I want to install let's encrypt certificate on my server for domain.com, www.domain.com and mail.domain.com. so I created the following domain-site.conf file for virtual hosts:

<VirtualHost *:80>
ServerAdmin admin@domain.com
DocumentRoot "/home"
ServerName domain.com
ServerAlias www.domain.com
ErrorLog "/var/log/httpd/domain.error_log"
CustomLog "/var/log/httpd/domain.access_log" common
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.domain.com [OR]
RewriteCond %{SERVER_NAME} =domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

<VirtualHost *:80>
ServerAdmin admin@domain.com
DocumentRoot "/home"
ServerName mail.domain.com
ErrorLog "/var/log/httpd/mail.domain.error_log"
CustomLog "/var/log/httpd/mail.domain.access_log" common

and then when I run sudo certbot --apache command and hit the enter to install certificate for all 3 names, it can not install certificate for mail.domain.com and gives the below output. how to solve the issue?

You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/domain.com.conf)

It contains these names: domain.com, www.domain.com

You requested these names for the new certificate: domain.com, mail.domain.com,

Do you want to expand and replace this existing certificate with the new
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: e
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for mail.domain.com
Waiting for verification...
Challenge failed for domain mail.domain.com
http-01 challenge for mail.domain.com
Cleaning up challenges
Some challenges have failed.

- The following errors were reported by the server:

Domain: mail.domain.com
Type:   unauthorized
Detail: Invalid response from
[ip]: "<html>\r\n<head><title>404 Not
Found</title></head>\r\n<body>\r\n<center><h1>404 Not
Found</h1></center>\r\n<hr><center>nginx/1.18.0 (Ub"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
  • 2
    certbot connected to some server which is apparently nginx. But you provided only an Apache configuration. Did you omit some important details? Sep 2 '20 at 16:25
  • 1
    Good spot @michael-hampton - I didn't spot the nginx stanza in the 404
    – jaygooby
    Sep 3 '20 at 10:26
  • @MichaelHampton I never installed nginx myself on the server and it was also a surprise for me where nginx has come from! I have installed postfix and devocot on my server. don't they install anything related to nginx?
    – SAndroid
    Sep 3 '20 at 10:30
  • 1
    Check to see if nginx is actually installed and running on your server. If it is not, then check your DNS records to ensure that they are correct. Sep 3 '20 at 14:19

That error means there's an HTTP 404 for the certbot file that it expects to see at mail.domain.com/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU

Can you see this file in /home/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU?

Can you write your own file there, to test that it's being served?

echo wat > /home/.well-known/acme-challenge/wat

Then you should be able to curl it with:

curl mail.domain.com/.well-known/acme-challenge/wat

Given that mail.domain.com has got the same docroot as domain.com and www.domain.com you should also be able to curl domain.com/.well-known/acme-challenge/wat and curl www.domain.com/.well-known/acme-challenge/wat

If that doesn't work, then there's something up with your Apache config, or possibly the ownership/permissions of /home, /home/.well-known or /home/.well-known/acme-challenge

  • thanks for your answer. the problem was related to DNS configurations!
    – SAndroid
    Sep 3 '20 at 10:35

so the problem was related to DNS forward zone configurations. I had defined mail IN A in forward zone and 60 IN PTR mail.domain.com in reverse zone. I changed the record in forward zone to mail IN A <server_ip> and the problem got disappeared.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.