Hello all. As of this morning I’m receiving a validation error when attempting to renew a certificate. The JSON response looks like this (after removing some private info):
I’ve checked my nginx access logs, and there is a request coming from the Let’s Encrypt validation server. This request has a 200 HTTP status, so it seems it was able to connect and obtain the information from the challenge URL. I also tried hitting my challenge URL on several machines outside of the network, all of which were able to retrive ths information, so it doesn’t seem to be a problem with it being served.
I was able to renew my certificate in this manner several times previously over the past year, and have only noticed the issue as of this morning. Is there anything else that a “Could not connect” error message may indicate, since it seems the Let’s Encrypt validation server is able to connect to my server (as seen in my nginx logs)? Thanks!
I ran this command:
acme_tiny.py (passing in arguments for account-key, csr, and acme-dir)
It produced this output:
Output listed above. It’s a json response with status of “invalid” and an error status of “Could not connect”, even though I’m seeing the Let’s Encrypt validation server connect successfully to my server. I too am able to retrieve the information from my challenge URL using machines on several different networks.
My operating system is (include version):
Ubuntu 14.04.4 LTS
My web server is (include version):
nginx 1.10.0
My hosting provider, if applicable, is:
N/A
I can login to a root shell on my machine (yes or no, or I don’t know):
Yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
No
Thanks for the extra information, @kshepard. Could you include the full error “detail” message too, and maybe an excerpt from your web server log where you see the validation server connect to you?
This was from a fresh renewal request I just tried a minute ago. I’ve also tried several times throughout today and yesterday, all with the same results.
@jsha, can Boulder really return such a generic ACME error detail as “Could not connect to [hostname]”? Don’t we typically get a more meaningful diagnostic back, like NXDOMAIN, SERVFAIL, TCP connection refused, HTTP errors, etc.?
Interesting! Thanks for looking that up, @jsha. I guess it would be great to surface a little more of that in the diagnostics, because those messages have usually been able to point us in the right direction to fix whatever went wrong.
@kshepard, this sounds to me like a network connectivity problem between you and the Let’s Encrypt CA, perhaps caused by a firewall or something interfering with inbound network connections. I can connect to your site just fine, but maybe that’s not true for the CA. Is there any chance a firewall is involved?
You can also use the DNS-01 method, if you can update the DNS zone file for your domain. This doesn’t require the CA to connect directly to your server at all (only to the authoritative name serves that serve its DNS zone).
That is very interesting. There is not a firewall running, and I unfortunately don’t have access to any of the DNS settings in this infrastructure. It’s very strange that the Boulder machine is unable to connect given that both you, and I, and several other machines in various locations I’ve tested have not had problems. Also, this had been working fine for months without any configuration changes. Is there any chance some more further diagnosis can be done on why this is timing out? For instance, what is the timeout set to? This server is located in Asia, so it wouldn’t surprise me at all if there was some heavy latency.
@schoen / @jsha - Do you have any other guidance for diagnosing this issue? I’m at a loss for what to do, since everything looks fine on my end, and every machine I’ve tested is able to access the ACME challenge URL without error. I just don’t see what could be causing the timeout at Boulder, and would be grateful of any other information you can provide. I’ve been sporadically issuing the renew request ever since running into this issue, and I’ve received the same results each time.
Alright, just installed Certbot, ran it and standalone mode, and it worked like a charm. Why the old setup wasn’t working will probably always be a great mystery to me (some kind of obscure Nginx issue, perhaps). But I’m happy to have a cert now and am ready to move on. Thanks for everyone’s help with this!