What is the cause of the Let's Encrypt validation status 400 error?

Question

Apache HTTP Server

Lord, welcome.
This is my first time setting up a VPS. There is a VPS on Ubuntu, Vesat CP, Apache. Through Vesta, I want to put an SSL certificate on the domain. But I see an error Let's Encrypt validation status 400.
I managed to find out:
Let's Encrypt service reports a 403 error when accessing mysite.ru/.well-known/acme-challenge/mRR_2Bs_DxJJe...
It seems to me that the .well- directory is not being created known and as a result the site gives its standard 403 error. Why - I can not understand. And it confuses me that the folders on the server are owned by root, and the new site that I migrated has admin owned by all directories. It may be that there are not enough rights to create? Please point me in the right direction)

Answer 1

In general, the suggested answers did not help. I even tried to install through certbot. But then I reinstalled all the software on the VPS, through VESTA CP there was still a 400 error, but through certbot it was installed immediately. Thanks to all.

Answer 2

You have phpmyadmin on each site and no one creates it manually on each site, so do the well-known/ acme
-challenge in exactly the same way sites on this link will go immediately to this directory
/etc/httpd/conf/extra/httpd-acme.conf:

Alias /.well-known/acme-challenge/ "/var/lib/letsencrypt/.well-known/acme-challenge/"
<Directory "/var/lib/letsencrypt/">
    AllowOverride None
    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    Require method GET POST OPTIONS
</Directory>

By enabling this in /etc/httpd/conf/httpd.conf:
Include conf/extra/httpd-acme.conf
Restart
Make sure the web server has enough rights to view and edit files in this directory
by rights I mean not only chmod but also chown
rights will be different depending on the web server and OS
Esil If your httpd conf includes the entire /etc/httpd or /etc/apache2/site-enabled directory, then you can simply put the config there. and everything,
respectively, here is the second option, here with the rights it will definitely be all right

Alias /.well-known/acme-challenge/ "/var/www/html/.well-known/acme-challenge/"
<Directory "/var/www/html/">
    AllowOverride None
    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    Require method GET POST OPTIONS
</Directory>

as a rule, this folder exists when creating a web server, and its rights are already correct.