# Unauthorized invalid response from (cannot renew)

**URL:** <https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570>\
**Category:** Help\
**Created:** [January 25, 2021, 5:32am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570 "2021-01-25T05:32:41Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 25, 2021, 5:32am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/1 "2021-01-25T05:32:41Z")

</div>

My domain is: [www.kyouikulogistics.com](http://www.kyouikulogistics.com)

I ran this command: certbot --force-renewal -d [www.kyouikulogistics.com](http://www.kyouikulogistics.com)

It produced this output: Type: Unauthorized, Detail: Invalid response from

[http://www.kyouikulogistics.com/.well-known/acme-challenge/](http://www.kyouikulogistics.com/.well-known/acme-challenge/) **long string** [my ip]: "\<DOCYTPE HTML PUBLIC \ "-//IETF//DTD HTML  
2.0//EN"\>\n\n

# Not Found
\n\<p"

I probably got a few forward/back slashes incorrect in the above...

My web server is (include version): Apache 2

The operating system my web server runs on is (include version): Ubuntu 16.04

My hosting provider, if applicable, is: Home (no provider)

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Combination of Webmin and command line

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 0.31.0

I had some difficulty renewing back in November but managed to accomplish by running a virtual server on port 80 along side my 443 version. The only thing I've messed with since then was to setup a port forward within Apache...guess that is what's causing trouble but am having a terrible time trying to figure out how to rectify the situation so I can renew my cert.

Any advice/assistance will be much appreciated.

Jason

---

<div class="post-metadata">

**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\
**Post date:** [January 25, 2021, 7:07am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/2 "2021-01-25T07:07:03Z")

</div>

Welcome Back to the Let's Encrypt Community, Jason 🙂

I just tried to run some tests on `www.kyouikulogistics.com`, but it stopped responding on both ports 80 and 443. Apache stopped? Adaptive firewall?

Please show the output of:

`sudo apachectl -S`

* * *

Certificate History

> **[crt.sh | kyouikulogistics.com](https://crt.sh/?Identity=kyouikulogistics.com&deduplicate=Y)**

---

<div class="post-metadata">

**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\
**Post date:** [January 25, 2021, 7:13am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/3 "2021-01-25T07:13:33Z")

</div>

It looks like it's your application interfering with the responses to some of my tests. We would still benefit by looking into your apache configuration per the command I gave in my last post.

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 25, 2021, 7:18am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/4 "2021-01-25T07:18:00Z")

</div>

Grifffin,

Thanks...I've just realized that, for some reason, another server I have behind the one I am trying to renew the cert for, is responding to [www.kyouikulogistics.com](http://www.kyouikulogistics.com)...which is odd...because that is behavior I was trying to accomplish with my proxy hosting on the first machine. Hmm, I've managed to mess something up somewhere....one moment and I'll paste the output of the apache configuration.

Here is is:

sudo apachectl -S  
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message  
VirtualHost configuration:  
192.168.11.37:443 [www.kyouikulogistics.com](http://www.kyouikulogistics.com) (/etc/apache2/sites-enabled/000-default.conf:11)  
192.168.11.37:80 [www.kyouikulogistics.com](http://www.kyouikulogistics.com) (/etc/apache2/sites-enabled/webmin.1600238302.conf:1)  
ServerRoot: "/etc/apache2"  
Main DocumentRoot: "/var/www/html"  
Main ErrorLog: "/var/log/apache2/error.log"  
Mutex default: dir="/var/lock/apache2" mechanism=fcntl  
Mutex mpm-accept: using\_defaults  
Mutex watchdog-callback: using\_defaults  
Mutex rewrite-map: using\_defaults  
Mutex ssl-stapling-refresh: using\_defaults  
Mutex ssl-stapling: using\_defaults  
Mutex proxy: using\_defaults  
Mutex ssl-cache: using\_defaults  
PidFile: "/var/run/apache2/apache2.pid"  
Define: DUMP\_VHOSTS  
Define: DUMP\_RUN\_CFG  
Define: ENABLE\_USR\_LIB\_CGI\_BIN  
User: name="www-data" id=33  
Group: name="www-data" id=33

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 25, 2021, 7:25am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/5 "2021-01-25T07:25:08Z")

</div>

I setup [schlc.kyouikulogistics.com](http://schlc.kyouikulogistics.com) back on the 30th of November last year but didn't have success in getting ProxyPass to work so I deleted it with the goal of working on it later. For some reason that subdomain seems to still be alive. Maybe that is not related to this issue but...

---

<div class="post-metadata">

**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\
**Post date:** [January 25, 2021, 7:28am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/6 "2021-01-25T07:28:28Z")

</div>

I ought to know better than to dig in without much time. 🙂

I'll be back later when I can, but for now, check into the two files containing `VirtualHosts` listed in the output you posted.

> **[Reverse Proxy Guide - Apache HTTP Server Version 2.4](https://httpd.apache.org/docs/current/howto/reverse_proxy.html)**

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 25, 2021, 7:29am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/7 "2021-01-25T07:29:35Z")

</div>

Griffin,

Thanks and much appreciated. I'll fiddle around and see what I can find/accomplish.

Jason

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 25, 2021, 7:47am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/8 "2021-01-25T07:47:56Z")

</div>

Griffin,

Thanks again...and here is a brief update.

I've deleted all reverse proxy settings and deleted the virtual server running on port 80. I then recreated a virtual server on port 80 with pathways to the letsencrypt fullchain.pem and privkey.pem. Restarted Apache and tried again but get the same error.

For reference, the contents of the two virtual servers are below

1: **000-default.conf** (note - I deleted all lines that have been commented out except the first line...it looks like I may have commented that out and added the 443 but I am embarrassed to say...I cannot remember)

#\<VirtualHost 192.168.11.37:80\>

\<VirtualHost 192.168.11.37:443\>  
ServerAdmin webmaster@localhost  
DocumentRoot /var/www/html  
ErrorLog {APACHE\_LOG\_DIR}/error.log CustomLog {APACHE\_LOG\_DIR}/access.log combined  
SSLEngine on

```
            ServerAdmin webmaster@localhost

ErrorLog ${APACHE_LOG_DIR}/error.log

```

CustomLog ${APACHE\_LOG\_DIR}/access.log combined

```
    ServerName www.kyouikulogistics.com
Include /etc/letsencrypt/options-ssl-apache.conf

```

SSLCertificateFile /etc/letsencrypt/live/www.kyouikulogistics.com/fullchain.pem  
SSLCertificateKeyFile /etc/letsencrypt/live/www.kyouikulogistics.com/privkey.pem

2: **webmin.1611560222.conf** (created today after deleting the previous virtual server...via Webmin)

\<VirtualHost 192.168.11.37:80\>  
DocumentRoot "/var/www/html"  
\<Directory "/var/www/html"\>  
allow from all  
Options None  
Require all granted

```
            ServerAdmin webmaster@localhost
            DocumentRoot /var/www/html
            ErrorLog ${APACHE_LOG_DIR}/error.log
            CustomLog ${APACHE_LOG_DIR}/access.log combined
            SSLEngine on

            ServerAdmin webmaster@localhost

ErrorLog ${APACHE_LOG_DIR}/error.log

```

CustomLog ${APACHE\_LOG\_DIR}/access.log combined

```
    ServerName www.kyouikulogistics.com
Include /etc/letsencrypt/options-ssl-apache.conf

```

SSLCertificateFile /etc/letsencrypt/live/www.kyouikulogistics.com/fullchain.pem  
SSLCertificateKeyFile /etc/letsencrypt/live/www.kyouikulogistics.com/privkey.pem

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 25, 2021, 9:19am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/9 "2021-01-25T09:19:21Z")

</div>

Another quick update here.

Part of my problem was that I had two servers running at the same IP and, for some reason, the one running with port 80 only was being prioritized over the one running with two virtual servers (one on 80 and one on 443). I shut off Apache on the other server and now get the following error:

Type: Connection  
Detail: Fetching  
[http://www.kyouikulogistics.com/.well-known](http://www.kyouikulogistics.com/.well-known)....  
Connection refused

I guess this represents baby steps in the correct direction but I'm not sure why the connection is being refused.

---

<div class="post-metadata">

**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\
**Post date:** [January 25, 2021, 9:48am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/10 "2021-01-25T09:48:20Z")

</div>

What's the current output of this:

`sudo apachectl -S`

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 25, 2021, 11:44am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/11 "2021-01-25T11:44:14Z")

</div>

Thanks,

Here it is. I messed around a bit more and didn't have much success.

sudo apachectl -S  
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message  
VirtualHost configuration:  
192.168.11.14:443 [www.kyouikulogistics.com](http://www.kyouikulogistics.com) (/etc/apache2/sites-enabled/000-default.conf:11)  
192.168.11.14:80 [www.kyouikulogistics.com](http://www.kyouikulogistics.com) (/etc/apache2/sites-enabled/webmin.1611560222.conf:1)  
ServerRoot: "/etc/apache2"  
Main DocumentRoot: "/var/www/html"  
Main ErrorLog: "/var/log/apache2/error.log"  
Mutex ssl-stapling: using\_defaults  
Mutex proxy: using\_defaults  
Mutex ssl-cache: using\_defaults  
Mutex default: dir="/var/lock/apache2" mechanism=fcntl  
Mutex mpm-accept: using\_defaults  
Mutex watchdog-callback: using\_defaults  
Mutex rewrite-map: using\_defaults  
Mutex ssl-stapling-refresh: using\_defaults  
PidFile: "/var/run/apache2/apache2.pid"  
Define: DUMP\_VHOSTS  
Define: DUMP\_RUN\_CFG  
Define: ENABLE\_USR\_LIB\_CGI\_BIN  
User: name="www-data" id=33  
Group: name="www-data" id=33

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [January 25, 2021, 2:46pm UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/12 "2021-01-25T14:46:21Z")

</div>

Please don't use IPs in configs.  
Things like:  
`<VirtualHost 192.168.11.37:443>`  
Should be just:  
`<VirtualHost *:443>`

Q1: Are there more then one internal server that will be accessed via HTTP or HTTPS from the Internet?

Q2: To which IP does the NAT/FW send HTTP connections to? And to which for HTTPS?

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 26, 2021, 11:06am UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/13 "2021-01-26T11:06:46Z")

</div>

rg305,

Thanks for the advice. I can change the virtual host settings but I don't think that is the problem in this case.

Q1: There was another server running but I didn't want to complicate things further so I have shut it down and removed any/all settings in the first server that refer to that second machine. The certbot still fails.

Q2: External IP for [kyouikulogistics.com](http://kyouikulogistics.com) is 211.133.220.51. The internal machine is currently 192.168.11.14

On the machine listed in Q2, there are two virtual servers (one for 443 and one for 80).

I plan to work on this again tomorrow morning (evening here in Japan now) and hope to figure out the problem. Any advice/suggestions will be appreciated.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [January 26, 2021, 3:19pm UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/14 "2021-01-26T15:19:15Z")

</div>

Why don't these IPs match?:

> [@jlh](#):
>
> The internal machine is currently 192.168.11.14

> [@jlh](#):
>
> \<VirtualHost 192.168.11.37:80\>

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 26, 2021, 11:38pm UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/15 "2021-01-26T23:38:05Z")

</div>

Sorry, yeah, this is an evolving situation. I restarted the machine and got a new IP (not sure why) but the virtual server settings have changed as well. I can, will, change to \*_\<VirtualHost :443\>_ to avoid further issues.

So, currently it is \<VirtualHost 192.168.11.24:443\>  
and  
\<VirtualHost 192.168.11.24:80\>

Regards

Jason

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 26, 2021, 11:44pm UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/16 "2021-01-26T23:44:47Z")

</div>

My current error, with certbot is:

"Error getting validation data" so it seems the connection is working but the fullchain and privkey files are not being accessed.

Jason

---

<div class="post-metadata">

**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\
**Post date:** [January 26, 2021, 11:45pm UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/17 "2021-01-26T23:45:31Z")

</div>

Make those

\<VirtualHost \*:80\>

\<VirtualHost \*:443\>

would likely make things **much** easier.

Otherwise, you're binding your virtual hosts to **only** private IP addresses!

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 26, 2021, 11:48pm UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/18 "2021-01-26T23:48:12Z")

</div>

griffin,

Thanks, done. 😉

Now I just have to figure out why the validation data cannot be accessed...

Thanks for your support thus far.

Jason

---

<div class="post-metadata">

**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\
**Post date:** [January 26, 2021, 11:49pm UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/19 "2021-01-26T23:49:18Z")

</div>

Full circle... 🙃

`sudo apachectl -k graceful`

What says this now?

`sudo apachectl -S`

---

<div class="post-metadata">

**Author:** ![jlh](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jlh](https://community.letsencrypt.org/u/jlh)\
**Post date:** [January 26, 2021, 11:53pm UTC](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570/20 "2021-01-26T23:53:39Z")

</div>

Thanks,

This is what I have now.

* * *

> sudo apachectl -S  
> AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message  
> VirtualHost configuration:  
> \*:443 [www.kyouikulogistics.com](http://www.kyouikulogistics.com) (/etc/apache2/sites-enabled/000-default.conf:11)  
> \*:80 [www.kyouikulogistics.com](http://www.kyouikulogistics.com) (/etc/apache2/sites-enabled/webmin.1611560222.conf:1)  
> ServerRoot: "/etc/apache2"  
> Main DocumentRoot: "/var/www/html"  
> Main ErrorLog: "/var/log/apache2/error.log"  
> Mutex proxy: using\_defaults  
> Mutex ssl-cache: using\_defaults  
> Mutex default: dir="/var/lock/apache2" mechanism=fcntl  
> Mutex mpm-accept: using\_defaults  
> Mutex watchdog-callback: using\_defaults  
> Mutex rewrite-map: using\_defaults  
> Mutex ssl-stapling-refresh: using\_defaults  
> Mutex ssl-stapling: using\_defaults  
> PidFile: "/var/run/apache2/apache2.pid"  
> Define: DUMP\_VHOSTS  
> Define: DUMP\_RUN\_CFG  
> Define: ENABLE\_USR\_LIB\_CGI\_BIN  
> User: name="www-data" id=33  
> Group: name="www-data" id=33

[Next page](https://community.letsencrypt.org/t/unauthorized-invalid-response-from-cannot-renew/143570.md?page=2)