# Unable to create SSL certificate for my domain

**URL:** <https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083>\
**Category:** Help\
**Created:** [July 5, 2021, 7:25am UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083 "2021-07-05T07:25:26Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![shrawan.lal](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shrawan.lal/32/88552_2.png) [@shrawan.lal](https://community.letsencrypt.org/u/shrawan.lal)\
**Post date:** [July 5, 2021, 7:25am UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/1 "2021-07-05T07:25:26Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:www.barkatstravelcrafters.com

I ran this command: sudo certbot --nginx --agree-tos -n -d [www.barkatstravelcrafters.com](http://www.barkatstravelcrafters.com)

It produced this output:  
Failed authorization procedure. [www.barkatstravelcrafters.com](http://www.barkatstravelcrafters.com) (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: During secondary validation: Invalid response from [https://www.barkatstravelcrafters.com/.well-known/acme-challenge/9hEj\_HfQimKkDMHr38ntlU7q-mUYEpzZolRdaexYtGE](https://www.barkatstravelcrafters.com/.well-known/acme-challenge/9hEj_HfQimKkDMHr38ntlU7q-mUYEpzZolRdaexYtGE) [3.6.147.154]: "\<!doctype html\>\<html lang="en"\>\<meta charset="utf-8"/\>\<link rel="shortcut icon" href="/android-icon-96x96.png"/\>\<meta name"

IMPORTANT NOTES:

- The following errors were reported by the server:

My web server is (include version): Nginx nginx/1.10.3

The operating system my web server runs on is (include version): Debian GNU/Linux 9.5 (stretch)

My hosting provider, if applicable, is: NA

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):

---

<div class="post-metadata">

**Author:** ![JamesLE](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jamesle/32/49364_2.png) [@JamesLE](https://community.letsencrypt.org/u/JamesLE)\
**Post date:** [July 5, 2021, 8:32pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/2 "2021-07-05T20:32:12Z")

</div>

3 posts were split to a new topic: [Renew the certificate for my mail server](https://community.letsencrypt.org/t/renew-the-certificate-for-my-mail-server/155147)

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 5, 2021, 4:46pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/3 "2021-07-05T16:46:08Z")

</div>

Hi @shrawan.lal, and welcome to the LE community forum 🙂

Your config is not handling the challenge requests as expected.  
When using `--nginx` it should have automatically handled the request within HTTP.  
But we see the failed request is via HTTPS; which means it was redirected (and not handled correctly).  
Please show us the `nginx` config with the output of:  
`sudo nginx -T`

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 5, 2021, 4:54pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/4 "2021-07-05T16:54:57Z")

</div>

It seems you were able to obtain a cert:  
[crt.sh | www.barkatstravelcrafters.com](https://crt.sh/?Identity=www.barkatstravelcrafters.com&deduplicate=Y)

---

<div class="post-metadata">

**Author:** ![shrawan.lal](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shrawan.lal/32/88552_2.png) [@shrawan.lal](https://community.letsencrypt.org/u/shrawan.lal)\
**Post date:** [July 9, 2021, 1:40pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/5 "2021-07-09T13:40:40Z")

</div>

The again same issue coming up for [www.urtripventure.com](http://www.urtripventure.com). Below is my Ngnix Conf file.  
Same error coming again and again for my different website also, But by trying multiple times it gets resolved automatically. Not sure what is the issue. Thanks in Advance.

server {  
listen 80;  
server\_name [urtripventure.com](http://urtripventure.com) [www.urtripventure.com](http://www.urtripventure.com);  
return 301 https://www.urtripventure.com$request\_uri;  
}

server {  
listen 443 ssl;  
server\_name [urtripventure.com](http://urtripventure.com);  
return 301 https://www.urtripventure.com$request\_uri;  
ssl\_certificate /etc/letsencrypt/live/urtripventure.com/fullchain.pem; # managed by Certbot  
ssl\_certificate\_key /etc/letsencrypt/live/urtripventure.com/privkey.pem; # managed by Certbot

}

server {  
listen 443 ssl;  
server\_name [www.urtripventure.com](http://www.urtripventure.com);

```
location ~* \.(jpg|jpeg|png|gif|ico|css|js|pdf|mp4)$ {
    autoindex on;
    root /home/admin/production/mytripkart_node/mytripkart/build/;
    try_files $uri $uri /index.html?args;
}

location / {
    proxy_pass http://127.0.0.1:3000/urtripventure.com/;
}

ssl_certificate /etc/letsencrypt/live/www.urtripventure.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/www.urtripventure.com/privkey.pem; # managed by Certbot

```

}

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 9, 2021, 4:10pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/6 "2021-07-09T16:10:21Z")

</div>

You need to add a location block to handle the ACME challenge requests.  
Now:  
All HTTP redirects to HTTPS.  
All HTTPS is proxied to port 3000.

---

<div class="post-metadata">

**Author:** ![shrawan.lal](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shrawan.lal/32/88552_2.png) [@shrawan.lal](https://community.letsencrypt.org/u/shrawan.lal)\
**Post date:** [July 16, 2021, 1:59am UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/7 "2021-07-16T01:59:11Z")

</div>

Hi RG305,

I am trying to install SSL for another domain [www.northclubhouse.com](http://www.northclubhouse.com) with the below command, it throws an SSL error.

sudo certbot --nginx -d [www.northclubhouse.com](http://www.northclubhouse.com)

Even I checked acme-challenge, it's properly opening in my browser. And it's has been more than a week when I set "A" record.

[http://www.northclubhouse.com/.well-known/acme-challenge/Qh4Bkv6b664qCHFc4CI0zOPf9BmzEn7I8RRWEfYwPj0](http://www.northclubhouse.com/.well-known/acme-challenge/Qh4Bkv6b664qCHFc4CI0zOPf9BmzEn7I8RRWEfYwPj0)

 ![Screenshot from 2021-07-16 07-16-52](https://global.discourse-cdn.com/letsencrypt/original/3X/6/4/640faafe0a4c5ac3ce8bad0cad4cf174629cd3dd.png)

certbot.errors.FailedChallenges: Failed authorization procedure. [www.northclubhouse.com](http://www.northclubhouse.com) (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: During secondary validation: Invalid response from [http://www.northclubhouse.com/.well-known/acme-challenge/Qh4Bkv6b664qCHFc4CI0zOPf9BmzEn7I8RRWEfYwPj0](http://www.northclubhouse.com/.well-known/acme-challenge/Qh4Bkv6b664qCHFc4CI0zOPf9BmzEn7I8RRWEfYwPj0) [3.6.147.154]: "\r\n404 Not Found\r\n\<body bgcolor="white"\>\r\n

# 404 Not Found
\r\n
* * *
"

Here is Nginx file:

server {  
listen 80;  
server\_name [northclubhouse.com](http://northclubhouse.com) [www.northclubhouse.com](http://www.northclubhouse.com);  
location ^~ /.well-known/acme-challenge/ {  
alias /var/www/html/acme-challenge/;  
}  
root /var/www/html;

}

When I checked in [letsdebug.net](http://letsdebug.net), It's comming all okay.

> **[Test result for www.northclubhouse.com: OK](https://letsdebug.net/www.northclubhouse.com/594729)**
>
> 0 unique issue(s) detected

All OK!

OK

No issues were found with [www.northclubhouse.com](http://www.northclubhouse.com). If you are having problems with creating an SSL certificate, please visit the [Let's Encrypt Community forums](https://community.letsencrypt.org/) and post a question there.

Below is the error which I am getting.

IMPORTANT NOTES:

- The following errors were reported by the server:

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 16, 2021, 2:35am UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/8 "2021-07-16T02:35:59Z")

</div>

> [@shrawan.lal](#):
>
> location ^~ /.well-known/acme-challenge/ {  
> alias /var/www/html/acme-challenge/;  
> }

Make that:

```nohighlight
location /.well-known/acme-challenge/ {
root /var/www/html/acme-challenge/;
try_files $uri 404;
}

```

And we can test it with:

```nohighlight
echo "test file 1" > /var/www/html/acme-challenge/test-file-1234
mkdir /var/www/html/acme-challenge/.well-known
mkdir /var/www/html/acme-challenge/.well-known/acme-challenge
echo "test file 2" > /var/www/html/acme-challenge/.well-known/acme-challenge/test-file-4321
http://www.northclubhouse.com/.well-known/acme-challenge/test-file-1234
http://www.northclubhouse.com/.well-known/acme-challenge/test-file-4321

```

EDIT: UPDATED TEST PROCEDURE

---

<div class="post-metadata">

**Author:** ![shrawan.lal](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shrawan.lal/32/88552_2.png) [@shrawan.lal](https://community.letsencrypt.org/u/shrawan.lal)\
**Post date:** [July 16, 2021, 4:50am UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/9 "2021-07-16T04:50:20Z")

</div>

I done the requested change...

Now I can see:

```nohighlight
http://www.northclubhouse.com/.well-known/acme-challenge/test-file-4321

```

this URL is working. Should I proceed with SSL install or you are going to test something?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 16, 2021, 1:06pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/10 "2021-07-16T13:06:00Z")

</div>

> [@shrawan.lal](#):
>
> Should I proceed

Yes.

---

<div class="post-metadata">

**Author:** ![shrawan.lal](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shrawan.lal/32/88552_2.png) [@shrawan.lal](https://community.letsencrypt.org/u/shrawan.lal)\
**Post date:** [July 16, 2021, 1:15pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/11 "2021-07-16T13:15:21Z")

</div>

> [@shrawan.lal](#):
>
> `northclubhouse`

Still getting same error:

sudo certbot --nginx -d [www.northclubhouse.com](http://www.northclubhouse.com)  
Saving debug log to /var/log/letsencrypt/letsencrypt.log  
Plugins selected: Authenticator nginx, Installer nginx  
Obtaining a new certificate  
Performing the following challenges:  
http-01 challenge for [www.northclubhouse.com](http://www.northclubhouse.com)  
Waiting for verification...  
Cleaning up challenges  
Failed authorization procedure. [www.northclubhouse.com](http://www.northclubhouse.com) (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: During secondary validation: Invalid response from [http://www.northclubhouse.com/.well-known/acme-challenge/RTCK3-oC8WWBgEtHB\_zXvU2X8IuCp4GfdyP7SMGMf8I](http://www.northclubhouse.com/.well-known/acme-challenge/RTCK3-oC8WWBgEtHB_zXvU2X8IuCp4GfdyP7SMGMf8I) [3.6.147.154]: "\r\n404 Not Found\r\n\<body bgcolor="white"\>\r\n

# 404 Not Found
\r\n
* * *
"

IMPORTANT NOTES:

- The following errors were reported by the server:

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 16, 2021, 1:33pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/12 "2021-07-16T13:33:33Z")

</div>

Try:

```nohighlight
sudo certbot --nginx --webroot -w /var/www/html/acme-challenge -d "northclubhouse.com,www.northclubhouse.com"

```

---

<div class="post-metadata">

**Author:** ![shrawan.lal](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shrawan.lal/32/88552_2.png) [@shrawan.lal](https://community.letsencrypt.org/u/shrawan.lal)\
**Post date:** [July 16, 2021, 1:33pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/13 "2021-07-16T13:33:55Z")

</div>

Now SSL installed... after trying multiple attempts it installed... Not sure what is wrong here.

---

<div class="post-metadata">

**Author:** ![shrawan.lal](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shrawan.lal/32/88552_2.png) [@shrawan.lal](https://community.letsencrypt.org/u/shrawan.lal)\
**Post date:** [July 17, 2021, 9:36am UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/14 "2021-07-17T09:36:50Z")

</div>

By running above command I got below error.

Saving debug log to /var/log/letsencrypt/letsencrypt.log  
Too many flags setting configurators/installers/authenticators 'nginx' -\> 'webroot'

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [July 17, 2021, 10:28am UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/15 "2021-07-17T10:28:47Z")

</div>

Try `-i nginx -a webroot` in stead of `--nginx --webroot`.

---

<div class="post-metadata">

**Author:** ![shrawan.lal](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shrawan.lal/32/88552_2.png) [@shrawan.lal](https://community.letsencrypt.org/u/shrawan.lal)\
**Post date:** [July 17, 2021, 12:59pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/16 "2021-07-17T12:59:44Z")

</div>

Run same command for other domain... Got below error:

IMPORTANT NOTES:

- The following errors were reported by the server:

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 17, 2021, 5:25pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/17 "2021-07-17T17:25:33Z")

</div>

The FQDN has IPv4 and IPv6 entries.  
But they don't return the same thing:

```nohighlight
curl -I4 http://esmetour.com/
HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Sat, 17 Jul 2021 17:23:48 GMT
Content-Type: text/html
Content-Length: 1474
Last-Modified: Sat, 04 Apr 2020 10:32:07 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "5e886227-5c2"
Accept-Ranges: bytes

curl -I6 http://esmetour.com/
HTTP/1.1 301 Moved Permanently
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
date: Sat, 17 Jul 2021 17:23:57 GMT
server: LiteSpeed
location: https://esmetour.com/

curl -I4 http://www.esmetour.com/
HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Sat, 17 Jul 2021 17:24:06 GMT
Content-Type: text/html
Content-Length: 1474
Last-Modified: Sat, 04 Apr 2020 10:32:07 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "5e886227-5c2"
Accept-Ranges: bytes

curl -I6 http://www.esmetour.com/
HTTP/1.1 301 Moved Permanently
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
date: Sat, 17 Jul 2021 17:24:15 GMT
server: LiteSpeed
location: https://www.esmetour.com/

```

Are they going to the same server?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 17, 2021, 5:28pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/18 "2021-07-17T17:28:30Z")

</div>

Even the certs used show the difference:

```nohighlight
curl -4 https://www.esmetour.com/
curl: (51) SSL: no alternative certificate subject name matches target host name 'www.esmetour.com'

curl -4 https://esmetour.com/
curl: (51) SSL: no alternative certificate subject name matches target host name 'esmetour.com'

curl -6 https://www.esmetour.com/
curl: (60) SSL certificate problem: certificate has expired

curl -6 https://esmetour.com/
curl: (60) SSL certificate problem: certificate has expired

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [August 16, 2021, 5:28pm UTC](https://community.letsencrypt.org/t/unable-to-create-ssl-certificate-for-my-domain/155083/19 "2021-08-16T17:28:36Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.