             
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;               
                                                                                                                                                             
        ##                                                                                                                                                   
        # Virtual Host Configs                                                                                                                               
        ##                                                                                                                                                   
                                                                                                                                                             
        include /etc/nginx/conf.d/*.conf;                                                                                                                    
        include /etc/nginx/sites-enabled/*;                                                                                                                  
}                                                                                                                                                            
                                                                                                                                                             
                                                                                                                                                             
#mail {                                                                                                                                                      
#       # See sample authentication script at:                                                                                                               
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript                                                                                          
#                                                                                                                                                            
#       # auth_http localhost/auth.php;                                                                                                                      
#       # pop3_capabilities "TOP" "USER";                                                                                                                    
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";                                                                                                           
#                                                                                                                                                            
#       server {                                                                                                                                             
#               listen     localhost:110;                                                                                                                    
#               protocol   pop3;                                                                                                                             
#               proxy      on;                                                                                                                               
#       }                                                                                                                                                    
#                                                                                                                                                            
#       server {                                                                                                                                             
#               listen     localhost:143;                                                                                                                    
#               protocol   imap;                                                                                                                             
#               proxy      on;                                                                                                                               
#       }                                                                                                                                                    
#}                                                                                                                                                           
                                                                                                                                                             
# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip2.conf:                                                                                     
load_module modules/ngx_http_geoip2_module.so;                                                                                                               
                                                                                                                                                             
# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:                                                                               
load_module modules/ngx_http_image_filter_module.so;                                                                                                         
                                                                                                                                                             
# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:                                                                                
load_module modules/ngx_http_xslt_filter_module.so;                                                                                                          
                                                                                                                                                             
# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:                                                                                            
load_module modules/ngx_mail_module.so;                                                                                                                      
                                                                                                                                                             
# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:                                                                                          
load_module modules/ngx_stream_module.so;                                                                                                                    
                                                                                                                                                             
# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip2.conf:                                                                                   
load_module modules/ngx_stream_geoip2_module.so;                                                                                                             
                                                                                                                                                             
# configuration file /etc/nginx/mime.types:                                                                                                                  
                                                                                                                                                             
types {                                                                                                                                                      
    text/html                             html htm shtml;                                                                                                    
    text/css                              css;                                                                                                               
    text/xml                              xml;                                                                                                               
    image/gif                             gif;                                                                                                               
    image/jpeg                            jpeg jpg;                                                                                                          
    application/javascript                js;                                                                                                                
    application/atom+xml                  atom;                                                                                                              
    application/rss+xml                   rss;                                                                                                               
                                                                                                                                                             
    text/mathml                           mml;                                                                                                               
    text/plain                            txt;                                                                                                               
    text/vnd.sun.j2me.app-descriptor      jad;                                                                                                               
    text/vnd.wap.wml                      wml;                                                                                                               
    text/x-component                      htc;                                                                                                               
                                                                                                                                                             
    image/png                             png;                                                                                                               
    image/tiff                            tif tiff;                                                                                                          
    image/vnd.wap.wbmp                    wbmp;                                                                                                              
    image/x-icon                          ico;                                                                                                               
    image/x-jng                           jng;                                                                                                               
    image/x-ms-bmp                        bmp;                                                                                                               
    image/svg+xml                         svg svgz;                                                                                                          
    image/webp                            webp;                                                                                                              
                                                                                                                                                             
    application/font-woff                 woff;                                                                                                              
    application/java-archive              jar war ear;                                                                                                       
    application/json                      json;                                                                                                              
    application/mac-binhex40              hqx;                                                                                                               
    application/msword                    doc;                                                                                                               
    application/pdf                       pdf;                                                                                                               
    application/postscript                ps eps ai;                                                                                                         
    application/rtf                       rtf;                                                                                                               
    application/vnd.apple.mpegurl         m3u8;                                                                                                              
    application/vnd.ms-excel              xls;                                                                                                               
    application/vnd.ms-fontobject         eot;                                                                                                               
    application/vnd.ms-powerpoint         ppt;                                                                                                               
    application/vnd.wap.wmlc              wmlc;                                                                                                              
    application/vnd.google-earth.kml+xml  kml;                                                                                                               
    application/vnd.google-earth.kmz      kmz;                                                                                                               
    application/x-7z-compressed           7z;                                                                                                                
    application/x-cocoa                   cco;                                                                                                               
    application/x-java-archive-diff       jardiff;                                                                                                           
    application/x-java-jnlp-file          jnlp;                                                                                                              
    application/x-makeself                run;                                                                                                               
    application/x-perl                    pl pm;                                                                                                             
    application/x-pilot                   prc pdb;                                                                                                           
    application/x-rar-compressed          rar;                                                                                                               
    application/x-redhat-package-manager  rpm;                                                                                                               
    application/x-sea                     sea;                                                                                                               
    application/x-shockwave-flash         swf;                                                                                                               
    application/x-stuffit                 sit;                                                                                                               
    application/x-tcl                     tcl tk;                                                                                                            
    application/x-x509-ca-cert            der pem crt;                                                                                                       
    application/x-xpinstall               xpi;                                                                                                               
    application/xhtml+xml                 xhtml;                                                                                                             
    application/xspf+xml                  xspf;                                                                                                              
    application/zip                       zip;                                                                                                               
                                                                                                                                                             
    application/octet-stream              bin exe dll;                                                                                                       
    application/octet-stream              deb;                                                                                                               
    application/octet-stream              dmg;                                                                                                               
    application/octet-stream              iso img;                                                                                                           
    application/octet-stream              msi msp msm;                                                                                                       
                                                                                                                                                             
    application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;                                                                         
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet          xlsx;                                                                         
    application/vnd.openxmlformats-officedocument.presentationml.presentation  pptx;                                                                         
                                                                                                                                                             
    audio/midi                            mid midi kar;                                                                                                      
    audio/mpeg                            mp3;                                                                                                               
    audio/ogg                             ogg;                                                                                                               
    audio/x-m4a                           m4a;                                                                                                               
    audio/x-realaudio                     ra;                                                                                                                
                                                                                                                                                             
    video/3gpp                            3gpp 3gp;                                                                                                          
    video/mp2t                            ts;                                                                                                                
    video/mp4                             mp4;                                                                                                               
    video/mpeg                            mpeg mpg;                                                                                                          
    video/quicktime                       mov;                                                                                                               
    video/webm                            webm;                                                                                                              
    video/x-flv                           flv;                                                                                                               
    video/x-m4v                           m4v;                                                                                                               
    video/x-mng                           mng;                                                                                                               
    video/x-ms-asf                        asx asf;                                                                                                           
    video/x-ms-wmv                        wmv;                                                                                                               
    video/x-msvideo                       avi;                                                                                                               
}                                                                                                                                                            
                                                                                                                                                             
# configuration file /etc/nginx/sites-enabled/provocah.com:                                                                                                  
root /var/www/html;                                                                                                                                          
server {                                                                                                                                                     
        listen 80;                                                                                                                                           
        server_name provocah.com www.provocah.com;                                                                                                           
                                                                                                                                                             
        location /.well-known/acme-challenge/ {                                                                                                              
                root /var/www/certbot;                                                                                                                       
        }                                                                                                                                                    
                                                                                                                                                             
        return 301 https://$server_name$request_uri;                                                                                                         
}                                                                                                                                                            
                                                                                                                                                             
server {                                                                                                                                                     
        listen 443 ssl;                                                                                                                                      
        listen [::]:443 ssl;                                                                                                                                 
        server_name provocah.com www.provocah.com;                                                                                                           
                                                                                                                                                             
        ssl_certificate /etc/letsencrypt/live/provocah.com/fullchain.pem;                                                                                    
        ssl_certificate_key /etc/letsencrypt/live/provocah.com/privkey.pem;                                                                                  
                                                                                                                                                             
#       ssl_protocols TLSv1 TLSv1.1 TLSv1.2;                                                                                                                 
#       ssl_prefer_server_ciphers on;                                                                                                                        
#       ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;                                                                                                          
                                                                                                                                                             
        location / {                                                                                                                                         
                try_files $uri $uri/ /index.html;                                                                                                            
        }                                                                                                                                                    
                                                                                                                                                             
        location /v1/ {                                                                                                                                      
                proxy_pass https://localhost:3000/v1/;                                                                                                       
                proxy_http_version 1.1;                                                                                                                      
                proxy_set_header Upgrade $http_upgrade;                                                                                                      
                proxy_set_header Connection 'upgrade';                                                                                                       
                proxy_set_header Host $host;                                                                                                                 
                proxy_cache_bypass $http_upgrade;                                                                                                            
        }                                                                                                                                                    
                                                                                                                                                             
        location /.well-known/acme-challenge/ {                                                                                                              
                root /var/www/certbot;                                                                                                                       
        }                                                                                                                                                    
                                                                                                                                                             
}

Also, now if you try to curl it, it will return 404...

MikeMcQ · January 29, 2024, 10:08pm

g-orgo:

        location /.well-known/acme-challenge/ {                                                                                                              
                root /var/www/certbot;                                                                                                                       
        }

But, now that you have that enabled this is wrong. The webroot path should match the root folder in the nginx server block

Is that the path when you had a LiteSpeed server? Have you just updated to nginx?

Please post contents of this file

/etc/letsencrypt/renewal/provocah.com.conf

g-orgo · January 29, 2024, 10:21pm

Idk how to quote your questions but answering you asked by my LiteSpeed server:
Actually this system started with litespeed but i've change it to nginx, as i'm not that good at infra maybe i didn't change it to nginx in this config file...

Here's the file you asked for:

# renew_before_expiry = 30 days
version = 1.21.0
archive_dir = /etc/letsencrypt/archive/provocah.com
cert = /etc/letsencrypt/live/provocah.com/cert.pem
privkey = /etc/letsencrypt/live/provocah.com/privkey.pem
chain = /etc/letsencrypt/live/provocah.com/chain.pem
fullchain = /etc/letsencrypt/live/provocah.com/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = 8a1300a291d6931b81aa6a6be961cda5
authenticator = webroot
webroot_path = /usr/local/lsws/Example/html,
server = https://acme-v02.api.letsencrypt.org/directory
[[webroot_map]]
provocah.com = /usr/local/lsws/Example/html
www.provocah.com = /usr/local/lsws/Example/html

MikeMcQ · January 29, 2024, 10:48pm

The cert renewal profile still thinks you have LiteSpeed and its folder structure.

You can get a new cert and update this renewal profile with

sudo certbot certonly --dry-run --webroot -w /var/www/certbot -d provocah.com -d www.provocah.com

The above uses --dry-run to test. If the test works re-run the command without --dry-run to get a new cert and update the profile.

If test fails please post the error.

If you have not yet created your /var/www/certbot folder do that first.

g-orgo · January 30, 2024, 12:45am

It actually renewed the already existent certificate.

root@provocah:~# sudo certbot certonly --webroot -w /var/www/certbot -d provocah.com -d www.provocah.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for provocah.com and www.provocah.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/provocah.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/provocah.com/privkey.pem
This certificate expires on 2024-04-28.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

So i think i should change the path in my nginx config file, right?
Also my cert seems fine rn but my website keep saying it's not safe

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: provocah.com
    Serial Number: 49118c499e292b37b95db68b0febbd1db5d
    Key Type: RSA
    Domains: provocah.com www.provocah.com
    Expiry Date: 2024-04-28 23:41:58+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/provocah.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/provocah.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

rg305 · January 30, 2024, 1:08am

There is no need to change nginx anymore.

Please show the URL that is having that trouble.

g-orgo · January 30, 2024, 1:09am

I'm sorry, it's already solved; it seems like a cache problem; as i tested with a anonymous tab on chrome it worked just fine... but even when i deleted the site data in my chrome it just keep saying it's unsafe. But it's a chrome bug, it's solved

system · February 29, 2024, 1:10am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Certbot failed to authenticate, Invalid response Help	15	6801	December 17, 2022
Unable update certificate (maybe problem with Apache) Help	16	380	May 26, 2024
Renewal Problem webroot - Certbot failed to authenticate some domains (authenticator: webroot) - unauthorized Help	7	1345	December 14, 2022
Certbot renewal failure Help	7	534	December 8, 2020
Old user unable to renew cert Help	16	1479	April 10, 2022

Renew unauthorized (authenticator:webroot) temporary challenges files cannot be created

nginx -T

nginx -T

Related topics

`nginx -T`

`nginx -T`