Unable to renew cert after auto renew failed

kiekar · April 1, 2019, 6:53pm

I had a renewal which failed. Tried a manual renewall using win-acme.v1.9.12.2 which also failed.
Downloaded verson win-acme.v2.0.4.227 and tried to create a new cert in test mode which resulted with some errors. I reviewed the validation page from PKISharp/win-acme and found under Anonymous authentication to Enable anonymous authentication to the /.well-known/acme-challenge/ path to allow access from the ACME server. Cannot find /.well-known/acme-challenge/ path to enable anonymous authentication.

Your help would be much appreciated.

My domain is:5220dessource.com

My web server is (include version):iis8.5

The operating system my web server runs on is (include version):2012 r2

My hosting provider, if applicable, is: hosting myself

[INFO] A simple Windows ACMEv2 client (WACS)
[INFO] Software version 2.0.4.227 (RELEASE)
[INFO] IIS version 8.5
[INFO] Please report issues at https://github.com/PKISharp/win-acme

[VERB] Verbose mode logging enabled
[VERB] Arguments: --test --verbose
[DBUG] Config folder: C:\ProgramData\win-acme\acme-staging-v02.api.letsencrypt.org
[DBUG] Certificate cache: C:\ProgramData\win-acme\acme-staging-v02.api.letsencrypt.org\Certificates
[VERB] Settings SettingsService {ConfigPath=“C:\ProgramData\win-acme\acme-staging-v02.api.letsencrypt.org”, CertificatePath=“C:\ProgramData\win-acme\acme-staging-v02.api.letsencrypt.org\Certificates”, ClientNames=[“win-acme”, “win-acme”], RenewalDays=60, HostsPerPage=50, ScheduledTaskRandomDelay=00:00:00, ScheduledTaskStartBoundary=09:00:00, ScheduledTaskExecutionTimeLimit=02:00:00}
[VERB] Sending e-mails False
[DBUG] Renewal period: 60 days

[DBUG] Scanning IIS site bindings for hosts
[INFO] Target generated using plugin IISBinding: www.5220dessources.com
[DBUG] Scanning IIS site bindings for hosts
[VERB] Checking [IISBinding] www.5220dessources.com
[DBUG] Loading signer from C:\ProgramData\win-acme\acme-staging-v02.api.letsencrypt.org\Signer_v2
[DBUG] Send GET request to https://acme-staging-v02.api.letsencrypt.org/directory
[DBUG] Send HEAD request to https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce
[DBUG] Loading account information from C:\ProgramData\win-acme\acme-staging-v02.api.letsencrypt.org\Registration_v2
[DBUG] Send POST request to https://acme-staging-v02.api.letsencrypt.org/acme/new-order
[DBUG] Send GET request to https://acme-staging-v02.api.letsencrypt.org/acme/authz/W6l61auQV7qd_AXNdO4uf7PnYD6LHXQCShzdgeThQrc
[INFO] Authorize identifier: www.5220dessources.com
[INFO] Authorizing www.5220dessources.com using http-01 validation (SelfHosting)
[DBUG] Submitting challenge answer
[DBUG] Send POST request to https://acme-staging-v02.api.letsencrypt.org/acme/challenge/W6l61auQV7qd_AXNdO4uf7PnYD6LHXQCShzdgeThQrc/287324153
[DBUG] Refreshing authorization
[DBUG] Send GET request to https://acme-staging-v02.api.letsencrypt.org/acme/challenge/W6l61auQV7qd_AXNdO4uf7PnYD6LHXQCShzdgeThQrc/287324153
[EROR] {
“type”: “urn:ietf:params:acme:error:unauthorized”,
“detail”: "Invalid response from http://www.5220dessources.com/.well-known/acme-challenge/MGSiTcoxP2pDaBlLs9AaWfZi4fQBQ4LjfGrv-E3gtgM [69.165.167.236]: “\r\n<html xmlns=\“http””,
“status”: 403
}
[EROR] Authorization result: invalid
[EROR] Create certificate failed: Authorization failed

JuergenAuer · April 1, 2019, 7:01pm

Hi @kiekar

if you have an IIS, you must allow extensionless files.

Go to your webroot. Then create the two directories

yourWebRoot\.well-known\acme-challenge

there a file (file name 1234 without extension).

Then try to load that file via

http://www.5220dessources.com/.well-known/acme-challenge/1234

kiekar · April 1, 2019, 8:22pm

Hi Juergen,

When I enter

http://www.5220dessources.com/.well-known/acme-challenge/1234

I receive a 404 error and the tranfer protocol changes from http to https. I did disable the url rewrite rule in iis and on the web config file. I am also using haproxy on my pfsense firewall.

JuergenAuer · April 1, 2019, 8:32pm

Browsers are limited to check such things. Too much caching.

But that's one reason I've created my online tool: https://check-your-website.server-daten.de/?q=5220dessources.com%2F.well-known%2Facme-challenge%2F1234

And there is something visible:

Domainname	Http-Status	Sec.	G
• http://5220dessources.com/.well-known/acme-challenge/1234
69.165.167.236	404	0.284	M
Not Found

• http://www.5220dessources.com/.well-known/acme-challenge/1234
69.165.167.236	404	0.287	M
Not Found

• https://5220dessources.com/.well-known/acme-challenge/1234
69.165.167.236	404	1.177	M
Not Found

• https://www.5220dessources.com/.well-known/acme-challenge/1234
69.165.167.236	404	1.190	M
Not Found

• http://5220dessources.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
69.165.167.236	404	0.276	A
Not Found
Visible Content: Server Error 404 - File or directory not found. The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

• http://www.5220dessources.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
69.165.167.236	404	0.283	A
Not Found
Visible Content: Server Error 404 - File or directory not found. The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

There answers always the same

Server: Microsoft-IIS/8.5

with the same size

Content-Length: 1245

So add the following config file in /.well-known/acme-challenge to allow extensionless files:

<configuration>
    <system.webServer>
        <staticContent>
            <mimeMap fileExtension="." mimeType="text/plain" />
        </staticContent>
    </system.webServer>
</configuration>

Then recheck your domain + file to see, if there is a http status 200 checking /.well-known/acme-challenge/1234.

kiekar · April 1, 2019, 9:06pm

Hi Juergen,

I added a web.config file as you instructed. This time i received a blank page when going to

http://www.5220dessources.com/.well-known/acme-challenge/1234

with no error.

JuergenAuer · April 1, 2019, 9:10pm

Now you have 4 * http status 200:

Domainname	Http-Status	Sec.	G
• http://5220dessources.com/.well-known/acme-challenge/1234
69.165.167.236	200	0.280	H

• http://www.5220dessources.com/.well-known/acme-challenge/1234
69.165.167.236	200	0.280	H

• https://5220dessources.com/.well-known/acme-challenge/1234
69.165.167.236	200	1.187	A

• https://www.5220dessources.com/.well-known/acme-challenge/1234
69.165.167.236	200	1.167	A

• http://5220dessources.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
69.165.167.236	404	0.283	A
Not Found
Visible Content: Server Error 404 - File or directory not found. The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

• http://www.5220dessources.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
69.165.167.236	404	0.276	A
Not Found
Visible Content: Server Error 404 - File or directory not found. The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

Is there content in your test file? The word “test”? Or is it an empty file?

kiekar · April 1, 2019, 9:22pm

Is there content in your test file? The word “test”? Or is it an empty file?

It's empty. Should I have test in the 1234 file?

JuergenAuer · April 2, 2019, 9:52am

Then you can't check if you see the correct content.

Create a file with content.

kiekar · April 2, 2019, 6:42pm

Hi Juergen and thanks for all help.

I added "test" to the file and I do now see the text when going to

http://www.5220dessources.com/.well-known/acme-challenge/1234

JuergenAuer · April 2, 2019, 7:12pm

Now that looks good.

So try it again to create a certificate.

kiekar · April 2, 2019, 7:30pm

Tried again but unfortunately I’m still getting the same error.

[DBUG] Scanning IIS site bindings for hosts
[INFO] Target generated using plugin IISBinding: www.5220dessources.com
[DBUG] Scanning IIS site bindings for hosts
[VERB] Checking [IISBinding] www.5220dessources.com
[DBUG] Loading signer from C:\ProgramData\win-acme\acme-staging-v02.api.letsencrypt.org\Signer_v2
[DBUG] Send GET request to https://acme-staging-v02.api.letsencrypt.org/directory
[DBUG] Send HEAD request to https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce
[DBUG] Loading account information from C:\ProgramData\win-acme\acme-staging-v02.api.letsencrypt.org\Registration_v2
[DBUG] Send POST request to https://acme-staging-v02.api.letsencrypt.org/acme/new-order
[DBUG] Send GET request to https://acme-staging-v02.api.letsencrypt.org/acme/authz/6-ocPaT0qOPGgeYDTfwYv-bWc0cxrSuvGDQU1KSLqrU
[INFO] Authorize identifier: www.5220dessources.com
[INFO] Authorizing www.5220dessources.com using http-01 validation (SelfHosting)
[DBUG] Submitting challenge answer
[DBUG] Send POST request to https://acme-staging-v02.api.letsencrypt.org/acme/challenge/6-ocPaT0qOPGgeYDTfwYv-bWc0cxrSuvGDQU1KSLqrU/289599559
[DBUG] Refreshing authorization
[DBUG] Send GET request to https://acme-staging-v02.api.letsencrypt.org/acme/challenge/6-ocPaT0qOPGgeYDTfwYv-bWc0cxrSuvGDQU1KSLqrU/289599559
[EROR] {
“type”: “urn:ietf:params:acme:error:unauthorized”,
“detail”: "Invalid response from http://www.5220dessources.com/.well-known/acme-challenge/1-2foU6k3NjbZpb0Fbv9Q4jVOP8iye9c1gKIi8SSpno [69.165.167.236]: “\r\n<html xmlns=\“http””,
“status”: 403
}
[EROR] Authorization result: invalid
[EROR] Create certificate failed: Authorization failed

kiekar · April 3, 2019, 1:18pm

Hello,

Is the error due to IIS configuration or haproxy on pfsense?

JuergenAuer · April 3, 2019, 1:23pm

As written:

But perhaps you have changed something.

There is a new check of your domain - https://check-your-website.server-daten.de/?q=5220dessources.com

there are always IIS-answers.

kiekar · April 3, 2019, 2:27pm

Hi Juergen,

There is a new check of your domain - [https://check-your-website.server-daten.de/?q=5220dessources.com ](https://check-your-website.server-daten.de/?q=5220dessources

Is there a specific area in the output I should focus on?

system · May 3, 2019, 2:27pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Win-acme cannot renew cert Help	12	2816	July 6, 2020
Win-acme error processing certificate renewal Help	2	6092	September 20, 2019
Problems renewing the certificate Help	5	2740	October 28, 2021
Failing to renew / can't install fresh. Worked OK last month Server	4	1679	January 17, 2017
Failure of Cert via Latest version of Win-Acme Help	12	1158	June 8, 2024

Unable to renew cert after auto renew failed

Related topics