1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
| Root logging level set at 10
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requested authenticator webroot and installer None
Single candidate plugin: * webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot.plugins.webroot:Authenticator
Initialized: <certbot.plugins.webroot.Authenticator object at 0x7f91884fea10>
Prep: True
Selected authenticator <certbot.plugins.webroot.Authenticator object at 0x7f91884fea10> and installer None
Picked account: <Account(RegistrationResource(body=Registration(status=None, contact=(u'mailto:b.hodzic@live.nl',), agreement=u'https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf', key=JWKRSA(key=<ComparableRSAKey(<cryptography.hazmat.backends.openssl.rsa._RSAPublicKey object at 0x7f918d634890>)>)), uri=u'https://acme-staging.api.letsencrypt.org/acme/reg/4935514', new_authzr_uri=u'https://acme-staging.api.letsencrypt.org/acme/new-authz', terms_of_service=u'https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf'), 7fa797679cefcf8bb3ada688159f1ede, Meta(creation_host=u'MIJNSERVER', creation_dt=datetime.datetime(2017, 10, 19, 9, 40, 49, tzinfo=<UTC>)))>
Sending GET request to https://acme-staging.api.letsencrypt.org/directory.
Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org
https://acme-staging.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 581
Received response:
HTTP 200
Server: nginx
Content-Type: application/json
Content-Length: 581
Replay-Nonce: sQNg2AZ8gJNTNlN9tj8jpHNgZqRsHWkqz3LwgKsbWe4
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
Expires: Fri, 20 Oct 2017 13:30:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 20 Oct 2017 13:30:43 GMT
Connection: keep-alive
{
"g28weNLLai0": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
"key-change": "https://acme-staging.api.letsencrypt.org/acme/key-change",
"meta": {
"terms-of-service": "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf"
},
"new-authz": "https://acme-staging.api.letsencrypt.org/acme/new-authz",
"new-cert": "https://acme-staging.api.letsencrypt.org/acme/new-cert",
"new-reg": "https://acme-staging.api.letsencrypt.org/acme/new-reg",
"revoke-cert": "https://acme-staging.api.letsencrypt.org/acme/revoke-cert"
}
Obtaining a new certificate
Requesting fresh nonce
Sending HEAD request to https://acme-staging.api.letsencrypt.org/acme/new-authz.
https://acme-staging.api.letsencrypt.org:443 "HEAD /acme/new-authz HTTP/1.1" 405 0
Received response:
HTTP 405
Server: nginx
Content-Type: application/problem+json
Content-Length: 91
Allow: POST
Replay-Nonce: QRDA6RDVY9QEfNlvkMRObSiYN00AR8Vv9-Bd0Af-SVM
Expires: Fri, 20 Oct 2017 13:30:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 20 Oct 2017 13:30:43 GMT
Connection: keep-alive
Storing nonce: QRDA6RDVY9QEfNlvkMRObSiYN00AR8Vv9-Bd0Af-SVM
JWS payload:
{
"identifier": {
"type": "dns",
"value": "mijndomain.nl"
},
"resource": "new-authz"
}
Sending POST request to https://acme-staging.api.letsencrypt.org/acme/new-authz:
{
"protected": "eyJub25jZSI6ICJRUkRBNlJEVlk5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXQVMcTlLbUVrVFpXR0NDdG9Nc1FSWE0xY05WTFk1SXVxT0JIUnNUdWJPRlBGWGFhc2liXzN1U0FRMG45UVNTMzltOHdaeWNraUptS2ZGVUlsVjJYb1BXOEI2dHNlZllvWnJ3azBFckc2NGVjMnppQTFKU3pZSEg1b1dDbGlXbVFYY2oxQVdCQUNtaFBmeHc4bHJmLXROU01lcU5ZejgxVFY3SjE5U3VCNDBNNE5HQXl6TnpIZ3UxMTQwM0FLX0k2V0FLT0lPSzVhT1M2UVREVU9Ibklncm1mTE9YNXBEZXI0WTZGbFpCejNEaFh3clBLSVhTWnpCSER2TWRqRkRQTW9DUGJhMkFmcDU5cDQ3cXhxelpOV2p6OWM3cFpVZkp4WktPZnh5QVlZSXVnV05YWnNXakhxZ0hGdVNVU19jSmJPd0V3In19",
"payload": "ewogICJpZGVudGlmaWVyIjogewogICAgInR5cGUiOiAiZG5zIiwgCiAXXXXXXXXXXXXXXXXF1dGh6Igp9",
"signature": "umlRivkFFvkDzgjYD7xT0YtarD3w-IWJLIIh0XXXQpG2X8pN_yUIDfMx1mFEBwe2iPy2wcsMJjozjdk5nDgOFdFu873Jb4Fkbsmdx4nEfsZ-WvnERtHxUDRXHpmeAa-1iEtn5yeZiOgg"
}
https://acme-staging.api.letsencrypt.org:443 "POST /acme/new-authz HTTP/1.1" 201 1004
Received response:
HTTP 201
Server: nginx
Content-Type: application/json
Content-Length: 1004
Boulder-Requester: 4935514
Link: <https://acme-staging.api.letsencrypt.org/acme/new-cert>;rel="next"
Location: https://acme-staging.api.letsencrypt.org/acme/authz/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI
Replay-Nonce: 5e9rRLw-VgWbKiRiMA-pUlueNr39irW0OBbf0Tzm8Uo
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
Expires: Fri, 20 Oct 2017 13:30:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 20 Oct 2017 13:30:43 GMT
Connection: keep-alive
{
"identifier": {
"type": "dns",
"value": "mijndomain.nl"
},
"status": "pending",
"expires": "2017-10-27T13:30:43.279005944Z",
"challenges": [
{
"type": "dns-01",
"status": "pending",
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219187",
"token": "J3d3ZFSax-ulCHTZDZQYk"
},
{
"type": "http-01",
"status": "pending",
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219188",
"token": "Rj_4NgcH2UPzL1xxyWzQjHlPE"
},
{
"type": "tls-sni-01",
"status": "pending",
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219189",
"token": "-LTRvsgEf7MSx9EW-j_6Gfk"
}
],
"combinations": [
[
1
],
[
0
],
[
2
]
]
}
Storing nonce: 5e9rRLw-VgWbKiRiMA-pUxxm8Uo
Performing the following challenges:
http-01 challenge for mijndomain.nl
Using the webroot path /var/www/virtual/mijndomain for all unmatched domains.
Creating root challenges validation dir at /var/www/virtual/mijndomain/.well-known/acme-challenge
Attempting to save validation to /var/www/virtual/mijndomain/.well-known/acme-challenge/Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE
Waiting for verification...
JWS payload:
{
"keyAuthorization": "Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE.L3WrNgS3tdjdBdwdti2nfaUP0Cvnvk_bOQONDKyNaNI",
"type": "http-01",
"resource": "challenge"
}
Sending POST request to https://acme-staging.api.letsencrypt.org/acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219188:
{
"protected": "eyJub25jZSI6ICI1ZTlyUkx3LxjFuR3ZlM1VMcTlLbUVrVFpXR0NDdG9Nc1FSWE0xY05WTFk1SXVxT0JIUnNUdWJPRlBGWGFhc2liXzN1U0FRMG45UVNTMzltOHdaeWNraUptS2ZGVUlsVjJYb1BXOEI2dHNlZllvWnJ3azBFckc2NGVjMnppQTFKU3pZSEg1b1dDbGlXbVFYY2oxQVdCQUNtaFBmeHc4bHJmLXROU01lcU5ZejgxVFY3SjE5U3VCNDBNNE5HQXl6TnpIZ3UxMTQwM0FLX0k2V0FLT0lPSzVhT1M2UVREVU9Ibklncm1mTE9YNXBEZXI0WTZGbFpCejNEaFh3clBLSVhTWnpCSER2TWRqRkRQTW9DUGJhMkFmcDU5cDQ3cXhxelpOV2p6OWM3cFpVZkp4WktPZnh5QVlZSXVnV05YWnNXakhxZ0hGdVNVU19jSmJPd0V3In19",
"payload": "ewogICJrZXlBdXRob3JpemF0aW9uIjx0ZGpkQmR3ZHRpMm5mYVVQMEN2bnZrX2JPUU9OREt5TmFOSSIsIAogICJ0eXBlIjogImh0dHAtMDEiLCAKICAicmVzb3VyY2UiOiAiY2hhbGxlbmdlIgp9",
"signature": "HBJ4rFUUBNpgDJ_SAnecLaJ3PBrAB5km02VXZRyXxqlkfKQfe041-OqjsUl28kV80k43-uGxJX_e989x8sC9kkfamwXC17w9ul2Dw_CLdzt4teGJl7rIuQ07qGKrS9XWGIm03Gs-_atFdNCiPZ5sq59oFBfZdgHks_FBWxU6kWcIKzEwEQxXpxItWpGs8ey-c0DX3SPtLNd4tNxAx9DAqFI4BwgPolMGYkaEgqWzSTSursI1z62MVfWh1k1mgFWXOYih7PUmk65PDM40yPYcJ7Vu-xYoo-2ijdJaA"
}
https://acme-staging.api.letsencrypt.org:443 "POST /acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219188 HTTP/1.1" 202 338
Received response:
HTTP 202
Server: nginx
Content-Type: application/json
Content-Length: 338
Boulder-Requester: 4935514
Link: <https://acme-staging.api.letsencrypt.org/acme/authz/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI>;rel="up"
Location: https://acme-staging.api.letsencrypt.org/acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219188
Replay-Nonce: WwA98n5LDQUVGG7J2xtKr6lmM5QcZJUtqGCCAN2iY8k
Expires: Fri, 20 Oct 2017 13:30:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 20 Oct 2017 13:30:43 GMT
Connection: keep-alive
{
"type": "http-01",
"status": "pending",
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219188",
"token": "Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE",
"keyAuthorization": "Rj_4NgcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxKyNaNI"
}
Storing nonce: WwA98n5LDQUVGG7J2xtKr6lmM5QcZJUtqGCCAN2iY8k
Sending GET request to https://acme-staging.api.letsencrypt.org/acme/authz/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI.
https://acme-staging.api.letsencrypt.org:443 "GET /acme/authz/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI HTTP/1.1" 200 1947
Received response:
HTTP 200
Server: nginx
Content-Type: application/json
Content-Length: 1947
Link: <https://acme-staging.api.letsencrypt.org/acme/new-cert>;rel="next"
Replay-Nonce: ubtVhVQ38AQRDtwi62NoiqF3i5UMY0CLiixlGbOcP-8
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
Expires: Fri, 20 Oct 2017 13:30:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 20 Oct 2017 13:30:46 GMT
Connection: keep-alive
{
"identifier": {
"type": "dns",
"value": "mijndomain.nl"
},
"status": "invalid",
"expires": "2017-10-27T13:30:43Z",
"challenges": [
{
"type": "dns-01",
"status": "pending",
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219187",
"token": "J3d3ZFSaYy060uS0nVDZtafMpYo_Myx-ulCHTZDZQYk"
},
{
"type": "http-01",
"status": "invalid",
"error": {
"type": "urn:acme:error:unauthorized",
"detail": "Invalid response from http://mijndomain.nl/.well-known/acme-challenge/Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE: \"\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\t\u003chead\u003e\n\t\t\u003clink rel=\"icon\" href=\"/img/favicon.png\" sizes=\"16x16\"\u003e\n\t\t\u003cmeta http-equiv=\"Content-Type\" conte\"",
"status": 403
},
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219188",
"token": "Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE",
"keyAuthorization": "Rj_4NgcH2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNI",
"validationRecord": [
{
"url": "http://mijndomain.nl/.well-known/acme-challenge/Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE",
"hostname": "mijndomain.nl",
"port": "80",
"addressesResolved": [
"IP_ADDRESS_VAN_mijndomain.nl",
"IPHEX_ADDRESS_VAN_mijndomain.nl"
],
"addressUsed": "IPHEX_ADDRESS_VAN_mijndomain.nl",
"addressesTried": []
}
]
},
{
"type": "tls-sni-01",
"status": "pending",
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/EfVvmNYtnzZk11_HRsFt8wNK-uWOsrUPIYDO0uJaERI/70219189",
"token": "-LTRvsgEf7MS5eu2WuOpNySXx_aQBcZqN9EW-j_6Gfk"
}
],
"combinations": [
[
1
],
[
0
],
[
2
]
]
}
Reporting to user: The following errors were reported by the server:
Domain: mijndomain.nl
Type: unauthorized
Detail: Invalid response from http://mijndomain.nl/.well-known/acme-challenge/Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE: "<!DOCTYPE html>
<html>
<head>
<link rel="icon" href="/img/favicon.png" sizes="16x16">
<meta http-equiv="Content-Type" conte"
To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address.
Cleaning up challenges
Removing /var/www/virtual/mijndomain/.well-known/acme-challenge/Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE
Unable to clean up challenge directory /var/www/virtual/mijndomain/.well-known/acme-challenge
Error was: [Errno 39] Directory not empty: '/var/www/virtual/mijndomain/.well-known/acme-challenge'
Exiting abnormally:
Traceback (most recent call last):
File "/usr/bin/certbot", line 11, in <module>
load_entry_point('certbot==0.17.0', 'console_scripts', 'certbot')()
File "/usr/lib/python2.7/dist-packages/certbot/main.py", line 753, in main
return config.func(config, plugins)
File "/usr/lib/python2.7/dist-packages/certbot/main.py", line 692, in certonly
lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
File "/usr/lib/python2.7/dist-packages/certbot/main.py", line 82, in _get_and_save_cert
lineage = le_client.obtain_and_enroll_certificate(domains, certname)
File "/usr/lib/python2.7/dist-packages/certbot/client.py", line 357, in obtain_and_enroll_certificate
certr, chain, key, _ = self.obtain_certificate(domains)
File "/usr/lib/python2.7/dist-packages/certbot/client.py", line 318, in obtain_certificate
self.config.allow_subset_of_names)
File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 81, in get_authorizations
self._respond(resp, best_effort)
File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 138, in _respond
self._poll_challenges(chall_update, best_effort)
File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 202, in _poll_challenges
raise errors.FailedChallenges(all_failed_achalls)
FailedChallenges: Failed authorization procedure. mijndomain.nl (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://mijndomain.nl/.well-known/acme-challenge/Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE: "<!DOCTYPE html>
<html>
<head>
<link rel="icon" href="/img/favicon.png" sizes="16x16">
<meta http-equiv="Content-Type" conte"
Failed authorization procedure. mijndomain.nl (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://mijndomain.nl/.well-known/acme-challenge/Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE: "<!DOCTYPE html>
<html>
<head>
<link rel="icon" href="/img/favicon.png" sizes="16x16">
<meta http-equiv="Content-Type" conte"
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: mijndomain.nl
Type: unauthorized
Detail: Invalid response from
http://mijndomain.nl/.well-known/acme-challenge/Rj_4NgcH2UPzL1OHOvr2RahgWa3ZKUBgI6yWzQjHlPE:
"<!DOCTYPE html>
<html>
<head>
<link rel="icon" href="/img/favicon.png"
sizes="16x16">
<meta http-equiv="Content-Type" conte"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. |
:strip_exif()/u/53522/crop583d477015a24.gif?f=community)
:strip_exif()/u/70496/glowmouse2.gif?f=community)
:strip_exif()/u/389747/iconcroppedresizedsmallercroppedcroppedresized.gif?f=community)