# The client lacks sufficient authorization :: Invalid response scammell.co.uk

**URL:** <https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633>\
**Category:** Help\
**Created:** [May 23, 2018, 4:27pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633 "2018-05-23T16:27:00Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![lukescammell](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lukescammell/32/15244_2.png) [@lukescammell](https://community.letsencrypt.org/u/lukescammell)\
**Post date:** [May 23, 2018, 4:27pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/1 "2018-05-23T16:27:00Z")

</div>

Please help – thank you!

Interestingly enough, I have another domain on this server which renews just fine, so I’m obviously doing something wrong on this particular one. I’ve read lots and tried lots but have so far been unable to see what I’m doing wrong.

I can view files at the location specified.

Example: [http://scammell.co.uk/.well-known/acme-challenge/test.txt](http://scammell.co.uk/.well-known/acme-challenge/test.txt)

Thank you!

* * *

My domain is: [scammell.co.uk](http://scammell.co.uk)

I ran this command: `certbot renew --dry-run`

It produced this output:

```auto

-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/scammell.co.uk.conf
-------------------------------------------------------------------------------
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for scammell.co.uk
http-01 challenge for www.scammell.co.uk
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (scammell.co.uk) from /etc/letsencrypt/renewal/scammell.co.uk.conf produced an unexpected error: Failed authorization procedure. scammell.co.uk (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://scammell.co.uk/.well-known/acme-challenge/r59KeXZJcP2szS_CwC-Sr9sWoL8c1J_t3kR8BJs-gSE: "<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>", www.scammell.co.uk (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.scammell.co.uk/.well-known/acme-challenge/FMGcqIY0n9lQX9kxtiWg2Yy9kf8rPo_4Z7hoRj-lhXM: "<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>". Skipping.

```

My web server is (include version): nginx/1.13.12

The operating system my web server runs on is (include version): Ubuntu 16.04.1, 4.13.0-43-generic

My hosting provider, if applicable, is: Digital Ocean

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 23, 2018, 4:35pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/2 "2018-05-23T16:35:18Z")

</div>

Resolving [scammell.co.uk](http://scammell.co.uk) ([scammell.co.uk](http://scammell.co.uk))… 188.166.195.182, 2a03:b0c0:3:d0::54:f001

LE prefers IPv6 over IPv4 and I don’t think it falls back on IPv6 failures.  
Is your site (and the challenge directory) available by IPv6?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 23, 2018, 4:51pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/3 "2018-05-23T16:51:44Z")

</div>

Please show:  
`/etc/letsencrypt/renewal/scammell.co.uk.conf`  
and the vhost config that covers this domain name.

---

<div class="post-metadata">

**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\
**Post date:** [May 23, 2018, 4:56pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/4 "2018-05-23T16:56:00Z")

</div>

> [@lukescammell](#):
>
> Plugins selected: Authenticator webroot, Installer None

It looks like you are using the `webroot` authenticator, which tries to put the response file in a specific location on your filesystem so the webserver will serve it in response to the challenge. Is it possible you've moved directories around since you first issued the certificate? As @rg305 mentioned, you should check in `/etc/letsencrypt/renewal/scammell.co.uk.conf` and make sure the the configured webroot directory matches the directory where you just put `.well-known-acme-challenge/test.txt`.

You may also want to try switching to the Nginx plugin, which can manage things for you more automatically, like figuring out where to put the file, and reloading your webserver once the new certificate is available.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [May 23, 2018, 4:56pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/5 "2018-05-23T16:56:44Z")

</div>

> [@rg305](#):
>
> Is your site (and the challenge directory) available by IPv6?

@rg305's diagnosis seems exactly right to me. In IPv4 the test file returns a redirect to the HTTPS version of the site, which then returns "ugh". In IPv6, the test file returns a 404 error. So, the problem seems to be the discrepancy between the IPv4 and IPv6 versions of the site.

---

<div class="post-metadata">

**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\
**Post date:** [May 23, 2018, 4:59pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/6 "2018-05-23T16:59:27Z")

</div>

To add a little detail: If @rg305’s and @schoen’s theory is correct, the fix will be to add `[::]:443` to the listen directives of each of your virtual hosts that serves SSL/TLS. Or to remove the AAAA (IPv6) record from your DNS.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [May 23, 2018, 5:02pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/7 "2018-05-23T17:02:04Z")

</div>

Since the site returns an nginx default page in IPv6, it seems like the server is already fully IPv6-capable and the `[::]:443` solution should work fine.

---

<div class="post-metadata">

**Author:** ![lukescammell](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lukescammell/32/15244_2.png) [@lukescammell](https://community.letsencrypt.org/u/lukescammell)\
**Post date:** [May 23, 2018, 5:21pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/8 "2018-05-23T17:21:15Z")

</div>

I’m bowled over by the speed and quality of these responses. I’m travelling for the next couple of hours, but I’ll try this change as soon as I can. Thank you to everyone!

---

<div class="post-metadata">

**Author:** ![lukescammell](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lukescammell/32/15244_2.png) [@lukescammell](https://community.letsencrypt.org/u/lukescammell)\
**Post date:** [May 24, 2018, 11:40am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/9 "2018-05-24T11:40:26Z")

</div>

Okay, I tried the above options and there's no change.

I've replaced the webroot plugin with the nginx plugin and I have a functioning Let's Encrypt certificate again! However, I run into the same error when trying to renew that (the permissions error).

Here are some more details that were requested in the thread so far.

> [@rg305](#):
>
> Please show:  
> `/etc/letsencrypt/renewal/scammell.co.uk.conf`

```nohighlight
version = 0.17.0
archive_dir = /etc/letsencrypt/archive/scammell.co.uk
cert = /etc/letsencrypt/live/scammell.co.uk/cert.pem
privkey = /etc/letsencrypt/live/scammell.co.uk/privkey.pem
chain = /etc/letsencrypt/live/scammell.co.uk/chain.pem
fullchain = /etc/letsencrypt/live/scammell.co.uk/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = webroot
installer = None
account = 20bfe4dd01f2ae0b164f302d3af6cbf3
renew_hook = /usr/sbin/service nginx reload
[[webroot_map]]
scammell.co.uk = /var/www/scammell.co.uk/htdocs
www.scammell.co.uk = /var/www/scammell.co.uk/htdocs

```

You know what, I think there are enough reasons to completely rebuild this server, so I'm not going to take this any further. Thank you for your help so far everyone, I'm going to do a clean Ubuntu 18.04 LTS build on a fresh DO server and follow some best practices.

Any better guides than the slightly old [Set Up a DigitalOcean VPS for WordPress on Ubuntu 24.04](https://deliciousbrains.com/hosting-wordpress-setup-secure-virtual-server/) that you can recommend?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 23, 2018, 11:40am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response-scammell-co-uk/62633/10 "2018-06-23T11:40:26Z")

</div>

Closed on June 23, 2018, 11:40am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.