I had working Let's encrypt certificates some months ago (with the old letsencrypt client). The server I am using is nginx.
Certbot is creating the .well-known folder, but not the acme-challenge folder
Now I tried to create new certificates via ~/certbot-auto certonly --webroot -w /var/www/webroot -d domain.com -d www.domain.com -d git.domain.com
But I always get errors like this:
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: git.domain.com
Type: unauthorized
Detail: Invalid response from
http://git.domain.com/.well-known/acme-challenge/ZLsZwCsBU5LQn6mnzDBaD6MHHlhV3FP7ozenxaw4fow:
"<.!DOCTYPE html>
<.html lang='en'>
<.head prefix='og: http://ogp.me/ns#'>
<.meta charset='utf-8'>
<.meta content='IE=edge' http-equiv"
Domain: www.domain.com
Type: unauthorized
Detail: Invalid response from
http://www.domain.com/.well-known/acme-challenge/7vHwDXstyiY0wgECcR5zuS2jE57m8I3utszEkwj_mWw:
"<.html>
<.head><.title>404 Not Found</title></head>
<.body bgcolor="white">
<.center><.h1>404 Not Found</h1></center>
(Of course the dots inside the HTML tags are not really there)
I have looked for a solution, but didn't found one yet. Does anybody know why certbot is not creating the folders?
Thanks in advance!
The problem was the nginx configuration. I replaced my long configuration files with the simplest config possible:
server {
listen 80;
server_name domain.com www.domain.com git.domain.com;
root /var/www/domain/;
}
Then I was able to issue new certificates.
The problem with my long configuration files was (as far as I can tell) that I had the these lines:
location ~ /.well-known {
allow all;
}
But they should be:
location ~ /.well-known/acme-challenge/ {
allow all;
}
Now the renewal works, too.