# SSL renewal failing when using certbot renew

**URL:** <https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085>\
**Category:** Help\
**Created:** [March 19, 2024, 12:33am UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085 "2024-03-19T00:33:11Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ondra](https://avatars.discourse-cdn.com/v4/letter/o/da6949/32.png) [@Ondra](https://community.letsencrypt.org/u/Ondra)\
**Post date:** [March 19, 2024, 12:33am UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/1 "2024-03-19T00:33:11Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:  
dormmarket.cz

I ran this command:  
certbot renew

It produced this output:  
Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

Processing /etc/letsencrypt/renewal/www.dormmarket.cz.conf

* * *

Renewing an existing certificate for www.dormmarket.cz

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:

Domain: www.dormmarket.cz

Type: unauthorized

Detail: 62.72.32.119: Invalid response from [http://www.dormmarket.cz/.well-known/acme-challenge/xb1zkt4gTwj-D-gAYI6UauUd3tCUJVy6IpziKFXXw5A:](http://www.dormmarket.cz/.well-known/acme-challenge/xb1zkt4gTwj-D-gAYI6UauUd3tCUJVy6IpziKFXXw5A:) 404

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Failed to renew certificate www.dormmarket.cz with error: Some challenges have failed.

* * *

All renewals failed. The following certificates could not be renewed:

/etc/letsencrypt/live/www.dormmarket.cz/fullchain.pem (failure)

* * *

1 renew failure(s), 0 parse failure(s)

Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):  
nginx/1.18.0 (Ubuntu)

The operating system my web server runs on is (include version):  
Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-1107-kvm x86\_64)

My hosting provider, if applicable, is:  
Hostinger

I can login to a root shell on my machine (yes or no, or I don't know):  
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):  
no

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):  
certbot 2.9.0

My nginx .conf file:

```nohighlight
server {
    listen 80;
    server_name www.dormmarket.cz;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name www.dormmarket.cz;
    ssl_certificate /etc/letsencrypt/live/www.dormmarket.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.dormmarket.cz/privkey.pem; # managed by Certbot

    location / {
        proxy_pass http://62.72.32.119:8080;
    }
}

```

My DNS records

 ![Screenshot 2024-03-19 at 01.36.38](https://global.discourse-cdn.com/letsencrypt/original/3X/b/7/b7489b98e6c6140ea01e80fc9c300870c7b3d010.png)

---

<div class="post-metadata">

**Author:** ![Ondra](https://avatars.discourse-cdn.com/v4/letter/o/da6949/32.png) [@Ondra](https://community.letsencrypt.org/u/Ondra)\
**Post date:** [March 19, 2024, 12:41am UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/2 "2024-03-19T00:41:36Z")

</div>

![Screenshot 2024-03-19 at 01.38.13](https://global.discourse-cdn.com/letsencrypt/original/3X/7/7/776eef63a48d06e8d1fd667719d06ed549b80897.png)

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 19, 2024, 12:49am UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/3 "2024-03-19T00:49:17Z")

</div>

Are you sure nginx is listening on port 80?

Try `ss -tlpn src :80`

---

<div class="post-metadata">

**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\
**Post date:** [March 19, 2024, 3:15am UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/4 "2024-03-19T03:15:29Z")

</div>

This is what I see with `curl`

```nohighlight
$ curl -i http://www.dormmarket.cz/.well-known/acme-challenge/sometestfile
HTTP/1.1 404 Not Found
Content-Length: 0

```

```nohighlight
$ curl -i http://www.dormmarket.cz
HTTP/1.1 302 Found
Location: https://www.dormmarket.cz/website/index.html
Content-Length: 0

```

---

<div class="post-metadata">

**Author:** ![Ondra](https://avatars.discourse-cdn.com/v4/letter/o/da6949/32.png) [@Ondra](https://community.letsencrypt.org/u/Ondra)\
**Post date:** [March 19, 2024, 12:19pm UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/5 "2024-03-19T12:19:11Z")

</div>

This results in this output

```nohighlight
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process        
LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=75658,fd=6),("nginx",pid=75657,fd=6),("nginx",pid=75656,fd=6),("nginx",pid=75655,fd=6),("nginx",pid=75554,fd=6))

```

---

<div class="post-metadata">

**Author:** ![Ondra](https://avatars.discourse-cdn.com/v4/letter/o/da6949/32.png) [@Ondra](https://community.letsencrypt.org/u/Ondra)\
**Post date:** [March 19, 2024, 12:20pm UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/6 "2024-03-19T12:20:49Z")

</div>

Yes, i have a server running there that redirects calls to [https://www.dormmarket.cz/website/index.html](https://www.dormmarket.cz/website/index.html).

