A couple months ago I set up an RPi as a test web server. A week ago, my Let’s Encrypt certificate expired and wasn’t renewed. This is my first time dealing with such things, and I’m not sure where to go from here. E.g., can the certificate be ‘fixed’, or do I need a new one?
I verified that the actual website works, and can be accessed via http.
My hardware and software:
- Device model : RPi 3 Model B+ (aarch64)
- Let's Encrypt Cert : Valid until 2026-Aug-5 01:47:56
- systemd status : No services failed
[ ] 0 OpenSSH Client: Feature-rich SSH, SFTP and SCP client
[ ] 1 Samba Client: access SMB/CIFS/Samba network shares
[ ] 84 Lighttpd: Extremely lightweight webserver
[ ] 88 MariaDB: Persistent cached file-per-table database server
[ ] 89 PHP: Hypertext Preprocessor for dynamic web content
[ ] 92 Certbot: Obtain and renew Let's Encrypt SSL certs for HTTPS
[ ] 96 Samba Server: Feature-rich SMB/CIFS server
[ ] 103 DietPi-RAMlog: Makes /var/log a RAM disk, preserves file structure on reboot
[ ] 105 OpenSSH Server: Feature-rich SSH server with SFTP and SCP support
My services:
●─ Single Service Options -------------●
nmbd : enabled | included | Affinity 0-3
smbd : enabled | included | Affinity 0-3
mariadb : enabled | included | Affinity 0-3
php8.4-fpm : enabled | included | Affinity 0-3
lighttpd : enabled | included | Affinity 0-3
cron : enabled | included | Affinity 0-3
ssh : enabled | included | Affinity 0-3
dietpi-vpn : disabled | included | Affinity 0-3
dietpi-cloudshell : disabled | included | Affinity 0-3
noip-duc : enabled | included | Affinity 0-3
Add : Add missing service to DietPi-Services
Running certbot:
sudo certbot renew --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/MY_SITE.net.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Account registered.
Simulating renewal of an existing certificate for MY_SITE.net
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: MY_SITE.net
Type: unauthorized
Detail: 73.128.102.145: Invalid response from http://MY_SITE.net/.well-known/acme-challenge/8dtxEOrVkqLiIz9eLAsILqfjgaH-KYeGYrqxWibkmig: 404
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
Failed to renew certificate MY_SITE.net with error: Some challenges have failed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All simulated renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/MY_SITE.net/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
I do not have a “.well-known/” directory.
TIA for any push in the right direction.