certbot-can't get SSL certificate for mail.domain.com

Solution 1:

That error means there's an HTTP 404 for the certbot file that it expects to see at mail.domain.com/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU

Can you see this file in /home/.well-known/acme-challenge/9heljxXRzeVUNLhilu3-Fr3fZ6YeCaPUQpna01etyoU?

Can you write your own file there, to test that it's being served?

echo wat > /home/.well-known/acme-challenge/wat

Then you should be able to curl it with:

curl mail.domain.com/.well-known/acme-challenge/wat

Given that mail.domain.com has got the same docroot as domain.com and www.domain.com you should also be able to curl domain.com/.well-known/acme-challenge/wat and curl www.domain.com/.well-known/acme-challenge/wat

If that doesn't work, then there's something up with your Apache config, or possibly the ownership/permissions of /home, /home/.well-known or /home/.well-known/acme-challenge