# The client lacks sufficient authorization :: Invalid response

**URL:** <https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028>\
**Category:** Server\
**Created:** [February 3, 2017, 2:39am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028 "2017-02-03T02:39:10Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![ren-kun](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@ren-kun](https://community.letsencrypt.org/u/ren-kun)\
**Post date:** [February 3, 2017, 2:39am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/1 "2017-02-03T02:39:10Z")

</div>

Hello everyone,

I’ve been chipping away but with no luck.

I get The client lacks sufficient authorization :: Invalid response error when trying to activate lets encrypt

* * *

Error: Let’s Encrypt SSL certificate installation failed: Failed letsencrypt execution: Saving debug log to /opt/psa/var/modules/letsencrypt/logs/letsencrypt.log  
Obtaining a new certificate  
Performing the following challenges:  
http-01 challenge for [grayles.net](http://grayles.net)  
Waiting for verification…  
Cleaning up challenges  
Failed authorization procedure. [grayles.net](http://grayles.net) (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://grayles.net/.well-known/acme-challenge/4aEq2RTYSg-W0wBD7QIZUYPt0mL-e3wN7bqj2vLiHsE:](http://grayles.net/.well-known/acme-challenge/4aEq2RTYSg-W0wBD7QIZUYPt0mL-e3wN7bqj2vLiHsE:) "\<!DOCTYPE HTML PUBLIC “-//IETF//DTD HTML 2.0//EN”\>  
\<html\>\<head\>  
\<title\>404 Not Found\</title\>  
\</head\>\<body\>  
\<h1\>Not Found\</h1\>  
\<p"  
IMPORTANT NOTES:

- The following errors were reported by the server:

Domain: [grayles.net](http://grayles.net)  
Type: unauthorized  
Detail: Invalid response from  
[http://grayles.net/.well-known/acme-challenge/4aEq2RTYSg-W0wBD7QIZUYPt0mL-e3wN7bqj2vLiHsE:](http://grayles.net/.well-known/acme-challenge/4aEq2RTYSg-W0wBD7QIZUYPt0mL-e3wN7bqj2vLiHsE:)  
"\<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"\>  
\<html\>\<head\>  
\<title\>404 Not Found\</title\>  
\</head\>\<body\>  
\<h1\>Not Found\</h1\>  
\<p"

To fix these errors, please make sure that your domain name was  
entered correctly and the DNS A record(s) for that domain  
contain(s) the right IP address.

* * *

Now i assure you i can access the directory [http://grayles.net/.well-known/acme-challenge](http://grayles.net/.well-known/acme-challenge) AND i have a valid A record as well.

What do i do?

Many thanks for your help.

Pan

---

<div class="post-metadata">

**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\
**Post date:** [February 3, 2017, 7:48am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/2 "2017-02-03T07:48:52Z")

</div>

Hi Pan,

What command are you running ?

If you create a simple text file with “OK” in it at webroot/.well-known/acme-challenge/test

can you reach it OK in the browser ?

---

<div class="post-metadata">

**Author:** ![ren-kun](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@ren-kun](https://community.letsencrypt.org/u/ren-kun)\
**Post date:** [February 3, 2017, 9:23am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/3 "2017-02-03T09:23:45Z")

</div>

Hello! I am just running the letsencrypt extension.

You can see the OK txt file here:

[http://grayles.net/.well-known/acme-challenge/ok.txt](http://grayles.net/.well-known/acme-challenge/ok.txt)

---

<div class="post-metadata">

**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\
**Post date:** [February 3, 2017, 9:24am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/4 "2017-02-03T09:24:41Z")

</div>

Thanks - can you create the file without an extension please ( so no .txt on the end ) … just to check. Thanks.

---

<div class="post-metadata">

**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\
**Post date:** [February 3, 2017, 9:26am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/5 "2017-02-03T09:26:58Z")

</div>

> [@ren-kun](#):
>
> Hello! I am just running the letsencrypt extension.

I'm asking for a little more detail please. The "letsencrypt extension" in another package such as plesk ? or are you running it from the command line - if so, what exact command.

---

<div class="post-metadata">

**Author:** ![ren-kun](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@ren-kun](https://community.letsencrypt.org/u/ren-kun)\
**Post date:** [February 3, 2017, 9:40am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/6 "2017-02-03T09:40:55Z")

</div>

Hello,

Ah my apologies! .

The answer to that would be, yes I’m using plesk 12.5 to launch the extension.

---

<div class="post-metadata">

**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\
**Post date:** [February 3, 2017, 9:42am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/7 "2017-02-03T09:42:40Z")

</div>

OK, thanks for that. Can you tell me when you have changed the test file to remove the .txt extension please.

---

<div class="post-metadata">

**Author:** ![ren-kun](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@ren-kun](https://community.letsencrypt.org/u/ren-kun)\
**Post date:** [February 3, 2017, 9:45am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/8 "2017-02-03T09:45:00Z")

</div>

Hello,

Yup done. the address is:

[http://grayles.net/.well-known/acme-challenge/ok](http://grayles.net/.well-known/acme-challenge/ok)

---

<div class="post-metadata">

**Author:** ![preetham](https://avatars.discourse-cdn.com/v4/letter/p/f9ae1b/32.png) [@preetham](https://community.letsencrypt.org/u/preetham)\
**Post date:** [February 3, 2017, 11:17am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/9 "2017-02-03T11:17:03Z")

</div>

Hi,

I got the same kinda error while generating certificate. I use ftp to create challenge file in my domain. The .well-known/acme-challenge/ directory is created in my domain, but i cant reach this challenge file from [http://www.iconectivteam.com/.well-known/acme-challenge/](http://www.iconectivteam.com/.well-known/acme-challenge/). It throws 404 error. May i konw what could be the reason for this. Why it cant be reached. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\
**Post date:** [February 4, 2017, 8:55am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/10 "2017-02-04T08:55:19Z")

</div>

come on @preetham @MikeRob gave you a good clue in your original post

follow that track

---

<div class="post-metadata">

**Author:** ![MikeRob](https://avatars.discourse-cdn.com/v4/letter/m/91b2a8/32.png) [@MikeRob](https://community.letsencrypt.org/u/MikeRob)\
**Post date:** [February 4, 2017, 2:01pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/11 "2017-02-04T14:01:28Z")

</div>

As I said “in that track,” the Apache configuration files must _tell Apache_ that a particular URL-location is to be served, as well as where (on the host system) the content is to come from. &nbsp; If Apache has not been given this information, it might respond in either one of two ways: &nbsp; (1)_Forbidden,_ or (2) ;a seraphically innocent blank stare … _“File? &nbsp; What file?”_ &nbsp; (404 Not Found).

---

<div class="post-metadata">

**Author:** ![ren-kun](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@ren-kun](https://community.letsencrypt.org/u/ren-kun)\
**Post date:** [February 7, 2017, 9:17am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/12 "2017-02-07T09:17:55Z")

</div>

Hello, Sorry to bump. @serverco what is my next step?

---

<div class="post-metadata">

**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\
**Post date:** [February 7, 2017, 9:24am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/13 "2017-02-07T09:24:46Z")

</div>

Are you still getting the same error when you try and run this from plesk ?

It looks as if there are a number of [issues with the plesk plugin](https://github.com/plesk/letsencrypt-plesk/issues). Since everything else looks OK on your site for obtaining a certificate I’d suggest using a different client (or raising an issue with plesk )

---

<div class="post-metadata">

**Author:** ![ren-kun](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@ren-kun](https://community.letsencrypt.org/u/ren-kun)\
**Post date:** [February 7, 2017, 9:33am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/14 "2017-02-07T09:33:43Z")

</div>

Hey! Thanks for the quick reply. I guess I will ask on PLESK forums. My provider wont give me their plesk number so I can’t get any real support. If i ask them for help I get mixed replies, sometimes they say they can’t help me and sometimes they try? I don’t know how I am going to get help though, I have a feeling that they will just say “ask Lets-encrypt”

Though, thanks man for all your help!

---

<div class="post-metadata">

**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\
**Post date:** [February 7, 2017, 9:36am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/15 "2017-02-07T09:36:19Z")

</div>

You’re welcome - sorry I couldn’t fix it fully. There are other methods that can be used ( other than the plesk-letsencrypt plugin ) to obtain the cert though, so if you get no luck with Plesk, let us knnow and we’ll go through alternatives methods.

---

<div class="post-metadata">

**Author:** ![ren-kun](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@ren-kun](https://community.letsencrypt.org/u/ren-kun)\
**Post date:** [February 7, 2017, 9:39am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/16 "2017-02-07T09:39:33Z")

</div>

Oh and for your curiosity. I tried one more time. It gave me a new error! (hahaah this is terrible)

```
Error: Let's Encrypt SSL certificate installation failed: Failed letsencrypt execution: Saving debug log to /opt/psa/var/modules/letsencrypt/logs/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for grayles.net
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. grayles.net (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://grayles.net/.well-known/acme-challenge/ie6JWqVqWKg5F2qsRp2797pkT9vLRnEi24oN9nWGdwc: &quot;&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML 2.0//EN&quot;&gt;
&lt;html&gt;&lt;head&gt;
&lt;title&gt;404 Not Found&lt;/title&gt;
&lt;/head&gt;&lt;body&gt;
&lt;h1&gt;Not Found&lt;/h1&gt;
&lt;p&quot;
IMPORTANT NOTES:
 The following errors were reported by the server:

Domain: grayles.net
Type: unauthorized
Detail: Invalid response from
http://grayles.net/.well-known/acme-challenge/ie6JWqVqWKg5F2qsRp2797pkT9vLRnEi24oN9nWGdwc:
&quot;&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML 2.0//EN&quot;&gt;
&lt;html&gt;&lt;head&gt;
&lt;title&gt;404 Not Found&lt;/title&gt;
&lt;/head&gt;&lt;body&gt;
&lt;h1&gt;Not Found&lt;/h1&gt;
&lt;p&quot;

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
```

---

<div class="post-metadata">

**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\
**Post date:** [February 7, 2017, 9:50am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/17 "2017-02-07T09:50:10Z")

</div>

This is essentially the same error.

Each time you try and validate your domain, you will get a new “token” which should be placed in the .well-known/acme-challenge folder.

I this case the “token” was ie6JWqVqWKg5F2qsRp2797pkT9vLRnEi24oN9nWGdwc and again it couldn’t be reached at [http://grayles.net/.well-known/acme-challenge/ie6JWqVqWKg5F2qsRp2797pkT9vLRnEi24oN9nWGdwc](http://grayles.net/.well-known/acme-challenge/ie6JWqVqWKg5F2qsRp2797pkT9vLRnEi24oN9nWGdwc) (there was a 404 error - file not found)

There is a slight error on your DNS - see [http://dnsviz.net/d/grayles.net/dnssec/](http://dnsviz.net/d/grayles.net/dnssec/) which would be worth correcting, but I don’t think this DNS issue is causing your problem.

---

<div class="post-metadata">

**Author:** ![ren-kun](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@ren-kun](https://community.letsencrypt.org/u/ren-kun)\
**Post date:** [February 7, 2017, 9:53am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/18 "2017-02-07T09:53:27Z")

</div>

Yeah… _SIGH_

I will come back once i exhaust help from PLESK forums!

Thanks once again \<3

---

<div class="post-metadata">

**Author:** ![ren-kun](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@ren-kun](https://community.letsencrypt.org/u/ren-kun)\
**Post date:** [February 10, 2017, 5:14am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/19 "2017-02-10T05:14:12Z")

</div>

Hello,

So PLESK forums didn’t help at all. I would buy a license just for support but its beyond my budget.

Does anyone know if there are other ways i can get a SSL?

* * *

So i found this site [https://www.sslforfree.com/](https://www.sslforfree.com/)

I followed the steps to the letter, but now i got a new issue

[https://grayles.net/](https://grayles.net/)

Secure Connection Failed

```
An error occurred during a connection to grayles.net. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
```

---

<div class="post-metadata">

**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\
**Post date:** [February 10, 2017, 9:07am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028/20 "2017-02-10T09:07:29Z")

</div>

Your configuration is incorrect. You are sending http not https on port 443 ( you can test using [http://grayles.net:443](http://grayles.net:443) )

I’m guessing you haven’t got a “SSLEngine on” in your config for port 443.

[Next page](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization-invalid-response/27028.md?page=2)