The problem I have seems directly related to: owner flag suggestion from 5 months ago but I haven’t been able to find any proper logical and long term resolution.
Dedicated Ubuntu 16.04 Apache install with default webroot /var/www/html/ for server abc123.domain.com.
The problem is .well-known is created but acme-challenge is missing - not created - and so the challenge file is also missing - not created.
The acme-challenge subdirectory of .well-known is deleted after the client has completed the challenge (no matter whether it’s been successful or not), so the fact that it’s missing is not conclusive - it’s likely failing because of something else.
I’d recommend trying to manually create the directory, putting a random file in there, and checking if you can browse to it from the public internet. Reviewing your apache access/error logs might also help.
Thank you for replying, and so fast.
I have already tried manually creating the acme-challenge folder and a test file inside - which is accessible so apparently not a dot-folder problem.
Nothing is showing in the system log if I am looking in the right place…
Could you try chown-ing .well-known to www-data:www-data? The file should generally be created with a mode that allows anyone to read it, but I seem to recall certain hardening features interfering with that if the owner doesn’t match the web server user. Unfortunately, I can’t seem to find the relevant thread right now, but chown should show if this is the case.
Attempted to reproduce this on a clean Ubuntu 16.04 image:
root@debug:~# apt-get update && apt-get upgrade && apt-get install apache2 python-letsencrypt
[...]
root@debug:~# letsencrypt certonly --webroot -w /var/www/html -d debug.example.com --staging
- Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/debug.example.com/fullchain.pem. Your cert will
expire on 2016-09-28. To obtain a new version of the certificate in
the future, simply run Let's Encrypt again.
My best guess is still some kind of hardening feature that’s interfering. Did you make any changes to your apache (or system) config that could be relevant here? Do you use something like mod_security? Any non-default AppArmor rules?
I am going to have to start from scratch tomorrow on this, though the related posts don’t fill me with confidence and I really don’t have time to reproduce this locally on a clean server… Damn.