certbot 更新 letsencrypt 证书总报 404 错误，排查半天找不到原因

[nowheretoseek]

证书更新用的是存放在 /etc/letsencrypt/renewal/的配置文件，总报这个 404 错误，验证文件也的确没有成功保存至/var/www/html/mysite/.well-known/acme-challenge/下面，不知怎么解决了，哪位朋友碰到过这个情况，请不吝赐教。

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for mydomain.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (mydomain.com) from /etc/letsencrypt/renewal/mydomain.com.conf produced an unexpected error: Failed authorization procedure. mydomain.com ( http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: 1.2.3.4: Invalid response from https://www.mydomain.com/.well-known/acme-challenge/wpQ9UaWBUJja7pbnZVmh5sU81zUkUOGCsGPqotpS2Hs: 404. Skipping.

配置文件是

cat /etc/letsencrypt/renewal/mydomain.com.conf

# renew_before_expiry = 30 days
version = 0.31.0
archive_dir = /etc/letsencrypt/archive/mydomain.com
cert = /etc/letsencrypt/live/mydomain.com/cert.pem
privkey = /etc/letsencrypt/live/mydomain.com/privkey.pem
chain = /etc/letsencrypt/live/mydomain.com/chain.pem
fullchain = /etc/letsencrypt/live/mydomain.com/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = webroot
server = https://acme-v02.api.letsencrypt.org/directory
account = d7e85a2d2857915eb10ca8c2df5433d3
[[webroot_map]]
mydomain.com = /var/www/html/mydomain

renew 时没有除 404 之外的错误提示，运行certbot certificates一直有这个 warning：OCSP check failed for /etc/letsencrypt/live/mydomain.com/cert.pem (are we offline?)

我怀疑是网络层面的原因，因为之前自动更新都没问题的。根据 https://v2ex.com/t/658605 反馈的 DNS 污染问题，已经23.32.3.72 ocsp.int-x3.letsencrypt.org写在/etc/hosts，但没用。

尝试申请一张新证书，仍报这个错误。

[jim9606]

会不会是 certbot 没权限写 acme-challenge 目录？

[nowheretoseek]

@jim9606 不是权限问题，因为用 sudo 和 root 都运行过，都是 404 错误

[lonewolfakela]

这说的是验证服务器尝试访问 https://www.mydomain.com/.well-known/acme-challenge/wpQ9UaWBUJja7pbnZVmh5sU81zUkUOGCsGPqotpS2Hs 但是得到了 404 的结果，我觉得你得检查下你的 web server 的配置是不是哪儿不对导致从外部访问不到这个地址。
另外如果不行的话可以尝试改成 DNS validation 试试

[nowheretoseek]

@lonewolfakela 谢谢，问题解决了。

可能是 apache 服务器升级导致的。我测试发现`well-known/acme-challenge/1.html`（没有.）和`.well-known/1.html`都可以访问，`.well-known/acme-challenge/1.html`却 404 ，于是搜索`apache .well-known 404`，在[404 error only on folder with name "acme-challenge" - Server - Let's Encrypt Community Support]( https://community.letsencrypt.org/t/404-error-only-on-folder-with-name-acme-challenge/70921/5)得到解决办法，就是配置文件中加入了
```
Alias /.well-known/acme-challenge/ /var/www/html/mysite/.well-known/acme-challenge/
<Directory /var/www/html/mysite/.well-known/acme-challenge/>
AllowOverride None
Require all granted
Satisfy Any
</Directory>
```

大概率跟 apache 升级有关，也不排除我之前改了什么记不起来的配置项。

刚发现 webroot 方法是不会在`.well-known/acme-challenge/`目录下生成验证文件的，我用`ls`看到的应该是很早之前用 manual 方法时生成的。