I get the above error while trying to add my subdomains to the same certificate. This works fine when I uncheck the three subdomains however. Domains: arimil.com, fgo.arimil.com, files.arimil.com, wsdb.arimil.com Error: The client lacks sufficient authorization 2016-01-06 18:16:32,302:INFO:letsencr…

So I never solved this issue but today I backed up everything on my server and moved to debian 8. After setting everything up it worked on the first try.

Then you still didn’t get a successful letsencrypt client certificate? Only errors? Because it shouldn’t give a zName-error this time… Other errors, sure, could be… But no zName :stuck_out_tongue:

Let’s Encrypt adds a temporary vhost to your apache config in order to solve the tls-sni-01 challenge. For some reason, apache does not use this vhost when Let’s Encrypt is sending the request using the tls-sni-01 challenge host, but rather uses your other existing vhost(s). I’m not really sure wha…

[image] A server restart still uses the self-signed certificate, there were no errors. [code]2016-01-07 01:33:28,966:DEBUG:letsencrypt.cli:Root logging level set at 30 2016-01-07 01:33:28,967:INFO:letsencrypt.cli:Saving debug log to /var/log/letsencrypt/letsencrypt.log 2016-01-07 01:33:28,967:DE…

Well, if the client reports a “Congratulations”, you should have a valid certificate somewhere in /etc/letsencrypt/ You could check every cert.pem in the directories with openssl x509 -noout -text -in cert.pem and look at the Issuer as well as the X509v3 Subject Alternative Name information. (Becau…

[image] Renari: I've generated a privkey.pem and cert.pem like advised above. I then replaced the keys that were previously generated in /etc/letsencrypt/archive/arimil.com with the self-signed cert. This might be the reason you're still seeing your self-signed certificates. The files created…

[image] pfg: I would suggest deleting them and re-running letsencrypt We don't want @Renari to hit any rate limits now do we? :wink: I would recommend checking the /archive/ directory manually and fixing it manually..

Sure, but manually messing with files in /etc/letsencrypt caused this issue in the first place. He’s successfully generated one or two certificates so far, one more won’t hurt. --staging is still an option if rate limits are a concern. :wink:

[image] pfg: I'm not sure the client is able to handle cases where those symlinks were changed or replaced by actual files; those files shouldn't really be modified manually. These still are symbolic links, linking to the very location you specified. I tried removing them and then letsencrypt…

And in other directories in /archive/? Could you run find /etc/letsencrypt/archive/ to get a full listing of files? Because it could be that the client choose another domain as its “main” domain.

I’m not sure what happened there, but if you don’t have any Let’s Encrypt-issued certificates in /etc/letsencrypt/archive/ (check other directories in there too!), you’ll definitely need to re-run the client. It’s probably best if you first delete the self-signed certs (both the symlinks and archive…

The client lacks sufficient authorization on subdomains

Help

pfg January 7, 2016, 2:38am 26

Take a look at this thread, where OP was also serving HTTP on port 443:

Topic		Replies	Views
The server could not connect to the client to verify the domain Help	55	93409	February 2, 2018
Apache2 vhosts domain and subdomain certificate problems Help	46	13286	November 11, 2016
Trouble renewing certificate Help	6	3606	April 8, 2016
SSL on subdomain hosted on another server Help	11	3393	June 23, 2018
How to add new subdomain on my certificat Server	26	4651	July 15, 2017

The client lacks sufficient authorization on subdomains

Related topics