403 error: Authorizations for these names not found or expired

[ghost]

Hi,
From the first time i tried to create an SSL certificate, i continue to get this error

Error occurred: Status: 403, Detail: Error creating new cert :: Authorizations for these names not found or expired: sub.domain.com, www.sub.domain.com, Type: urn:acme:error:unauthorized

I managed to install a cert on a domain (let's say www.domain.com), but when i try to install the certificate on a different domain on the same machine, or a subdomain, i get the aforementioned error. I've already seen this issue and this one too, but none of these worked. I never installed any self-signed certificate, I've disabled the https redirecting within the .htaccess and added the www.sub.domain.com dns entry, but it still give me the same error again and again. I looked a bit within the code, but didn't found any useful information. I can say, however, that the challanges were successfully created within the /home/domain/public_html/sub/.well-known/acme-challange/ folder. The first certificate that I installed gave the same error multiple time, than it gave me a "malformed json" error and the following time it worked. I can't really say why.

EDIT:
If I try to open sub.domain.com/.well-known from the browser, it gives me a 403 error (Forbidden). Is this the expected behaviour? Maybe it's because of this...

I'm sorry to bother this much, thank you for your help!

[Prajithp]

No, it should list all files in that directory. Could you please check the permission of "/home/domain/public_html/sub/.well-known/" directory and all inner directories?

[ghost]

Hi, thank you for your help,
the folders have a read permission for both group and others. This probably means that there's an apache configuration that is avoiding files and folders starting with dot from being read. But still I don't know how to override it. I tried putting a .htaccess within the .well-known with this code:
Options All
Order allow,deny
Allow from All
But it still doesn't work...
The acme-challange folder and all its content have at least a read privilege for 'others'

EDIT:
I checked and it's true that everything that starts with a dot won't be listed or opened, even if it has read privilege and the htaccess tries to grant all permissions...

[divemasterza]

I have also the 403 error when creating the new certs.
I can list all the ACME challenges situated in /.well-known from the browser, and a new file is definitely being created on a new cert request.

It seems to happen only with newly created subdomains, I can generate a cert for an old domain without any errors

[ian81]

I have the same issue. Running domain + subdomain on CentOS7.x, cpanel56. Certificates on Domains/subdomains created many years ago on the same server seemed to work fine. Let me know what I can do to assist with troubleshooting,

[Prajithp]

@divemasterza @ian81 make sure you subdomains are correctly pointing to the server. For newly created subdomains, please allow few mins to propagate the DNS everywhere otherwise let'sencrypt may failed to reach the server and return 403 error while validating domain ownership.

[divemasterza]

Nope, definitely not that :( domain is resolving perfectly from the outside world. Defintely not a DNS propagation issue!

[Prajithp]

re-opening it. @divemasterza Could you share the domain names with me?

[divemasterza]

Sure you can try http://surveys.progressive-personnel.com

Domain was setup a couple days ago and I get the 403 error when requesting a cert.

It seems the issues started with 11.56.08 (can't confirm this though)

[jaggad]

Possible due to redirecting all http traffic to https causing self-signing loop when trying to get cert for subdomain .

Had the same issue: removed .htaccess redirect, added subdomain cert, added .htaccess redirect back in. Solved it for me

[ian81]

Subdomain has been active and working for approx. 1 month. No http to https redirection in the .htaccess, also removed any certs on the parent domain. Parent domain encounters the same error when trying to obtain SSL. Running latest cPanel (11.56.14). The subdomain was created with cPanel 11.54. The '.well-known/acme-challenge' files are getting created. Is there a log file that captures where/how this is breaking?

[Prajithp]

@divemasterza In your case the subdomain alias www.surveys.progressive-personnel.com is not resolving properly.

Will add an option to select alt-domains, so that these kind of issues will be fixed.

[ian81]

I am still having the same issue on a domain and subdomain. Its running drupal. I temporarily renamed the .htaccess file and updated to the latest script build (~9days ago). Same issue. Domain resolution works externally from multiple testing sources. Can view the /well-known/ challenges when the .htaccess file is renamed.

[jruston]

I am also having this problem.

[WilliamIsted]

@jackedgson solution worked for me after months of reinstalling the plugin, I was adamant that I'd broken something when cloning and using the official Let's Encrypt git repo. Renaming the .htaccess file (removing the redirect to https) instantly allowed the cPanel plugin to complete and install the Cert.

I added the following line to .htaccess directly under RewriteEngine On:
RewriteRule ^.well-known(.*)$ - [L,NC]
So if the well-known folder is requested (by Let's Encrypt) it doesn't process further rules and avoids any SSL redirection that happens below it.

Note: I also removed the following line as a precaution and have yet to confirm if it affects Let's Encrypt's process:
Header always set Strict-Transport-Security

[jaggad]

@WilliamIsted Ah, nice little line of code, I didn't even think of doing something like that (I've just been commenting out the redirect and adding it back it). Anyway, I'm glad I could help out with the issue.

[ian81]

Thanks @WilliamIsted ! the " RewriteRule ^.well-known(.*)$ - [L,NC] " bit worked awesome for me. I did not have the "Header always set Strict-Transport-Security" in my .htaccess file.

[Prajithp]

@WilliamIsted if you don't mind, Could you please update this in the Readme file and create a PR?