# \[SOLVED\] Certbot http-01 failure for second subdomain **URL:** \ **Category:** Help\ **Created:** [January 18, 2018, 4:32pm UTC](https://community.letsencrypt.org/t/solved-certbot-http-01-failure-for-second-subdomain/50782 "2018-01-18T16:32:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![nerder](https://avatars.discourse-cdn.com/v4/letter/n/65b543/32.png) [@nerder](https://community.letsencrypt.org/u/nerder)\ **Post date:** [January 18, 2018, 4:32pm UTC](https://community.letsencrypt.org/t/solved-certbot-http-01-failure-for-second-subdomain/50782/1 "2018-01-18T16:32:48Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [rshii.com](http://rshii.com) ([domain.google.com](http://domain.google.com) forwarded to subdomain [server.rshii.com](http://server.rshii.com) which is my web server) I ran this command: certbot --staging --nginx certbot --staging --authenticator webroot --installer nginx -d [admin.rshii.com](http://admin.rshii.com) certbot --staging --authenticator standalone --installer nginx -d [admin.rshii.com](http://admin.rshii.com) --pre-hook “systemctl stop nginx” --post-hook “systemctl start nginx” It produced this output: All of them result in: Failed authorization procedure. [admin.rshii.com](http://admin.rshii.com) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain My web server is (include version): nginx version: nginx/1.12.1 (Ubuntu) (running as a reverse proxy for apache in backend) Server version: Apache/2.4.27 (Ubuntu) The operating system my web server runs on is (include version): Ubuntu 17.10 My hosting provider, if applicable, is: N/A I can login to a root shell on my machine (yes or no, or I don’t know): Yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No **Additional Information:** I previously only had my webserver set up as [server.rshii.com](http://server.rshii.com) and was successful in obtaining a certificate, however I set up a secondary subdomain to [admin.rshii.com](http://admin.rshii.com) for a few other web applications. When running the certbot and including both domains [server.rshii.com](http://server.rshii.com) passes with tls but I still fail on [admin.rshii.com](http://admin.rshii.com) for http-01. Also, I have installed certbot from the ppa which is version 0.19 and also in the development version 0.22, both of which return the same results. **Nginx configuration:** server { listen 80; listen [::]:80; root /usr/share/nginx/html/; index index.php index.html index.htm; server\_name [server.rshii.com](http://server.rshii.com); location / { try\_files $uri $uri/ /index.php; } location ~ .php$ { proxy\_set\_header X-Real-IP $remote\_addr; proxy\_set\_header X-Forwarded-For $remote\_addr; proxy\_set\_header Host $host; proxy\_pass [http://127.0.0.1:8080](http://127.0.0.1:8080); } location ~ /.ht { deny all; } listen 443 ssl; # managed by Certbot ssl\_certificate /etc/letsencrypt/live/server.rshii.com/fullchain.pem; # managed by Certbot ssl\_certificate\_key /etc/letsencrypt/live/server.rshii.com/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl\_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot } server { listen 80; listen [::]:80; root /usr/share/nginx/management/; index index.php index.html index.htm; server\_name [admin.rshii.com](http://admin.rshii.com); location ~ /.well-known { root /usr/share/nginx/management/; allow all; } location / { try\_files $uri $uri/ /index.php; } location ~ .php$ { proxy\_set\_header X-Real-IP $remote\_addr; proxy\_set\_header X-Forwarded-For $remote\_addr; proxy\_set\_header Host $host; proxy\_pass [http://127.0.0.1:8081](http://127.0.0.1:8081); } location ~ /.ht { deny all; } } **My Apache2 configuration:** \ ServerAdmin webmaster@localhost DocumentRoot /usr/share/nginx/html/ LogLevel warn ErrorLog ${APACHE\_LOG\_DIR}/error.log CustomLog ${APACHE\_LOG\_DIR}/access.log combined \ ServerAdmin webmaster@localhost DocumentRoot /usr/share/nginx/management/ LogLevel warn ErrorLog ${APACHE\_LOG\_DIR}/management/error.log CustomLog ${APACHE\_LOG\_DIR}/management/access.log combined Not sure what else to include that can be of assistance at this moment. I’m using ddclient in a crontab for ensuring the [admin.rshii.com](http://admin.rshii.com) and [server.rshii.com](http://server.rshii.com) are my current ip address (which they are) ---
**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\ **Post date:** [January 18, 2018, 4:46pm UTC](https://community.letsencrypt.org/t/solved-certbot-http-01-failure-for-second-subdomain/50782/2 "2018-01-18T16:46:17Z")
Is there a firewall or anything blocking access to port 80 ( http ) ? I can access https but not http on your IP. ---
**Author:** ![nerder](https://avatars.discourse-cdn.com/v4/letter/n/65b543/32.png) [@nerder](https://community.letsencrypt.org/u/nerder)\ **Post date:** [January 18, 2018, 4:53pm UTC](https://community.letsencrypt.org/t/solved-certbot-http-01-failure-for-second-subdomain/50782/3 "2018-01-18T16:53:02Z")
Kinda weird, but its -semi- blocked? The ISP blocks the web traffic, but if I tcping it I can see it’s an open connection. I was able to issue the original certificate no problem with the same configuration ---
**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\ **Post date:** [January 18, 2018, 4:54pm UTC](https://community.letsencrypt.org/t/solved-certbot-http-01-failure-for-second-subdomain/50782/4 "2018-01-18T16:54:38Z")
You may find it easier using the DNS-01 challenge if the port is semi-blocked. I’m not getting enough of a connection to get a redirect to https ---
**Author:** ![nerder](https://avatars.discourse-cdn.com/v4/letter/n/65b543/32.png) [@nerder](https://community.letsencrypt.org/u/nerder)\ **Post date:** [January 18, 2018, 4:59pm UTC](https://community.letsencrypt.org/t/solved-certbot-http-01-failure-for-second-subdomain/50782/5 "2018-01-18T16:59:37Z")
Successfully installed the certificates. Thank you very much! For anyone who gets here with a similar issue, I used: certbot certonly --manual --preferred-challenges dns -d [server.rshii.com](http://server.rshii.com) -d [admin.rshii.com](http://admin.rshii.com) ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [January 18, 2018, 8:07pm UTC](https://community.letsencrypt.org/t/solved-certbot-http-01-failure-for-second-subdomain/50782/6 "2018-01-18T20:07:58Z")
> [@nerder](#): > > certbot certonly --manual --preferred-challenges dns -d [server.rshii.com](http://server.rshii.com) -d [admin.rshii.com](http://admin.rshii.com) Note that this doesn't work with automatic renewal via `certbot renew`. You'll need to repeat the `certonly` command at least every 90 days in order to obtain an updated certificate when using this method. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [February 17, 2018, 8:08pm UTC](https://community.letsencrypt.org/t/solved-certbot-http-01-failure-for-second-subdomain/50782/7 "2018-02-17T20:08:12Z")
Closed on February 17, 2018, 8:08pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.