Certbot-auto renew failed - 客户端缺乏足够的授权 - 为什么？

Question

所以多年来，我将多个域的 certbot-auto 证书放在同一台服务器上（Apache 2.2 - Debian 7）。但是今天我看到我的 crontab 没有更新证书，所以我尝试在 SSH 中使用以下行：

./certbot-auto renew

这是错误声明：

    Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/www.domain1.fr.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for domain2.fr
http-01 challenge for domain1.fr
http-01 challenge for www.domain2.fr
http-01 challenge for www.domain1.fr
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (www.domain1.fr) from /etc/letsencrypt/renewal/www.domain1.fr.conf produced an unexpected error: Failed authorization procedure. domain2.fr (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://domain2.fr/.well-known/acme-challenge/ZIp1x0730t7J0iJii67jS95Fli2eLhPA12SgXGzR6P8 [151.80.100.117]: 503, www.domain1.fr (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.domain1.fr/.well-known/acme-challenge/hoy1fNZkCyBkK2kA7gQhhW8QpWiCk7K00kFHsxNcZgc [151.80.100.117]: 503, domain1.fr (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://domain1.fr/.well-known/acme-challenge/LvfaVWC1VzbOehKgFvJe1gNd3tsEWUH3eBDan1-q8Oo [151.80.100.117]: 503, www.domain2.fr (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.domain2.fr/.well-known/acme-challenge/fOAwU_IAvKW7AC9nAFNZ6InVHrYB9VmuB9tGvEGpU2c [151.80.100.117]: 503. Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/www.domain1.fr/fullchain.pem (failure)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
** DRY RUN: simulating 'certbot renew' close to cert expiry
**          (The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/www.domain1.fr/fullchain.pem (failure)
** DRY RUN: simulating 'certbot renew' close to cert expiry
**          (The test certificates above have not been saved.)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: domain2.fr
   Type:   unauthorized
   Detail: Invalid response from
   http://domain2.fr/.well-known/acme-challenge/ZIp1x0730t7J0iJii67jS95Fli2eLhPA12SgXGzR6P8
   [151.80.100.117]: 503

   Domain: www.domain1.fr
   Type:   unauthorized
   Detail: Invalid response from
   http://www.domain1.fr/.well-known/acme-challenge/hoy1fNZkCyBkK2kA7gQhhW8QpWiCk7K00kFHsxNcZgc
   [151.80.100.117]: 503

   Domain: domain1.fr
   Type:   unauthorized
   Detail: Invalid response from
   http://domain1.fr/.well-known/acme-challenge/LvfaVWC1VzbOehKgFvJe1gNd3tsEWUH3eBDan1-q8Oo
   [151.80.100.117]: 503

   Domain: www.domain2.fr
   Type:   unauthorized
   Detail: Invalid response from
   http://www.domain2.fr/.well-known/acme-challenge/fOAwU_IAvKW7AC9nAFNZ6InVHrYB9VmuB9tGvEGpU2c
   [151.80.100.117]: 503

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.

我没有更改任何有关 Vhost 配置或服务器配置的内容，所以我不知道为什么 certbot 没有自动更新功能。

编辑：

所有域在DNS 中都有一条A 记录，并具有正确的IP。

我的/.well-known/ 文件夹目前拥有 0777 权限。

Answer 1

在我的情况下，我已经为 Apache 配置中的一些虚拟主机更新了 DocumentRoot；从而打破 LE 更新。

您可以在/etc/letsencrypt/renewal/mysite.com.conf下查看LE更新配置

webroot_map 部分下的那些路径：

[[webroot_map]]
mysite.com = /var/www/vhosts/mysite.com
www.mysite.com = /var/www/vhosts/mysite.com

应该与您的 Apache vhost 配置中的 DocumentRoot 匹配

按照我的示例，您可以使用以下方法进行比较：grep DocumentRoot /etc/apache2/sites-enabled/mysite.com.conf

Answer 2

在我们的例子中，我们的 DNS 工作正常，但仍然收到 lacks sufficient authorization 错误。

终于在这里找到了一个资源： https://webdock.io/en/docs/webdock-control-panel/common-certbot-errors

这让跑步大白于天下：

certbot rollback

接着是：

certbot renew

我们终于可以更新证书了。

我们正准备启动一个全新的虚拟机并重新迁移所有内容 - 因为在多次尝试解决该问题后，证书终于过期了，我们处于紧缩状态。

也许这会减轻一些人的痛苦。

Answer 3

使用 nginx-certbot 解决方案试试这个

sudo add-apt-repository ppa:certbot/certbot
sudo apt install python-certbot-nginx
sudo certbot --nginx -d xxx.xxx.com

https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-18-04

Answer 4

我找到了一个替代解决方案，但我没有解决问题。

我做了here 之类的技巧： 我使用了以下命令：

./certbot-auto certonly -d www.domain1.fr -d domain1.fr -d domain2.fr -d www.domain2.fr

我的证书现在又可以使用了。

所以问题（我想）是certbot-auto renew 匹配每个网站的 webroot 的方式。

非常感谢@Martin Zeitler 的帮助和时间。

Answer 5

确保每个主机名在DNS 中都有一个A 记录，并且每个目录.well-known/acme-challenge 都可以访问；当它抱怨503 Service Unavailable 时，它再明显不过了。日志文件/var/log/letsencrypt/letsencrypt.log 可能包含更多信息。

a) 在一个域上，.well-known/acme-challenge 需要从 URL 重写中排除：

RewriteCond %{REQUEST_URI} !^\.well-known/(.*)$

b) 在另一个域上，:80 不得重定向到 :443。