Urn:acme:error:unauthorized :: The client lacks sufficient authorization

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: zeegear.com, zeegear.de

I ran this command:
certbot -c /etc/letsencrypt/cli.ini --standalone certonly

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for zeegear.com
http-01 challenge for zeegear.de
http-01 challenge for production.zeegear.com
http-01 challenge for production.zeegear.de
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. zeegear.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://zeegear.com/.well-known/acme-challenge/TvKhJapc7FJCWy2iBOPkrzobWr7lp_noaCQdsU7ybr4: "

404 Not Found

404 Not Found

", zeegear.de (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://zeegear.de/.well-known/acme-challenge/FOPBIEe2B3c7P_7bfWm_xdRBuhJfhx86izzVvzupCRA: " 404 Not Found

404 Not Found

"

IMPORTANT NOTES:

My web server is (include version):
standalone
The operating system my web server runs on is (include version):
AWS
My hosting provider, if applicable, is:
AWS
I can login to a root shell on my machine (yes or no, or I don’t know):
yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
no

2

All your sites are returning me 404.
See also:
https://letsdebug.net/zeegear.de/157
https://letsdebug.net/zeegear.com/158

Name: zeegear.com
Addresses: 2a01:4f8:221:11cd:9734:4c26:6044:5f33
18.184.104.206

Name: zeegear.de
Addresses: 2a01:4f8:221:11cd:9734:4c26:6044:5f33
18.184.104.206

3

In my test I hade used “standalone”. After these I am trying with nginx, because of that have you got 404 always.

4

standalone only creates the cert - it will not install it.

5

I was my goal, I wanted to get only the certs.

6

run
certbot certificates
to see if you got any
If not you may have to stop nginx and run the standalone again

7

I had “production.zeegear.com” and “production.zeegear.de”, but now:

certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Found the following matching certs:

-------------------------------------------------------------------------------
8

You may have deleted them by mistake.

9

I am sure I have not removed anything. under …live/default/ there are

10

maybe you have multiple copies of certbot installed?

but if the files are there, don’t you have what you needed?
Make sure you have the actual files not just the symlinks.

11

no. I had previously “production.zeegear.com” and “production.zeegear.de” and since yesterday I try to add “zeegear.com” and “zeegear.de”, but with these come the problems.

12

show:
/etc/letsencrypt/cli.ini

13 
# Use a 4096 bit RSA key instead of 2048
rsa-key-size = 4096

email = .............................
domains = zeegear.com, zeegear.de, production.zeegear.com, production.zeegear.de

noninteractive = true
# no ncurses interface
text = True
# no questions asked
agree-tos = true

authenticator = standalone
preferred-challenges = http

cert-name = default

expand = true
keep-until-expiring = true

and my comand: certbot -c /etc/letsencrypt/cli.ini --standalone certonly

14

try changing it to TLS:
certbot -c /etc/letsencrypt/cli.ini --standalone certonly --preferred-challenges tls-sni

be sure that your system is reachable via IPv6

15 
certbot -c /etc/letsencrypt/cli.ini --standalone certonly --preferred-challenges tls-sni
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Renewing an existing certificate
Performing the following challenges:
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.
16

rem out the line in cli.ini:

and
be sure that your system is reachable via IPv6

17

Uhm… actually we have only IPv4, sorry

18

Then that is the problem; as LE will prefer IPv6 when present and will not fall back to IPv4.
Just remove the related AAAA DNS entries in your DNS zone.

19

Thank you very much! Solved!

1 Like
20

Glad to hear that :slight_smile:

1 Like