This web site runs under Apache on Windows. I installed Windows certbot client and ran it as suggested on its homepage, in webroot mode, since the web site cannot be stopped. This is what it reported:

C:\WWW\somedomain>certbot certonly --webroot
Saving debug log to C:\Certbot\log\letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Please enter in your domain name(s) (comma and/or space separated)  (Enter 'c'
to cancel): somedomain.com
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for somedomain.com
Input the webroot for somedomain.com: (Enter 'c' to cancel): c:\www\somedomain
Waiting for verification...
←[31mChallenge failed for domain somedomain.com←[0m
http-01 challenge for somedomain.com
Cleaning up challenges
←[31mSome challenges have failed.←[0m
←[0m - The following errors were reported by the server:

   Domain: somedomain.com
   Type:   unauthorized
   Detail: Invalid response from
   [2**.1**.1**.2**]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
   2.0//EN\">\n<html><head>\n<title>404 Not
   Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

The certbot server does query the right IP address, so the DNS record is working fine. I suspect that it may not be creating the challenge folder/file. I tried creating the above URL manually and querying it in a browser from elsewhere, and it is being served fine. Any ideas what is missing for certbot? Keep in mind that somedomain.com is only used here for example.

  • Have you tried using the --webroot-path (or -w) command line options to tell certbot where to put the files? – Stephen Ostermiller Aug 22 '20 at 22:52
  • if I am right, you should be config your .well-known/acme-challenge/ on your web server(etc nginx), http://somedomain.com/.well-known/acme-challenge/UIWHcmUsNd_4itYD5IWMLSuldIF4yzd2m9mpSH4W7a0 should response a secret key to letsencrypt. Usually I uses certbot tool with DNS verification. I recomment acmetool tool. – zhengchun Aug 23 '20 at 3:13
  • @Stephen Ostermiller: no dice, same problem. certbot takes the local path into account, but LEC queries the same vanilla path on the web server. Sounds like a bug. I cannot comment so do not ask. Thanks to SE. – user113410 Aug 29 '20 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy