Using certbot --apache ends with error 503 (or 403)

Welcome to the community @Laiss

Thanks for nice problem description. A strong possibility is you are being blocked by a Palo Alto brand firewall. We saw many similar problems starting about a year ago but haven't seen these much lately.

See an earlier post of mine for more info (link here)

In that one the error was a "reset by peer" but sometimes we also saw a 503 depending on the model and software version on the Palo Alto device.

Your symptoms are that this returns an expected 404:

curl -I http://wiki.wsi.med.uni-muenchen.de/.well-known/Test123
HTTP/1.1 404 Not Found
Date: Wed, 10 May 2023 14:01:55 GMT
Server: Apache/2.4.52 (Ubuntu)

But, if I use a user-agent similar to what Let's Encrypt uses it fails with a 503

curl -I http://wiki.wsi.med.uni-muenchen.de/.well-known/acme-challenge/Test123 -A "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
HTTP/1.1 503 Service Unavailable
P3P: CP="CAO PSA OUR"

(various other headers removed for readability)

4 Likes