I'd make sure that httpd has read access to /var/www/acme. The default
permissions for it are
$ ls -ld /var/www/acme/
drwxr-xr-x 2 root daemon 512 Aug 27 07:58 /var/www/acme/
On Thu, Sep 03, 2026 at 04:14:37PM -0500, [email protected] wrote:
> On Thu, Sep 03, 2026 at 11:34:34AM -0500, [email protected] wrote:
> >Just recently, I started seeing problems where one Let's Encrypt certificate
> >was not being renewed by acme-client.
> >
> >Digging around the issue after waiting a few days to see if the issue as
> >temporal, I found that the temporary file set by acme-client in
> >/var/www/acme/ is not available when Let's Encrypt checks for it; instead,
> >httpd is generating a 404.
> >
> >I'm running 7.9
> >
> >$ uname -a
> >OpenBSD www 7.9 GENERIC#8 amd64
> >
> >Relevant portions of /etc/acme-client.conf
> >------------------------------------------
> >
> >authority letsencrypt-staging {
> >api url "https://acme-staging-v02.api.letsencrypt.org/directory";
> >account key "/etc/acme/letsencrypt-staging-privkey.pem" }
> >
> >domain www.example.com {
> > domain key "/etc/ssl/private/www.example.com.key.pem"
> > domain full chain certificate "/etc/ssl/certs/www.example.com.chain.pem"
> > sign with letsencrypt-staging
> >}
> >
> >
> >Relevant parts of httpd.conf
> >----------------------------
> >
> >server "www.example.com" {
> > alias "www2.example.com"
> > listen on 203.0.113.1 port 80
> > listen on 3fff:a:b::2 port 80
> > location "/.well-known/acme-challenge/*" {
> > root "/acme"
> > request strip 2
> > pass
> > }
> > block return 301 "https://$HTTP_HOST$REQUEST_URI";
>
> I took out this entire config and used /etc/examples/httpd.conf (simply
> changing the server to my server name (www.example.com). The problem
> persists, and httpd looks to possibly be the culprit here. More logs of
> the session follow.
