(Http-01): urn: ietf: params: acme: error: unauthorized error when I execute "$ sudo certbot renew --dry-run" command

Question

environment ・Nginx ・ CentOS 7 ・ Certbot 0.31.0

$ sudo certbot renew --dry-run

Saving debug log to /var/log/letsencrypt/letsencrypt.log


Processing /etc/letsencrypt/renewal/hoge.example.com.conf

Cert not due for renewal, but simulating renewal for dry run
Plugins selected: Authenticator nginx, Installer nginx
Starting new HTTPS connection (1): acme-staging-v02.api.letsencrypt.org
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for hoge.example.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (hoge.example.com) from /etc/letsencrypt/renewal/hoge.example.com.conf produced an unexpected error: Failed authorization procedure. hoge.example.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from https://hoge.example.com/.well-known/acme-challenge/xxxx [IP address]: "<!doctype html>\r\n<html lang=\"ja\">\r\n<head>\r\n\t<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" />\r\n\t<meta http-e". Skipping.

Question

・What exactly does a Failed authorization procedure mean?

・Error contents are cut off in Skipping. What should I do to display them all?

2019/4/16 add

$ sudo less /var/log/letsencrypt/letsencrypt.log

2019-04-16 20:40:54,333:DEBUG:certbot.updater:Skipping renewal deployer in dry-run mode.
2019-04-16 20:40:55,401:DEBUG:certbot.updater:Skipping updaters in dry-run mode.
2019-04-16 20:40:55,455:DEBUG:certbot.cli:Var dry_run=True (set by user).
2019-04-16 20:40:55,455:DEBUG:certbot.cli:Var server=set(['staging', 'dry_run']) (set by user).
2019-04-16 20:40:55,456:DEBUG:certbot.cli:Var dry_run=True (set by user).
2019-04-16 20:40:55,456:DEBUG:certbot.cli:Var server=set(['staging', 'dry_run']) (set by user).
2019-04-16 20:40:55,456:DEBUG:certbot.cli:Var account=set(['server']) (set by user).
2019-04-16 20:40:55,482:DEBUG:certbot.storage:Should renew, less than 30 days before certificate expiry 2019-05-01 22:55:56 UTC.
2019-04-16 20:40:55,482:INFO:certbot.renewal:Cert is due for renewal, auto-renewing...
2019-04-16 20:40:55,482:DEBUG:certbot.plugins.selection:Requested authenticator manual and installer None
2019-04-16 20:40:55,483:DEBUG:certbot.plugins.disco:Other error:(PluginEntryPoint#manual): An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/certbot/plugins/disco.py", line 132, in prepare
    self._initialized.prepare()
  File "/usr/lib/python2.7/site-packages/certbot/plugins/manual.py", line 133, in prepare
    self.option_name('auth-hook')))
PluginError: An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.
2019-04-16 20:40:55,516:DEBUG:certbot.plugins.selection:No candidate plugin
2019-04-16 20:40:55,516:DEBUG:certbot.plugins.selection:Selected authenticator None and installer None
2019-04-16 20:40:55,516:INFO:certbot.main:Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',)
2019-04-16 20:40:55,520:WARNING:certbot.renewal:Attempting to renew cert (example.com) from /etc/letsencrypt/renewal/example.com.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',). Skipping.
2019-04-16 20:40:55,527:DEBUG:certbot.renewal:Traceback was:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/certbot/renewal.py", line 452, in handle_renewal_request
    main.renew_cert(lineage_config, plugins, renewal_candidate)
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 1187, in renew_cert
    installer, auth = plug_sel.choose_configurator_plugins(config, plugins, "certonly")
  File "/usr/lib/python2.7/site-packages/certbot/plugins/selection.py", line 237, in choose_configurator_plugins
    diagnose_configurator_problem("authenticator", req_auth, plugins)
  File "/usr/lib/python2.7/site-packages/certbot/plugins/selection.py", line 341, in diagnose_configurator_problem
    raise errors.PluginSelectionError(msg)
PluginSelectionError: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',)

2019-04-16 20:40:55,527:ERROR:certbot.renewal:The following certs could not be renewed:
2019-04-16 20:40:55,527:ERROR:certbot.renewal:  /etc/letsencrypt/live/entrepreneur.0mode.tokyo/fullchain.pem (failure)
  /etc/letsencrypt/live/example.com/fullchain.pem (failure)
2019-04-16 20:40:55,528:DEBUG:certbot.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/certbot", line 9, in <module>
    load_entry_point('certbot==0.31.0', 'console_scripts', 'certbot')()
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 1365, in main
    return config.func(config, plugins)
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 1272, in renew
    renewal.handle_renewal_request(config)
  File "/usr/lib/python2.7/site-packages/certbot/renewal.py", line 477, in handle_renewal_request
    len(renew_failures), len(parse_failures)))

What are the exact contents of `/var/log/letsencrypt/letsencrypt.log`? — Andrew Eisenberg, Apr 16 '19 at 03:31
OK. That clarifies what the error is. You are not using the nginx plugin, but rather the manual plugin. See the changed answer below. — Andrew Eisenberg, Apr 16 '19 at 15:08
Thank you for editing. I read the answer and understood the cause. I remembered that I was trying to get a wildcard certificate. I would like to rewrite the configuration file to use the nginx plugin or choose to delete it once. — re1, Apr 17 '19 at 12:24

Andrew Eisenberg · Accepted Answer · 2019-04-16T15:14:48.370

The problem here is that you are trying to renew the cert at hoge.example.com, which you almost certainly don't own. The letsencrypt nginx plugin will update your nginx configuration so that there is a server block that serves on port 80 (http) at the domain hoge.example.com. It will server a path at .well-known/<some-hash>. Then the letsencrypt server sends an HTTP request to http://hoge.example.com/.well-known/<some-hash>. This is failing since you don't actually own the domain.

You need to change your config so that you are creating a cert for the domain that you own.

EDIT: With the log, I know more information.

The key lines of the log are:

Requested authenticator manual and installer None
Other error:(PluginEntryPoint#manual): An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.

What this means is that you are not using the nginx plugin, but rather the manual plugin. And when you use the manual plugin, you need to specify an authorization hook, which is basically a way of proving that you own the website you say that you do. It's likely a problem with your config.

Here is what mine looks like:

# renew_before_expiry = 30 days
version = 0.32.0
archive_dir = /etc/letsencrypt/archive/my-domain.net
cert = /etc/letsencrypt/live/my-domain.net/cert.pem
privkey = /etc/letsencrypt/live/my-domain.net/privkey.pem
chain = /etc/letsencrypt/live/my-domain.net/chain.pem
fullchain = /etc/letsencrypt/live/my-domain.net/fullchain.pem

# Options used in the renewal process
[renewalparams]
installer = nginx
server = https://acme-v02.api.letsencrypt.org/directory
account = xxx123456789xxx
authenticator = nginx

Notice the installer and authenticator sections. Yours should look similar.

I would first recommend that you make sure that your config looks like mine and try again. If that doesn't work, you should probably just delete and recreate your cert.

I have replaced it with hoge.example.com to ask a question, but here I'm trying on my own domain. — re1, Apr 16 '19 at 01:50

(Http-01): urn: ietf: params: acme: error: unauthorized error when I execute "$ sudo certbot renew --dry-run" command

1 Answers1