I’m running a Raspberry Pi 3 as webserver since December 2016: Raspbian (‘Jessie’), Nginx, PHP7, MariaDB, DynDNS already setup, ssh enabled, root rights, …
I created configuration files including server blocks at /etc/nginx/sites-available
server {
listen 80 default_server;
listen [::]:80 default_server;
# SSL configuration
#
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
ssl_protocols TLSv1.2;
ssl_ciphers EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers On;
ssl_certificate /etc/letsencrypt/live/nx1.benjamintauscher.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/nx1.benjamintauscher.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/nx1.benjamintauscher.com/chain.pem;
ssl_session_cache shared:SSL:128m;
ssl_stapling on;
ssl_stapling_verify on;
# Force https, also on subdomains
add_header Strict-Transport-Security "max-age=31557600; includeSubDomains";
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Xss-Protection "1";
root /var/www/nx1.benjamintauscher.com/html;
# Add index.php to the list if you are using PHP
index index.php index.html index.htm index.nginx-debian.html;
server_name nx1.benjamintauscher.com www.nx1.benjamintauscher.com;
location ^~ /.well-known/acme-challenge/ {
allow all;
}
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
# pass PHP scripts to FastCGI server
#
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
# include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
fastcgi_index index.php;
include fastcgi.conf;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#} }
They are identical (except from subdomains).
Certificate for subdomain nx2 was renewed without any problem – also force renewals worked fine. I’m for some reason not able to renew the certs for nx1.
Actually I guess that authentification could be the cause of the problem, but I have no idea why.
There also exists a server block file default in /etc/nginx/sites-available beeing identical to nx1.benjamintauscher.com at the same directory.
Processing /etc/letsencrypt/renewal/nx1.benjamintauscher.com.conf
Cert is due for renewal, auto-renewing...
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for nx1.benjamintauscher.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert from /etc/letsencrypt/renewal/nx1.benjamintauscher.com.conf produced an unexpected error: Failed authorization procedure. nx1.benjamintauscher.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://nx1.benjamintauscher.com/.well-known/acme-challenge/ZGPidlPALYRtmKQ7-JbdaObqcXBXa3S69itWdcgy_QA: "404 Not Found". Skipping.
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: nx1.benjamintauscher.com
Type: unauthorized
Detail: Invalid response from
http://nx1.benjamintauscher.com/.well-known/acme-challenge/ZGPidlPALYRtmKQ7-JbdaObqcXBXa3S69itWdcgy_QA:
"404 Not Found"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
- The following errors were reported by the server:
Domain: nx1.benjamintauscher.com
Type: unauthorized
Detail: Invalid response from
http://nx1.benjamintauscher.com/.well-known/acme-challenge/wviLrh2zYVEhwsl57AhzDVbNAFd8jB7hsErXcyZErT0:
"404 Not Found"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
My operating system is (include version): Debian 8 (raspberry pi)
My web server is (include version): Nginx 1.10.2
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
Can you be more specific please? What information would be helpful for you?
Could you please show the content of files /etc/letsencrypt/renewal/nx1.benjamintauscher.com.conf and /etc/letsencrypt/renewal/nx2.benjamintauscher.com.conf ?.
Also, create a test file inside .well-known/acme-challenge/ dir and try to get it.
echo "This is a test" > /var/www/nx1.benjamintauscher.com/html/.well-known/acme-challenge/test
The [[webroot_map]] paremeters for nx1.benjamintauscher.com were not correct. I just re-configured the mapping, the renewal process worked perfectly fine after that.
I noticed that the certificate for nx1.benjamintauscher.com is still going to expire beginning of March. I repeated sudo certbot renew but still no effect. I also tried sudo certbot renew --force-renew but the result did not change:
CRT ID DOMAIN (CN) VALID FROM VALID TO EXPIRES IN SANs
94636395 nx1.benjamintauscher.com 2017-Feb-19 14:22 CET 2017-May-20 15:22 CEST 88 days nx1.benjamintauscher.com
94636374 nx1.benjamintauscher.com 2017-Feb-19 14:22 CET 2017-May-20 15:22 CEST 88 days nx1.benjamintauscher.com
www.nx1.benjamintauscher.com
Are you sure you have restarted/reload your nginx server?. If you did it, show us the result of these commands: