# Acme-challenge failed (solved) **URL:** \ **Category:** Help\ **Created:** [May 24, 2021, 12:58am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323 "2021-05-24T00:58:43Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![dxq](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dxq/32/49880_2.png) [@dxq](https://community.letsencrypt.org/u/dxq)\ **Post date:** [May 24, 2021, 12:58am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/1 "2021-05-24T00:58:44Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [dxq.duckdns.org](http://dxq.duckdns.org) I ran this command: sudo certbot certonly --manual --preferred-challenges=http-01 --dry-run It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator manual, Installer None Please enter in your domain name(s) (comma and/or space separated) (Enter 'c' to cancel): [dxq.duckdns.org](http://dxq.duckdns.org) Simulating a certificate request for [dxq.duckdns.org](http://dxq.duckdns.org) Performing the following challenges: http-01 challenge for [dxq.duckdns.org](http://dxq.duckdns.org) * * * Create a file containing just this data: nBXliU2lDp4nT2WnjXTSC-A6gWT03Todrzu33E3w9lc.4Q1D4DC5cB4wUfW4mFEllUPyhaU3CEbVp6LAaufdve0 And make it available on your web server at this URL: [http://dxq.duckdns.org/.well-known/acme-challenge/nBXliU2lDp4nT2WnjXTSC-A6gWT03Todrzu33E3w9lc](http://dxq.duckdns.org/.well-known/acme-challenge/nBXliU2lDp4nT2WnjXTSC-A6gWT03Todrzu33E3w9lc) * * * Press Enter to Continue Waiting for verification... Challenge failed for domain [dxq.duckdns.org](http://dxq.duckdns.org) http-01 challenge for [dxq.duckdns.org](http://dxq.duckdns.org) Cleaning up challenges Some challenges have failed. IMPORTANT NOTES: - The following errors were reported by the server: My web server is (include version): nginx/1.14.1 The operating system my web server runs on is (include version): debian 9 4.19.0-0.bpo.9-amd64 My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 1.15.0 ---
**Author:** ![dxq](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dxq/32/49880_2.png) [@dxq](https://community.letsencrypt.org/u/dxq)\ **Post date:** [May 24, 2021, 1:09am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/2 "2021-05-24T01:09:38Z")
comments: I have renewed my certificate several times for other domains and without any error. And I try to renew it again, I met the time out error. To avoid it's the limitation for my old domain and I try use the manual mode of certbot for the new domain [dxq.duckdns.org](http://dxq.duckdns.org). It's obvious that the url [http://dxq.duckdns.org/.well-known/acme-challenge/nBXliU2lDp4nT2WnjXTSC-A6gWT03Todrzu33E3w9lc](http://dxq.duckdns.org/.well-known/acme-challenge/nBXliU2lDp4nT2WnjXTSC-A6gWT03Todrzu33E3w9lc) can be accessed from the brower. Don't know what's wrong there. I changed nothing compare with the last several successfull renew. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [May 24, 2021, 1:13am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/3 "2021-05-24T01:13:42Z")
> [@dxq](#): > > It's obvious that the url > [http://dxq.duckdns.org/.well-known/acme-challenge/nBXliU2lDp4nT2WnjXTSC-A6gWT03Todrzu33E3w9lc](http://dxq.duckdns.org/.well-known/acme-challenge/nBXliU2lDp4nT2WnjXTSC-A6gWT03Todrzu33E3w9lc) > can be accessed from the brower. That doesn't load for me. I get a network timeout. Some things to check: 1. Port 80 is still port-forwarded on any modem/router, if this is a NAT/residential connection. 2. You haven't closed port 80 on the firewall ([Best Practice - Keep Port 80 Open - Let's Encrypt](https://letsencrypt.org/docs/allow-port-80/)). 3. Your ISP hasn't suddenly started blocking port 80. 4. That `135.0.229.130` is the correct IP address ---
**Author:** ![dxq](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dxq/32/49880_2.png) [@dxq](https://community.letsencrypt.org/u/dxq)\ **Post date:** [May 24, 2021, 1:31am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/4 "2021-05-24T01:31:17Z")
Thank you \_az, You can't load the page, it's a very important information to me and I am surprise. I checked other items you listed and they seems not applicable to me except: 3. Your ISP hasn't suddenly started blocking port 80. That's could be the reason because I changed the ISP in March. If my ISP blocking port 80, there is other way to finish the acme challenge (I can't change dns record of my domain)? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [May 24, 2021, 2:04am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/5 "2021-05-24T02:04:39Z")
DuckDNS does let you modify the DNS. You can set Certbot up to do DNS-based renewal with the instructions below. It will have the added benefit of being automatic. 1. Create up the DuckDNS hook (make sure you edit the `TOKEN` line first to the token you see in your DuckDNS dashboard): ```bash sudo sh -c ' cat </etc/letsencrypt/duckdns.sh TOKEN="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" DOMAIN="dxq.duckdns.org" curl "https://www.duckdns.org/update?domains=\$DOMAIN&token=\$TOKEN&txt=\$CERTBOT_VALIDATION&verbose=true" EOF chmod 0700 /etc/letsencrypt/duckdns.sh ' ``` 1. Then try renew the certificate: Finally, there are some other ACME clients which support DuckDNS natively: [dnsapi · acmesh-official/acme.sh Wiki · GitHub](https://github.com/acmesh-official/acme.sh/wiki/dnsapi#27-use-duckdnsorg-api)) ---
**Author:** ![dxq](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dxq/32/49880_2.png) [@dxq](https://community.letsencrypt.org/u/dxq)\ **Post date:** [May 24, 2021, 2:38am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/6 "2021-05-24T02:38:28Z")
Hi \_az, I would like to renew for the using cert/domains: cert-name: [rickdong.mynetgear.com](http://rickdong.mynetgear.com) domains: [rickdong.mynetgear.com](http://rickdong.mynetgear.com), [rickdong.duckdns.org](http://rickdong.duckdns.org) The domain [dxq.duckdns.org](http://dxq.duckdns.org) is used for test and has no certificate yet. I placed the duckdns.sh and the command as: /etc/letsencrypt/duckdns.sh: TOKEN="my duckdns token" DOMAIN="[rickdong.duckdns.org](http://rickdong.duckdns.org)" curl "[https://www.duckdns.org/update?domains=$DOMAIN&token=$TOKEN&txt=$CERTBOT\_VALIDATION&verbose=true](https://www.duckdns.org/update?domains=%24DOMAIN&token=%24TOKEN&txt=%24CERTBOT_VALIDATION&verbose=true)" command: sudo certbot renew --cert-name [rickdong.mynetgear.com](http://rickdong.mynetgear.com) --manual --preferred-challenges dns --manual-auth-hook /etc/letsencrypt/duckdns.sh the output: * * * Processing /etc/letsencrypt/renewal/rickdong.mynetgear.com.conf * * * Cert is due for renewal, auto-renewing... Plugins selected: Authenticator manual, Installer None Renewing an existing certificate for [rickdong.mynetgear.com](http://rickdong.mynetgear.com) and [rickdong.duckdns.org](http://rickdong.duckdns.org) Performing the following challenges: dns-01 challenge for [rickdong.duckdns.org](http://rickdong.duckdns.org) dns-01 challenge for [rickdong.mynetgear.com](http://rickdong.mynetgear.com) Running manual-auth-hook command: /etc/letsencrypt/duckdns.sh Output from manual-auth-hook command duckdns.sh: OK 5dvgq\_S9ozjtk2YB41cH4BUUr4OYXlyKi4LM1KdXxfI UPDATED Error output from manual-auth-hook command duckdns.sh: % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 54 0 54 0 0 89 0 --:--:-- --:--:-- --:--:-- 89 Running manual-auth-hook command: /etc/letsencrypt/duckdns.sh Output from manual-auth-hook command duckdns.sh: OK jySsBTT85Ja3lTpm46c4eYtpDeOUTNBB-o7UmfH6t\_Y UPDATED Error output from manual-auth-hook command duckdns.sh: % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 54 0 54 0 0 100 0 --:--:-- --:--:-- --:--:-- 100 Waiting for verification... Challenge failed for domain [rickdong.duckdns.org](http://rickdong.duckdns.org) Challenge failed for domain [rickdong.mynetgear.com](http://rickdong.mynetgear.com) dns-01 challenge for [rickdong.duckdns.org](http://rickdong.duckdns.org) dns-01 challenge for [rickdong.mynetgear.com](http://rickdong.mynetgear.com) Cleaning up challenges Failed to renew certificate [rickdong.mynetgear.com](http://rickdong.mynetgear.com) with error: Some challenges have failed. * * * All renewals failed. The following certificates could not be renewed: /etc/letsencrypt/live/rickdong.mynetgear.com/fullchain.pem (failure) * * * 1 renew failure(s), 0 parse failure(s) IMPORTANT NOTES: - The following errors were reported by the server: - The following errors were reported by the server: how to correct it? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [May 24, 2021, 2:58am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/7 "2021-05-24T02:58:28Z")
OK. What I posted is suitable for a single DuckDNS domain, but it's not going to work if you also need the the `mynetgear.com` domain on the same certificate. They use entirely different nameservers. If you want both domains AND port 80 is blocked, then you're in a pretty tricky situation. There is a less often used (because it's a pain in the ass) validation method called TLS-ALPN. It only needs port 443 to be open BUT you usually have to stop your webserver in order to use it. Certbot doesn't support it, you'd need to use a program like [acme.sh](https://github.com/acmesh-official/acme.sh). What you would do is something like: ``` acme.sh --issue --alpn -d rickdong.duckdns.org -d rickdong.mynetgear.com \ --pre-hook "service nginx stop" --post-hook "service nginx restart" ``` ---
**Author:** ![dxq](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dxq/32/49880_2.png) [@dxq](https://community.letsencrypt.org/u/dxq)\ **Post date:** [May 24, 2021, 3:31am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/8 "2021-05-24T03:31:34Z")
Thank you \_az, I will make some study on how to use acme.sh, but as you said it's a trouble to main 2 domains in one certificate. So if I want one certificate that only contains one domain: [rickdong.duckdns.org](http://rickdong.duckdns.org), can I request a new certificate? or I must concel the current certificate at first? How to prepare the /etc/letsencrypt/duckdns.sh and command? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [May 24, 2021, 3:45am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/9 "2021-05-24T03:45:24Z")
> [@dxq](#): > > So if I want one certificate that only contains one domain: [rickdong.duckdns.org](http://rickdong.duckdns.org), can I request a new certificate? Yeah, that should work just fine. (2 domains is actually fine, it's just that we don't have a DNS solution for the Netgear domain). The command to create a second certificate is similar: ``` certbot certonly -d rickdong.duckdns.org --manual \ --preferred-challenges dns --manual-auth-hook /etc/letsencrypt/duckdns.sh ``` > [@dxq](#): > > How to prepare the /etc/letsencrypt/duckdns.sh Everything the same as before, i.e. keep `DOMAIN` the same, change `TOKEN`: > [@\_az](#): > > ```nohighlight > TOKEN="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" > DOMAIN="rickdong.duckdns.org" > > ``` ---
**Author:** ![dxq](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dxq/32/49880_2.png) [@dxq](https://community.letsencrypt.org/u/dxq)\ **Post date:** [May 24, 2021, 4:13am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/10 "2021-05-24T04:13:22Z")
Yes, it works! Thank you so much @_az. Will fight with the ISP tomorrow for unblocking 80 ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [June 23, 2021, 4:13am UTC](https://community.letsencrypt.org/t/acme-challenge-failed-solved/152323/11 "2021-06-23T04:13:33Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.