Question

我知道这个问题已被多次询问过，但我需要一些具体的帮助，因为我一直在接受其他几个主题的建议，但到目前为止还没有任何工作。

我正在尝试使用certbot-auto renew在Ubuntu 14.04中续订我的SSL证书，并且我正在运行Apache2服务器和nginx。我得到certbot-auto renew的以下输出：

  root@PostgreSQLServer:/# sudo certbot-auto renew
  Saving debug log to /var/log/letsencrypt/letsencrypt.log

  -------------------------------------------------------------------------------
  Processing /etc/letsencrypt/renewal/my-domain.com.conf
  -------------------------------------------------------------------------------
  Cert is due for renewal, auto-renewing...
  Renewing an existing certificate
  Performing the following challenges:
  http-01 challenge for my-domain.com
  Waiting for verification...
  Cleaning up challenges
  Attempting to renew cert from /etc/letsencrypt/renewal/my-domain.com.conf produced an unexpected error: Failed authorization procedure. my-domain.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://my-domain.com/.well-known/acme-challenge/ailNmgZADpb4QBipKM57sOi9w3PwNkwBwVFiRYs7i40: "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
  <html><head>
  <title>404 Not Found</title>
  </head><body>
  <h1>Not Found</h1>
  <p". Skipping.

  All renewal attempts failed. The following certs could not be renewed:
    /etc/letsencrypt/live/my-domain.com/fullchain.pem (failure)
  1 renew failure(s), 0 parse failure(s)

  IMPORTANT NOTES:
   - The following errors were reported by the server:

     Domain: my-domain.com
     Type:   unauthorized
     Detail: Invalid response from
     http://my-domain.com/.well-known/acme-challenge/ailNmgZADpb4QBipKM57sOi9w3PwNkwBwVFiRYs7i40:
     "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
     <html><head>
     <title>404 Not Found</title>
     </head><body>
     <h1>Not Found</h1>
     <p"

     To fix these errors, please make sure that your domain name was
     entered correctly and the DNS A record(s) for that domain
     contain(s) the right IP address.

我确保.well-known中存在/var/www/my-domain.com/public_html文件夹，当我在浏览器中导航到http://my-domain.com/.well-known/时，我能够看到该目录的内容。我还在acme-challenge中添加了一个.well-known文件夹，其中包含一个用于测试的test.txt文件;我能够在浏览器中访问目录和文本文件。

我发现在运行acme-challenge命令时未创建certbot-auto文件夹，因此它似乎是一个权限问题。我以root身份运行certbot-auto，但还在www-data和.well-known文件夹上为acme-challenge用户提供了写入权限（root和www-data用户正在运行apache2和nginx进程）。

即使在授予写入权限后，我仍然会收到上面详述的404错误。

我还有一个通过crontab运行的自动证书续订流程，我将输出记录到本地文件中。在该日志文件中，我看到续订请求似乎正常工作，直到certbot-auto从0.9.3升级到0.10.1。以下是升级发生时日志文件中的示例：

  -------------------------------------------------------------------------------
  Processing /etc/letsencrypt/renewal/offensively-bad.com.conf
  -------------------------------------------------------------------------------

  The following certs are not due for renewal yet:
    /etc/letsencrypt/live/offensively-bad.com/fullchain.pem (skipped)
  No renewals were attempted.

  -------------------------------------------------------------------------------
  Processing /etc/letsencrypt/renewal/offensively-bad.com.conf
  -------------------------------------------------------------------------------

  The following certs are not due for renewal yet:
    /etc/letsencrypt/live/offensively-bad.com/fullchain.pem (skipped)
  No renewals were attempted.
  Upgrading certbot-auto 0.9.3 to 0.10.1...
  Replacing certbot-auto...
  Creating virtual environment...
  Installing Python packages...
  Installation succeeded.

  -------------------------------------------------------------------------------
  Processing /etc/letsencrypt/renewal/offensively-bad.com.conf
  -------------------------------------------------------------------------------

  All renewal attempts failed. The following certs could not be renewed:
    /etc/letsencrypt/live/offensively-bad.com/fullchain.pem (failure)
  IMPORTANT NOTES:
   - The following errors were reported by the server:

     Domain: offensively-bad.com
     Type:   unauthorized
     Detail: Invalid response from
     http://offensively-bad.com/.well-known/acme-challenge/tkSc8l-r1XVPIF5TosTbEXiYMa8sQnoXEjAEgAwRoqI:
     "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
     <html><head>
     <title>404 Not Found</title>
     </head><body>
     <h1>Not Found</h1>
     <p"

     To fix these errors, please make sure that your domain name was
     entered correctly and the DNS A record(s) for that domain
     contain(s) the right IP address.

您可以看到升级后，该过程开始失败并显示404消息。

我已经尝试了我在网上找到的所有建议并且完全被难倒了，所以任何帮助都会非常感激。提前谢谢！

Answer 1

我的问题是我的覆盆子pi raspbian Stretch上的一个太旧的certbot版本：

certbot --version

给予

certbot 0.10.2

apt-get install python-certbot-apache -t stretch-backports

诀窍：

certbot 0.21.1

然后只是

certbot --apache -d domain.com

希望这有帮助！

Answer 2

我必须编辑此配置文件：/etc/letsencrypt/renewal/offensively-bad.com.conf并修改[[webroot_map]]下方的行：

[[webroot_map]]
offensively-bad.com = /path/to/what/certbot/thinks/is/the/correct/webroot/path/initially/specified/by/the/user

在我的情况下，我将其更改为

    offensively-bad.com = /var/www/offensively-bad.com/public_html/

感谢letsencrypt的论坛帮助我。

certbot-auto：客户端缺乏足够的授权

2 个答案: