Unable to renew certificate - failed authorization procedure

My domain is:
igem-tuebingen.com and igem-tuebingen.de

I ran this command:
sudo certbot renew --dry-run

It produced this output:
`zeth@igem-tuebingen-website-droplet:~$ sudo certbot renew --dry-run
[sudo] password for zeth:
Saving debug log to /var/log/letsencrypt/letsencrypt.log


Processing /etc/letsencrypt/renewal/igem-tuebingen.com.conf


Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for igem-tuebingen.com
http-01 challenge for www.igem-tuebingen.com
nginx: [warn] conflicting server name “www.igem-tuebingen.com” on 0.0.0.0:80, ignored
Waiting for verification…
Cleaning up challenges
nginx: [warn] conflicting server name “www.igem-tuebingen.com” on 0.0.0.0:80, ignored
Attempting to renew cert (igem-tuebingen.com) from /etc/letsencrypt/renewal/igem-tuebingen.com.conf produced an unexpected error: Failed authorization procedure. www.igem-tuebingen.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.igem-tuebingen.com/.well-known/acme-challenge/Ewuy3gtz_mJfT5RxMmMaosEpuIbC7gwy7g-83cpMxcA [104.248.16.189]: “\r\n404 Not Found\r\n<body bgcolor=“white”>\r\n

404 Not Found

\r\n
”. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/igem-tuebingen.com/fullchain.pem (failure)

** DRY RUN: simulating ‘certbot renew’ close to cert expiry
** (The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/igem-tuebingen.com/fullchain.pem (failure)
** DRY RUN: simulating ‘certbot renew’ close to cert expiry
** (The test certificates above have not been saved.)


1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

  • The following errors were reported by the server:

Domain: www.igem-tuebingen.com
Type: unauthorized
Detail: Invalid response from
http://www.igem-tuebingen.com/.well-known/acme-challenge/Ewuy3gtz_mJfT5RxMmMaosEpuIbC7gwy7g-83cpMxcA
[104.248.16.189]: “\r\n404 Not
Found\r\n<body bgcolor=“white”>\r\n

404
Not Found

\r\n

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

  • Your account credentials have been saved in your Certbot
    configuration directory at /etc/letsencrypt. You should make a
    secure backup of this folder now. This configuration directory will
    also contain certificates and private keys obtained by Certbot so
    making regular backups of this folder is ideal.`

My web server is (include version):
nginx 1.16

The operating system my web server runs on is (include version):
Ubuntu 16.04

My hosting provider, if applicable, is:
Digital ocean for the droplet, namecheap for the domain and 1&1 Germany for the de domain.

I can login to a root shell on my machine (yes or no, or I don’t know):
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
0.31.0

Additional details:
The whole setup and setup scripts for the nginx server as well as the letsencrypt certificate can be found here: https://github.com/Zethson/igem_tuebingen_website/tree/development/production_setup

Thank you very much!

I do not think that the configuration you've posted to GitHub exactly reflects what's on your server. It would not generate this warning:

That warning is also probably be the reason that the nginx authenticator is failing to work properly. You can have, AT MOST, one port 80 virtualhost for each server_name.

If your configuration has duplicate server names, then all but one of them is going to be ignored. This could cause the configuration that is added by the nginx authenticator to be ineffective.

To fix this,

 grep -R server_name /etc/nginx

and merge your port 80 virtual hosts until you don't have any duplicates remaining.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.