From: "Steven Levine" <ecs-isp@2rosenthals.com>
Message-ID: <675102f2.14.mr2ice.fgrirsq@earthlink.net>
Date: Wed, 04 Dec 2024 17:33:38 -0800
To: "eCS ISP Mailing List" <ecs-isp@2rosenthals.com>
In-Reply-To: <list-11320718@2rosenthals.com>
Subject: Re: [eCS-ISP] (uacme) certificate renew issue

In <list-11320718@2rosenthals.com>, on 12/04/24
   at 06:21 PM, "Massimo S." <ecs-isp@2rosenthals.com> said:

Hi,

>i didn't change anything,

So you claim.  I see you figured out what you changed. :-)

>{
>"type": "urn:ietf:params:acme:error:unauthorized",
>"detail": "1.2.3.4: Invalid response from 
>http://www.mydomain.it/.well-known/acme-challenge/pLTPh5BwkH6reeUtEnlynzNgrL8gYSctv1d3-D3eyiM:
>404", "status": 403
>}

For the layman, uacme is telling us that it could not access to token. 
When a 404 failure happens, the first thing to do is try the URL outside
of uacme with wget or curl

  wget
http://www.mydomain.it/.well-known/acme-challenge/pLTPh5BwkH6reeUtEnlynzNgrL8gYSctv1d3-D3eyiM

would have shown that the file really was not accessible.  If the token
file is gone by the time you are ready to test, create a file named foo in
the acme-challenge directory and try

  wget http://www.mydomain.it/.well-known/acme-challenge/foo

>of course it's not an issue on port 80 or some FW rule closing something
>i've also tried without firewall

This not the most effective way to test.  Since uacme cannot retrieve the
file you need test whether or not you can retrieve the file outside of
uacme.

>i've also restarted the web server to avoid performance issues i've check
>the paths tenths of times

If you had tested with wget and looked at the apache error logs you might
have figured out what you did.

Steven

-- 
----------------------------------------------------------------------
"Steven Levine" <steve53@earthlink.net>  Warp/DIY/BlueLion etc.
www.scoug.com www.arcanoae.com www.warpcave.com
----------------------------------------------------------------------