On Thu, Sep 03, 2026 at 11:34:34AM -0500, [email protected] wrote: >Just recently, I started seeing problems where one Let's Encrypt certificate >was not being renewed by acme-client. > >Digging around the issue after waiting a few days to see if the issue as >temporal, I found that the temporary file set by acme-client in >/var/www/acme/ is not available when Let's Encrypt checks for it; instead, >httpd is generating a 404. > >I'm running 7.9 > >$ uname -a >OpenBSD www 7.9 GENERIC#8 amd64 > >Relevant portions of /etc/acme-client.conf >------------------------------------------ > >authority letsencrypt-staging { >api url "https://acme-staging-v02.api.letsencrypt.org/directory"; >account key "/etc/acme/letsencrypt-staging-privkey.pem" } > >domain www.example.com { > domain key "/etc/ssl/private/www.example.com.key.pem" > domain full chain certificate "/etc/ssl/certs/www.example.com.chain.pem" > sign with letsencrypt-staging >} > > >Relevant parts of httpd.conf >---------------------------- > >server "www.example.com" { > alias "www2.example.com" > listen on 203.0.113.1 port 80 > listen on 3fff:a:b::2 port 80 > location "/.well-known/acme-challenge/*" { > root "/acme" > request strip 2 > pass > } > block return 301 "https://$HTTP_HOST$REQUEST_URI";
I took out this entire config and used /etc/examples/httpd.conf (simply changing the server to my server name (www.example.com). The problem persists, and httpd looks to possibly be the culprit here. More logs of the session follow. # acme-client -v www.example.com acme-client: /etc/ssl/private/www.example.org.key.pem: generated RSA domain key acme-client: https://acme-staging-v02.api.letsencrypt.org/directory: directories acme-client: acme-staging-v02.api.letsencrypt.org: DNS: 172.65.46.172 acme-client: acme-staging-v02.api.letsencrypt.org: DNS: 2606:4700:60:0:f41b:d4fe:4325:6026 acme-client: account key: https://acme-staging-v02.api.letsencrypt.org/acme/acct/999999999 acme-client: dochngreq: https://acme-staging-v02.api.letsencrypt.org/acme/authz/999999999/4333296883 acme-client: challenge, token: Cxjyj5atWIJv3n8OU7KJ87DbRPjflrBu_tgFBbRQI-I, uri: https://acme-staging-v02.api.letsencrypt.org/acme/chall/999999999/4333296883/Ies70A, status: 0 acme-client: /var/www/acme/Cxjyj5atWIJv3n8OU7KJ87DbRPjflrBu_tgFBbRQI-I: created acme-client: https://acme-staging-v02.api.letsencrypt.org/acme/chall/999999999/4333296883/Ies70A: challenge acme-client: order.status 0 acme-client: dochngreq: https://acme-staging-v02.api.letsencrypt.org/acme/authz/999999999/4333296883 acme-client: challenge, token: Cxjyj5atWIJv3n8OU7KJ87DbRPjflrBu_tgFBbRQI-I, uri: https://acme-staging-v02.api.letsencrypt.org/acme/chall/999999999/4333296883/Ies70A, status: 0 acme-client: /var/www/acme/Cxjyj5atWIJv3n8OU7KJ87DbRPjflrBu_tgFBbRQI-I: created acme-client: https://acme-staging-v02.api.letsencrypt.org/acme/chall/999999999/4333296883/Ies70A: challenge acme-client: https://acme-staging-v02.api.letsencrypt.org/acme/chall/999999999/4333296883/Ies70A: bad HTTP: 409 acme-client: transfer buffer: [{ "type": "urn:ietf:params:acme:error:conflict", "detail": "Unable to update challenge :: failed to mark authz as processing: Authorization is already being validated. This may indicate your client attempted the same challenge multiple times, possibly due to a client bug.", "status": 409 }] (296 bytes) acme-client: bad exit: netproc(15057): 1 Let's Encrypt gives the following output { "identifier": { "type": "dns", "value": "www.example.com" }, "status": "invalid", "expires": "2026-09-10T21:05:27Z", "challenges": [ { "type": "http-01", "url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall/999999999/4333296883/Ies70A";, "status": "invalid", "validated": "2026-09-03T21:05:27Z", "error": { "type": "urn:ietf:params:acme:error:unauthorized", "detail": "203.0.113.1: Invalid response from http://www.example.com/.well-known/acme-challenge/Cxjyj5atWIJv3n8OU7KJ87DbRPjflrBu_tgFBbRQI-I: 404", "status": 403 }, "token": "Cxjyj5atWIJv3n8OU7KJ87DbRPjflrBu_tgFBbRQI-I", "validationRecord": [ { "url": "http://www.example.com/.well-known/acme-challenge/Cxjyj5atWIJv3n8OU7KJ87DbRPjflrBu_tgFBbRQI-I";, "hostname": "www.example.com", "port": "80", "addressesResolved": [ "3fff:a:b::2", "203.0.113.1" ], "addressUsed": "3fff:a:b::2" }, { "url": "http://www.example.com/.well-known/acme-challenge/Cxjyj5atWIJv3n8OU7KJ87DbRPjflrBu_tgFBbRQI-I";, "hostname": "www.example.com", "port": "80", "addressesResolved": [ "3fff:a:b::2", "203.0.113.1" ], "addressUsed": "203.0.113.1" } ] } ] } Debugging httpd shows the HTTP 404. # httpd -d -d -v -v -f /etc/examples/httpd.conf [..] server www.example.org, client 4 (1 active), 66.133.109.36:43323 -> 203.0.113.1, /.well-known/acme-challenge/Cxjyj5atWIJv3n8OU7KJ87DbRPjflrBu_tgFBbRQI-I (404 Not Found)