But when I do  
curl -i [http://www.dormmarket.cz/.well-known/acme-challenge/sometestfile](http://www.dormmarket.cz/.well-known/acme-challenge/sometestfile)  
I get this

```nohighlight
HTTP/1.1 301 Moved Permanently

**Server** : nginx/1.18.0 (Ubuntu)

**Date** : Tue, 19 Mar 2024 12:29:41 GMT

**Content-Type** : text/html

**Content-Length** : 178

**Connection** : keep-alive

**Location** : https://www.dormmarket.cz/.well-known/acme-challenge/sometestfile

<html>

<head><title>301 Moved Permanently</title></head>

<body>

<center><h1>301 Moved Permanently</h1></center>

<hr><center>nginx/1.18.0 (Ubuntu)</center>

</body>

</html>

```

Is there something I can do to make it work?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 19, 2024, 7:09pm UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/7 "2024-03-19T19:09:05Z")

</div>

I don't get the redirect.  
I get:

```nohighlight
curl -i http://www.dormmarket.cz/.well-known/acme-challenge/sometestfile
HTTP/1.1 404 Not Found
Content-Length: 0

```

---

<div class="post-metadata">

**Author:** ![Ondra](https://avatars.discourse-cdn.com/v4/letter/o/da6949/32.png) [@Ondra](https://community.letsencrypt.org/u/Ondra)\
**Post date:** [March 19, 2024, 11:21pm UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/8 "2024-03-19T23:21:23Z")

</div>

I see, and what can I do to make it work. Just return HTTP 200 when someone calls  
[http://www.dormmarket.cz/.well-known/acme-challenge/anything](http://www.dormmarket.cz/.well-known/acme-challenge/anything)

---

<div class="post-metadata">

**Author:** ![Ondra](https://avatars.discourse-cdn.com/v4/letter/o/da6949/32.png) [@Ondra](https://community.letsencrypt.org/u/Ondra)\
**Post date:** [March 20, 2024, 12:27am UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/9 "2024-03-20T00:27:39Z")

</div>

I have tried that and now I am getting this

```nohighlight
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: www.dormmarket.cz
  Type: unauthorized
  Detail: The key authorization file from the server did not match this challenge. Expected "Yq0Yw90IWPIcm1TB6ODO4Z_grYvo9-IIfBP5F_NBtLo.4Jl8s06zaEp9BDzRtfCICEb4H-kN1tH3vW6gZ3JnFn4" (got "")

```

I have also tried to pass this HTML but it is also not working.

```nohighlight
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

```

What should be returned, or how should i route that call?  
Should i make some changes in the DNS records or on the nginx configuration? I am a bit lost. I understand that there should some verification of the domain be happening, but what can i do?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 20, 2024, 2:39am UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/10 "2024-03-20T02:39:25Z")

</div>

> [@Ondra](#):
>
> I see, and what can I do to make it work.

My point was to show that we are getting two completely different replies.  
Are you connecting from the same network or over the Internet?

---

<div class="post-metadata">

**Author:** ![Ondra](https://avatars.discourse-cdn.com/v4/letter/o/da6949/32.png) [@Ondra](https://community.letsencrypt.org/u/Ondra)\
**Post date:** [March 20, 2024, 8:44pm UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/11 "2024-03-20T20:44:37Z")

</div>

I was executing if from the root server

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [March 20, 2024, 9:53pm UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/12 "2024-03-20T21:53:24Z")

</div>

> [@Ondra](#):
>
> was executing if from the root server

You should try from the public internet.

It looks like something is handling the HTTP requests before it reaches your nginx server. Is there any kind of firewall or other protection setup in your server? Or maybe with your hosting service?

Here are some example requests

```nohighlight
# An HTTP request is redirected but notice no "Server: nginx" response header
curl -i http://www.dormmarket.cz
HTTP/1.1 302 Found
Location: https://www.dormmarket.cz/website/index.html
Content-Length: 0

# An HTTPS request is also redirected but see "nginx/1.18.0 (Ubuntu)"
curl -i https://www.dormmarket.cz
HTTP/1.1 302 Found
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 20 Mar 2024 21:49:16 GMT
Content-Length: 0
Connection: keep-alive
Location: https://www.dormmarket.cz/website/index.html

# A test HTTP Challenge request is redirected wrong
# It is sent to "website/security.html" which is wrong
# It should do one of these two:
# Redirect but retain the URI "./well-known/acme-challenge/Test404"
# Or, it could just reply 404
curl -i http://www.dormmarket.cz/.well-known/acme-challenge/Test404
HTTP/1.1 302 Found
Location: https://www.dormmarket.cz/website/security.html
Content-Length: 0

```

This pattern of responses from your server usually indicate some sort of firewall or communications device inspecting and rejecting HTTP requests.

EDIT: OR,  
Do you have some kind of DNS URL redirect feature just for HTTP requests? Maybe related to some kind of "parking" setting?

---

<div class="post-metadata">

**Author:** ![Ondra](https://avatars.discourse-cdn.com/v4/letter/o/da6949/32.png) [@Ondra](https://community.letsencrypt.org/u/Ondra)\
**Post date:** [March 21, 2024, 12:46am UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/13 "2024-03-21T00:46:20Z")

</div>

> [@rg305](#):
>
> `.well-known/acme-challenge/`

Thanks a lot  
I think there was this type of problem. I have a screenshot of what I did

 ![Screenshot 2024-03-21 at 01.22.04](https://global.discourse-cdn.com/letsencrypt/original/3X/3/f/3f1550e8497682c7793c8b601a7accba20cf1ee8.png)  
I had to change to the recommended option in Hosting, for some reason it was on the second one and that was probably causing the error. Now I can say the certificate is renewed.  
Thanks a lot to all!!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [April 20, 2024, 12:47am UTC](https://community.letsencrypt.org/t/ssl-renewal-failing-when-using-certbot-renew/215085/14 "2024-04-20T00:47:12Z")

</div>

Closed on April 20, 2024, 12:47am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.