Re: Certificate renewal fails after upgrade to httpd v2.4.66
Deepak Goel <[email protected]> Fri, 19 Jun 2026 15:46:05 +0530
| Newsgroups | gmane.comp.apache.user |
|---|---|
| Message-ID | <CA+b7NVWrW2+acFqOyQQPjEc0AOX-7RoB7uvWLi6CdarTstMh3w@mail.gmail.com> |
--00000000000051157c06549895d3 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable looks like a directory or file access issue * "status-description": "Permission denied",* You might have to check with ls -lt command and then do a chmod Deepak "The greatness of a nation can be judged by the way its animals are treated - Mahatma Gandhi" +91 73500 12833 [email protected] LinkedIn: www.linkedin.com/in/deicool "Plant a Tree, Go Green" Make In India : http://www.makeinindia.com/home On Fri, Jun 19, 2026 at 3:43=E2=80=AFPM Abfalterer, Armin < [email protected]> wrote: > Hi all > An instance running httpd v2.4.66 persistently fails to renew certificate= s > with an ACME unauthorized error. ZeroSSL rejects the replaces field in > the new order, claiming the certificate being replaced does not belong to > the current ACME account. Renewal never succeeds and the error counter > keeps incrementing. > Renewal was working prior to the upgrade to v2.4.66. > *Environment* > > - Apache httpd version: 2.4.66 > - ACME CA: ZeroSSL > > *Observed Behavior* > Renewal fails repeatedly with error count accumulating. The job.json / > md-status output shows status 13 (Permission denied), problem > urn:ietf:params:acme:error:unauthorized, with the detail: "The 'replaces' > field does not identify a certificate that belongs to this ACME account", > during the activity "Creating new order ... replacing-cert=3D...". > > { > "renewal": { > "name": "xxx", > "finished": false, > "notified": false, > "notified-renewed": false, > "next-run": "Fri, 19 Jun 2026 06:09:00 GMT", > "last-run": "Thu, 18 Jun 2026 22:44:59 GMT", > "errors": 11, > "last": { > "status": 13, > "status-description": "Permission denied", > "problem": "urn:ietf:params:acme:error:unauthorized", > "detail": "The \"replaces\" field does not identify a certificate > that belongs to this ACME account", > "activity": "Creating new order, key-spec=3Ddefault, profile=3Dnone= , > replacing-cert=3Dxxx" > }, > "cert": {} > } > } > > Is this a known issue? Is there a recommended mitigation? > > Regards, Armin > > --00000000000051157c06549895d3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>looks like a directory or file access issue=C2=A0<br>= <br><span style=3D"color:rgb(0,0,0);font-family:Verdana,sans-serif;font-siz= e:12px"><b>=C2=A0=C2=A0 "status-description": "Permission de= nied",<br></b><br>You might have to check with ls -lt command and then= do a chmod<br><br><br></span></div><div><div dir=3D"ltr" class=3D"gmail_si= gnature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><div dir= =3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr">= <div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div= dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"l= tr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div>= <div dir=3D"ltr"><div><div dir=3D"ltr"><div><font size=3D"2"><br></font><di= v dir=3D"ltr"><font size=3D"2"><br>Deepak<br></font></div><div><font size= =3D"2">"<span style=3D"font-family:Arial;color:rgb(34,34,34);backgroun= d-color:rgb(255,255,255);font-weight:400;font-style:normal;font-variant:nor= mal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">The = greatness of a nation can be judged by the way its animals are treated - Ma= hatma Gandhi</span>"<br><br></font></div><div dir=3D"ltr"><font size= =3D"2">+91 73500 12833<br><a href=3D"mailto:[email protected]" target=3D"_b= lank">[email protected]</a><br><br><span>LinkedIn:=C2=A0</span><a href=3D"h= ttp://www.linkedin.com/in/deicool" target=3D"_blank">www.linkedin.com/in/de= icool</a></font></div></div><div dir=3D"ltr"><br></div><div><font size=3D"2= ">"Plant a Tree, Go Green"</font></div><div><font size=3D"2"><br>= </font></div><div><font size=3D"2">Make In India : <a href=3D"http://www.ma= keinindia.com/home" target=3D"_blank">http://www.makeinindia.com/home</a><b= r></font></div></div></div></div></div></div></div></div></div></div></div>= </div></div></div></div></div></div></div></div></div></div></div></div></d= iv></div></div></div></div></div></div></div></div></div></div></div></div>= <br></div><br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"= ltr" class=3D"gmail_attr">On Fri, Jun 19, 2026 at 3:43=E2=80=AFPM Abfaltere= r, Armin <<a href=3D"mailto:[email protected]= h">[email