# The client lacks sufficient authorization

**URL:** <https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100>\
**Category:** Help\
**Created:** [May 21, 2019, 2:17pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100 "2019-05-21T14:17:22Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 2:17pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/1 "2019-05-21T14:17:22Z")

</div>

My domain is:  
[countomega.ddnsfree.com](http://countomega.ddnsfree.com)  
I ran this command:  
`certbot --apache`  
It produced this output:  
`Failed authorization procedure. countomega.ddnsfree.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://countomega.ddnsfree.com/.well-known/acme-challenge/jqpFcTDMVJrLrDrpAYHI8mHsEwTHHkSpfQazYxJT0FQ [93.212.153.143]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"`  
My web server is (include version):  
Apache/2.4.29 (Ubuntu)  
The operating system my web server runs on is (include version):  
Ubuntu 18.04.2 LTS  
My hosting provider, if applicable, is:  
Dynu  
I can login to a root shell on my machine (yes or no, or I don’t know):  
yes  
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):  
no  
The version of my client is:  
0.31.0  
I´m running a nextcloud 16.0 on my Rock64. Any help would be appriciated.

Thanks in advance

Count Omega

---

<div class="post-metadata">

**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\
**Post date:** [May 21, 2019, 2:42pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/2 "2019-05-21T14:42:40Z")

</div>

[https://letsdebug.net/countomega.ddnsfree.com/40097](https://letsdebug.net/countomega.ddnsfree.com/40097)  
[AAAANotWorking](https://letsdebug.net/countomega.ddnsfree.com/40097#AAAANotWorking-Error)

Error

[countomega.ddnsfree.com](http://countomega.ddnsfree.com) has an AAAA (IPv6) record (2003:ea:dbd6:ea00:646c:ebff:fe45:ddbb) but a test request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address. You should either ensure that validation requests to this domain succeed over IPv6, or remove its AAAA record.

Get [http://countomega.ddnsfree.com/.well-known/acme-challenge/letsdebug-test:](http://countomega.ddnsfree.com/.well-known/acme-challenge/letsdebug-test:) dial tcp [2003:ea:dbd6:ea00:646c:ebff:fe45:ddbb]:80: connect: permission denied

Trace:  
@0ms: Making a request to [http://countomega.ddnsfree.com/.well-known/acme-challenge/letsdebug-test](http://countomega.ddnsfree.com/.well-known/acme-challenge/letsdebug-test) (using initial IP 2003:ea:dbd6:ea00:646c:ebff:fe45:ddbb)  
@0ms: Dialing 2003:ea:dbd6:ea00:646c:ebff:fe45:ddbb  
@114ms: Experienced error: dial tcp [2003:ea:dbd6:ea00:646c:ebff:fe45:ddbb]:80: connect: permission denied

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 21, 2019, 2:54pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/3 "2019-05-21T14:54:05Z")

</div>

Hi @orangepizza :

the diagnose is correct. But curiously:

> [@CountOmega](#):
>
> Invalid response from [http://countomega.ddnsfree.com/.well-known/acme-challenge/jqpFcTDMVJrLrDrpAYHI8mHsEwTHHkSpfQazYxJT0FQ](http://countomega.ddnsfree.com/.well-known/acme-challenge/jqpFcTDMVJrLrDrpAYHI8mHsEwTHHkSpfQazYxJT0FQ) [93.212.153.143]:

There is no ipv6 address used.

Typical errors with a working ipv4 and a not working ipv6 have the ipv6 address in the error message.

Hi @CountOmega

did you add the ipv6 address later? I see the same like letsdebug - ipv6 timeouts ( [https://check-your-website.server-daten.de/?q=countomega.ddnsfree.com](https://check-your-website.server-daten.de/?q=countomega.ddnsfree.com) ):

| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://countomega.ddnsfree.com/](http://countomega.ddnsfree.com/) | | | | |
| 93.212.153.143 | 200 | | 0.123 | H |
| | | | | |
| • [http://countomega.ddnsfree.com/](http://countomega.ddnsfree.com/) | | | | |
| 2003:ea:dbd6:ea00:646c:ebff:fe45:ddbb | -14 | | 10.030 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [http://www.countomega.ddnsfree.com/](http://www.countomega.ddnsfree.com/) | | | | |
| 93.212.153.143 | 200 | | 0.126 | H |
| | | | | |
| • [http://www.countomega.ddnsfree.com/](http://www.countomega.ddnsfree.com/) | | | | |
| 2003:ea:dbd6:ea00:646c:ebff:fe45:ddbb | -14 | | 10.026 | T |
| Timeout - The operation has timed out | | | | |

So first step - remove your not working ipv6. Then try to find your DocumentRoot, then use it.

```nohighlight
certbot run -a webroot -i apache -w yourDocumentRoot -d countomega.ddnsfree.com

```

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 2:55pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/4 "2019-05-21T14:55:38Z")

</div>

Thank you for the quick reply. I´ll try this.

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 3:01pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/5 "2019-05-21T15:01:01Z")

</div>

I´ve removed the Ipv6 in the DDNS configuration, but I´m still getting the same error. The Document Root is `/var/ww/nextcloud`, right?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 21, 2019, 3:14pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/6 "2019-05-21T15:14:14Z")

</div>

> [@CountOmega](#):
>
> The Document Root is `/var/ww/nextcloud` , right?

I don't know. Check your config file.

Sometimes /var/www/nextcloud, sometimes /var/www or another directory.

Create the two subdirectories

```nohighlight
DocumentRoot/.well-known/acme-challenge

```

there a file (file name 1234), then try to load that file

```nohighlight
http://countomega.ddnsfree.com/.well-known/acme-challenge/1234

```

That must work.

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 3:33pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/7 "2019-05-21T15:33:49Z")

</div>

I´ve created the two directories earlier, but `ls` return empty. Permissions are set for 755.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 21, 2019, 3:35pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/8 "2019-05-21T15:35:19Z")

</div>

Then create a file and check, if you are able to see that file in your browser.

If not, the DocumentRoot is wrong.

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 3:53pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/9 "2019-05-21T15:53:25Z")

</div>

Firefox keeps saying security error. Somehow the site has the certificate from my brothers’ ddns running in the same network: `SSL_ERROR_BAD_CERT_DOMAIN`. I can´t explain how this happens.

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 5:17pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/10 "2019-05-21T17:17:40Z")

</div>

Skipping security via Edge gives me  
`Not Found`  
`The requested URL /.well-known/acme-challenge/1234 was not found on this server.`  
`Apache/2.4.25 (Raspbian) Server at countomega.ddnsfree.com Port 443`

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 21, 2019, 6:04pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/11 "2019-05-21T18:04:49Z")

</div>

> [@CountOmega](#):
>
> `The requested URL /.well-known/acme-challenge/1234 was not found on this server.`  
> `Apache/2.4.25 (Raspbian) Server at countomega.ddnsfree.com Port 443`

Why answers port 443? Do you have a redirect http -\> https?

There - [https://check-your-website.server-daten.de/?q=countomega.ddnsfree.com#url-checks](https://check-your-website.server-daten.de/?q=countomega.ddnsfree.com#url-checks) - is no redirect visible.

Or is this a home server with a wrong port forwarding, so port 80 extern -\> port 443 intern?

What says

```nohighlight
apachectl configtest
apachectl fullstatus
apachectl -S

```

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 6:12pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/12 "2019-05-21T18:12:40Z")

</div>

```
apachectl fullstatus
/usr/sbin/apachectl: 113: /usr/sbin/apachectl: www-browser: not found
'www-browser -dump http://localhost:80/server-status' failed.
Maybe you need to install a package providing www-browser or you
need to adjust the APACHE_LYNX variable in /etc/apache2/envvars

apachectl -S
VirtualHost configuration:
*:80 countomega.ddnsfree.com (/etc/apache2/sites-enabled/000-default.conf:1)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex watchdog-callback: using_defaults
Mutex rewrite-map: using_defaults
Mutex default: dir="/var/run/apache2/" mechanism=default
Mutex mpm-accept: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33
Group: name="www-data" id=33
```

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 6:13pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/13 "2019-05-21T18:13:33Z")

</div>

i have the permanent redirect on the .conf commented.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 21, 2019, 6:15pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/14 "2019-05-21T18:15:05Z")

</div>

There is your document root.

> [@CountOmega](#):
>
> Main DocumentRoot: "/var/www/html"

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 9:04pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/15 "2019-05-21T21:04:33Z")

</div>

I created the directories and an 1234 fille, yet I´m still getting

```
The requested URL /.well-known/acme-challenge/1234 was not found on this server.
Apache/2.4.25 (Raspbian) Server at countomega.ddnsfree.com Port 443

```

. Entering port 80 now gets me an 500 error.

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 9:10pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/16 "2019-05-21T21:10:24Z")

</div>

I think i found the error:  
`/var/www/nextcloud/.htaccess: php_value takes two arguments, PHP Value Modifier`  
In .htaccess:  
`<IfModule mod_php7.c>`  
`php_value mbstring.func_overload 0`  
`php_value default_charset 'UTF-8'`  
`php_value output_buffering 0`  
`php_value upload_max_filesize`  
`php_value post_max_size`  
`<IfModule mod_env.c>`  
I once edited it in order to set the up/download filesize. Do I have to change it?

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 9:17pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/17 "2019-05-21T21:17:54Z")

</div>

That fixed apache errors and nextcloud runs again, but am still getting  
`The client lacks sufficient authorization` etc.

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 21, 2019, 9:19pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/18 "2019-05-21T21:19:09Z")

</div>

And still getting `The requested URL /.well-known/acme-challenge/1234 was not found on this server.`

---

<div class="post-metadata">

**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\
**Post date:** [May 21, 2019, 9:29pm UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/19 "2019-05-21T21:29:44Z")

</div>

can you access that file from the internet?

---

<div class="post-metadata">

**Author:** ![CountOmega](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/countomega/32/32013_2.png) [@CountOmega](https://community.letsencrypt.org/u/CountOmega)\
**Post date:** [May 22, 2019, 7:07am UTC](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100/20 "2019-05-22T07:07:52Z")

</div>

No.I still can’t access it.

[Next page](https://community.letsencrypt.org/t/the-client-lacks-sufficient-authorization/94100.md?page=2)