I started with letsencrypt before there was an ubuntu package of certbot (i.e. previously using letsencrypt_auto). I've recently upgraded to use certbot (version 0.23.0 on ubuntu 18.04), but now renew is failing. I'm using the Apache plugin.
From poking around it looks as though the Apache config is being updated to serve .well-known/acme-challenge/... from /var/lib/letsencrypt/http_challenges, which is fine except it seems my redirect to https is happening first, so the result is a 404.
please answer the following questions (template in Help ):
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
I ran this command:
It produced this output:
My web server is (include version):
The operating system my web server runs on is (include version):
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
It produced this output: Attempting to renew cert (alsdiary.org) from /etc/letsencrypt/renewal/alsdiary.org.conf produced an unexpected error: Failed authorization procedure. alsdiary.org (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from https://alsdiary.org/.well-known/acme-challenge/j-o_KAnVLIk5_WKVksXsFrIJ5tfErPudurIplF2rwvk [206.189.123.47]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p". Skipping.
My web server is (include version): Apache 2.4.29
The operating system my web server runs on is (include version): Ubuntu 18.04
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): 0.23.0
$ certbot renew --dry-run
Attempting to renew cert (alsdiary.org) from
/etc/letsencrypt/renewal/alsdiary.org.conf produced an unexpected error:
Failed authorization procedure. alsdiary.org (http-01):
urn:ietf:params:acme:error:unauthorized ::
The client lacks sufficient authorization ::
Invalid response from https://alsdiary.org/.well-known/acme-challenge/0rxu5DvuGvYP059tzj2-T9-JYtvM3lvOv9tFvejMv0k [206.189.123.47]:
"<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p".
Skipping.
The following certs could not be renewed:
/etc/letsencrypt/live/alsdiary.org/fullchain.pem (failure)
It still looks as though the Apache config is being updated to serve .well-known/acme-challenge/… from /var/lib/letsencrypt/http_challenges, which is fine except it seems my redirect to https is happening first, so the result is a 404 (because the https site doesn’t have the same config update)
Now it seems that certbot certonly -a webroot -w /web/root -d alsdiary.org -d www.alsdiary.org --dry-run works OK, so perhaps I have a workaround.
Yep, now your two connections use the same certificate with two domain names:
CN=alsdiary.org
16.02.2019
17.05.2019
expires in 90 days alsdiary.org, www.alsdiary.org - 2 entries
You have a brand-new certificate, so you can ignore the error.
And in two months, instead of
use
certbot run -a webroot -w /web/root -d alsdiary.org -d www.alsdiary.org -i apache
one time, then your config file should be new. Perhaps now your config file has the old values. More then one vHost with the same name is sometimes a problem.