protected]</a>> wrote:<br></div><b= lockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le= ft:1px solid rgb(204,204,204);padding-left:1ex"><div class=3D"msg4493127253= 698114818"> <div dir=3D"ltr"> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:1em 0px;font-family:Verdana,sans-serif;font-size:9pt;color:blac= k"> Hi all</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:1em 0px;font-family:Verdana,sans-serif;font-size:9pt;color:blac= k"> An instance running httpd v2.4.66 persistently fails to renew certificates = with an ACME=C2=A0<code>unauthorized</code>=C2=A0error. ZeroSSL rejects the= =C2=A0<code>replaces</code>=C2=A0field in the new order, claiming the certi= ficate being replaced does not belong to the current ACME account. Renewal never succeeds and the error counter keeps increment= ing.</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:1em 0px;font-family:Verdana,sans-serif;font-size:9pt;color:blac= k"> Renewal was working prior to the upgrade to v2.4.66.</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:1em 0px;font-family:Verdana,sans-serif;font-size:9pt;color:blac= k"> <b>Environment</b></div> <ul style=3D"text-align:left;background-color:rgb(255,255,255)"> <li style=3D"font-family:Verdana,sans-serif;font-size:9pt;color:black">Apac= he httpd version: 2.4.66</li><li style=3D"font-family:Verdana,sans-serif;fo= nt-size:9pt;color:black"> <div role=3D"presentation" style=3D"margin:0px">ACME CA: ZeroSSL</div> </li></ul> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:1em 0px;font-family:Verdana,sans-serif;font-size:9pt;color:blac= k"> <b>Observed Behavior</b></div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:1em 0px;font-family:Verdana,sans-serif;font-size:9pt;color:blac= k"> Renewal fails repeatedly with error count accumulating. The job.json / md-s= tatus output shows status 13 (Permission denied), problem urn:ietf:params:a= cme:error:unauthorized, with the detail: "The 'replaces' field= does not identify a certificate that belongs to this ACME account", during the activity "Creating new order .= .. replacing-cert=3D...".</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:1em 0px;font-family:Verdana,sans-serif;font-size:9pt;color:blac= k"> <br> </div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:1em 0px;font-family:Verdana,sans-serif;font-size:9pt;color:blac= k"> {</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 "renewal": {</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 "name": "xxx",</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 "finished": false,</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 "notified": false,</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 "notified-renewed": false,</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 "next-run": "Fri, 19 Jun 2026 06:09:00 GMT&quo= t;,</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 "last-run": "Thu, 18 Jun 2026 22:44:59 GMT&quo= t;,</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 "errors": 11,</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 "last": {</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 =C2=A0 "status": 13,</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 =C2=A0 "status-description": "Permission denie= d",</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 =C2=A0 "problem": "urn:ietf:params:acme:error:= unauthorized",</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 =C2=A0 "detail": "The \"replaces\" f= ield does not identify a certificate that belongs to this ACME account"= ;,</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 =C2=A0 "activity": "Creating new order, key-sp= ec=3Ddefault, profile=3Dnone, replacing-cert=3Dxxx"</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 },</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 =C2=A0 "cert": {}</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> =C2=A0 }</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> }</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> <br> </div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> Is this a known issue? Is there a recommended mitigation?</div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> <br> </div> <div style=3D"text-align:left;text-indent:0px;background-color:rgb(255,255,= 255);margin:0px;font-family:Verdana,sans-serif;font-size:9pt;color:black"> Regards, Armin</div> <div style=3D"font-family:Verdana,Geneva,sans-serif;font-size:11pt;color:rg= b(0,0,0)"> <br> </div> </div> </div></blockquote></div> --00000000000051157c06549895d3--