[SOLVED] installing certificate with Let's Encrypt

vincix · 04-13-2016, 04:17 AM

I am running Centos 7 and Apache 2.4.6. I'm trying to install a certificate with Let's Encrypt.
This is what I'm running:

Code:

letsencrypt certonly --webroot -w /certs -d example.com mail.example.com www.example.com

If I run:
[root@hostname]# letsencrypt certonly --webroot -w /certs -d example.com
I get this:

Code:

Failed authorization procedure. example.com (http-01): urn:acme:error:unauthorized :: 
The client lacks sufficient authorization :: 
Invalid response from http://example.com/.well-known/acme-challenge/randomlygeneratedstring [1.2.3.4]: 404
IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: example.com
   Type:   unauthorized
   Detail: Invalid response from http://example.com/.well-known
   /acme-challenge/randomlygeneratedstring
   [1.2.3.4]: 404

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address.

Any ideas how I should approach this problem?

TenTenths · 04-13-2016, 05:16 AM

You'll probably find that you're running letsencrypt wrongly.

If you're using the --webroot plugin then the -w parameter is the /path/to/your/site/webroot/ not to where you want to store the cert.

So if your files are in /var/www/html/example/ then you need to use that as the -w parameter.

vincix · 04-13-2016, 05:34 AM

Quote:

Originally Posted by TenTenths

You'll probably find that you're running letsencrypt wrongly.

If you're using the --webroot plugin then the -w parameter is the /path/to/your/site/webroot/ not to where you want to store the cert.

So if your files are in /var/www/html/example/ then you need to use that as the -w parameter.

Thank you. That makes sense. I was wondering how it knows where to store the challenge strings

I'll let you know if it works. Thank you!

vincix · 04-13-2016, 06:26 AM

The thing is, the root directory is /var/www/html, not /var/www/html/example.
I don't have a folder called example (my domain, I mean, of course) under the html folder.

So it still isn't working. Any ideas?

TenTenths · 04-13-2016, 06:57 AM

I just gave those paths as examples, put the correct path to your DocumentRoot folder for your domain.

vincix · 04-13-2016, 07:36 AM

Quote:

Originally Posted by TenTenths

I just gave those paths as examples, put the correct path to your DocumentRoot folder for your domain.

Yes, I did so, but it's the same thing. I usually have a redirect directive configured in httpd.conf, but I deleted in order to see if it works - I saw that it uses 80 to check for the random string. But it doesn't work.

TenTenths · 04-13-2016, 07:43 AM

So are you trying to renew a cert or is this the first time set-up you're doing?

Does your site make use of SSL already?

vincix · 04-14-2016, 05:00 AM

Hi,

Thanks for replying again

Yes, I already use a self-signed certificate. How does this affect the situation?

TenTenths · 04-14-2016, 11:01 AM

Quote:

Originally Posted by vincix

Yes, I already use a self-signed certificate. How does this affect the situation?

At a guess it's possible if you're redirecting the authentication request to SSL then LetsEncrypt is not accepting the self-signed cert.

Disable SSL (and redirection) on your site and just try it with pure http only
to see if that gets your cert issued.

For what it's worth, I changed my wife's blog to https with a letsencrypt cert in about 10 minutes. If you think it might be useful I captured each of my steps and can write it up.

vincix · 04-14-2016, 12:08 PM

What I did was back up httpd.conf and ssl.conf, the only configuration files that were different from the original, and I reinstalled apache. Then all of a sudden it worked:

Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/example.com/fullchain.pem.

The problem is that I don't know why it didn't work before. I had deleted the welcome screen, indeed, and I had a few password protected folders (using httpd, basic authentication, etc.), but I don't know exactly what the trouble was.

TenTenths · 04-14-2016, 12:12 PM

Well at least you got sorted