# After update and renewal - server empty response (curl error 52)

**URL:** <https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406>\
**Category:** Help\
**Created:** [February 20, 2022, 9:30pm UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406 "2022-02-20T21:30:16Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![gg4u](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gg4u/32/58643_2.png) [@gg4u](https://community.letsencrypt.org/u/gg4u)\
**Post date:** [February 20, 2022, 9:30pm UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/1 "2022-02-20T21:30:16Z")

</div>

Hello,  
I can't find a solution.

About a month ago I had to renew certbot. Since then, subdomains occasionally send empty responses, and could not find a solution.

Each time I was apparently able to find a fix, like here:

> [@Unable to renew certs as nginx is missing fullchain.pem](https://community.letsencrypt.org/t/unable-to-renew-certs-as-nginx-is-missing-fullchain-pem/97841):
>
> c…

The website was turning back, running again. But then after some time I check back the website:

```nohighlight
curl discovery.nifty.works
curl: (52) Empty reply from server

```

And cannot find a solution.

I now tried again something else, I removed certbot and reinstalled via snapd:

> **[Certbot Instructions](https://certbot.eff.org/instructions?ws=nginx&os=ubuntuxenial)**
>
> Tagline

I have certificates installed, included a wildcard one. And the main site works. But none of the subdomains.

Nginx configuration is fine and web servers up and running.

I set up DNS with \_acme.challenge and it seems fine.

What's wrong ? I can't find a way to get back sites on subdomains, and find a solution that stays. At this point, I am even not sure that what I tried earlier (delete and new of new certificates; renewal of new certificates; different threads here) was a real solution to the problem.

Cannot find the error, but website won't appear, server sends no reply.

```nohighlight

certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: nifty.works-0001
    Serial Number: 499040cba88628d0aa87137afa0673395bf
    Key Type: RSA
    Domains: *.nifty.works
    Expiry Date: 2022-05-21 19:37:44+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/nifty.works-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/nifty.works-0001/privkey.pem
  Certificate Name: nifty.works-0002
    Serial Number: 3297630963202b8da5e9d6cf8e88b7ff905
    Key Type: RSA
    Domains: nifty.works www.nifty.works
    Expiry Date: 2022-05-21 20:00:17+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/nifty.works-0002/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/nifty.works-0002/privkey.pem
  Certificate Name: nifty.works
    Serial Number: 3ac0fd9f46125d08d80d90819e173663457
    Key Type: RSA
    Domains: nifty.works
    Expiry Date: 2022-05-18 15:14:24+00:00 (VALID: 86 days)
    Certificate Path: /etc/letsencrypt/live/nifty.works/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/nifty.works/privkey.pem

```

```nohighlight
certbot --version
certbot 1.23.0

```

```nohighlight
dig _acme-challenge.nifty.works

; <<>> DiG 9.10.3-P4-Ubuntu <<>> _acme-challenge.nifty.works
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6699
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;_acme-challenge.nifty.works.	IN	A

;; AUTHORITY SECTION:
nifty.works. 233	IN	SOA	ns-935.awsdns-52.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

;; Query time: 2 msec
;; SERVER: 50.116.61.5#53(50.116.61.5)
;; WHEN: Sun Feb 20 21:26:35 UTC 2022
;; MSG SIZE rcvd: 140

```

```nohighlight
nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

```

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [February 20, 2022, 9:34pm UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/2 "2022-02-20T21:34:26Z")

</div>

Your nginx returns the same error over HTTP, so this is not an issue with TLS nor with the certificate.

---

<div class="post-metadata">

**Author:** ![gg4u](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gg4u/32/58643_2.png) [@gg4u](https://community.letsencrypt.org/u/gg4u)\
**Post date:** [February 20, 2022, 9:56pm UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/3 "2022-02-20T21:56:15Z")

</div>

@Osiris can you please explain ?

the last time certbot applied changes to the nginx configurations and sites were working fine.  
Now nothing is displayed again.

But nginx -t shows OK configuration.

I also noted that:  
the variable on \_acme.challenge.nifty.works point to a [XXXXXX.auth.acme-dns.io](http://XXXXXX.auth.acme-dns.io) that cannot be solved.

I once tried to set certbot using this tutorial :

> **[How To Acquire a Let's Encrypt Certificate Using DNS Validation with...](https://www.digitalocean.com/community/tutorials/how-to-acquire-a-let-s-encrypt-certificate-using-dns-validation-with-acme-dns-certbot-on-ubuntu-18-04)**
>
> DNS validation allows for certificate issuance requests to be verified using DNS records, rather than by serving content over HTTP. The acme-dns-certbot tool…

that made use of:

> **[GitHub - acme-dns/acme-dns-client: A client software for...](https://github.com/acme-dns/acme-dns-client)**
>
> A client software for https://github.com/joohoi/acme-dns - GitHub - acme-dns/acme-dns-client: A client software for https://github.com/joohoi/acme-dns

to generate the [XXXXXX.auth.acme-dns.io](http://XXXXXX.auth.acme-dns.io)

but now I also found that snap filled all my disk ?

```nohighlight
df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 24285116 23084556 0 100% /
devtmpfs 1002280 0 1002280 0% /dev
tmpfs 1006460 0 1006460 0% /dev/shm
tmpfs 1006460 107452 899008 11% /run
tmpfs 5120 0 5120 0% /run/lock
tmpfs 1006460 0 1006460 0% /sys/fs/cgroup
cgmfs 100 0 100 0% /run/cgmanager/fs
tmpfs 201292 0 201292 0% /run/user/1000
/dev/loop0 113536 113536 0 100% /snap/core/12725
/dev/loop1 63488 63488 0 100% /snap/core20/1328
/dev/loop2 44160 44160 0 100% /snap/certbot/1788
/dev/loop3 15360 15360 0 100% /snap/certbot-dns-route53/1370

```

(Why things are so complicated 😑 )

---

<div class="post-metadata">

**Author:** ![gg4u](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gg4u/32/58643_2.png) [@gg4u](https://community.letsencrypt.org/u/gg4u)\
**Post date:** [February 20, 2022, 10:10pm UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/4 "2022-02-20T22:10:39Z")

</div>

> [@Osiris](#):
>
> HTTP

Darn.

Ok, it turned out disk was full for a massive log file was created and indeed the issue was not related with certbot.

However, please help me understand if the configuration is OK, because here and there the same problem of empty response from server appeared also on the main sites (the one on https) after having updated certbot, and I tried different things that occasionally made the site working again.

Indeed the variable on the DNS `_acme.challenge.nifty.works` seems to be incorrrect, but `dig _acme.challenge.nifty.works` gives no error. I now set the DNS as TXT as following the instructions on :

> **[Certbot Instructions](https://certbot.eff.org/instructions?ws=nginx&os=ubuntuxenial)**
>
> Tagline

but on digitalocean guide was said to set CNAME:

> **[How To Acquire a Let's Encrypt Certificate Using DNS Validation with...](https://www.digitalocean.com/community/tutorials/how-to-acquire-a-let-s-encrypt-certificate-using-dns-validation-with-acme-dns-certbot-on-ubuntu-18-04)**
>
> DNS validation allows for certificate issuance requests to be verified using DNS records, rather than by serving content over HTTP. The acme-dns-certbot tool…

Also, please instruct how to fix errors on dns using the version on `snap` now that I installed it (I don't know the difference with other versions on apt-get).

Thank you..

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [February 20, 2022, 10:56pm UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/5 "2022-02-20T22:56:27Z")

</div>

> [@gg4u](#):
>
> `_acme.challenge.nifty.works`

The name should be `_acme-challenge.nifty.works`  
Note the dash after \_acme not a period

---

<div class="post-metadata">

**Author:** ![gg4u](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gg4u/32/58643_2.png) [@gg4u](https://community.letsencrypt.org/u/gg4u)\
**Post date:** [February 21, 2022, 9:06am UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/6 "2022-02-21T09:06:29Z")

</div>

Yes, you're right it was just a typo here.

`_acme-challenge.nifty.works` is named correctly, and `dig _acme-challenge.nifty.works` does not return error.

but the variable in it `XXXX.auth.acme-dns.io` cannot be reached.

If I browse `https://www.nifty.works` it seems everything ok.

But if I do

```nohighlight
curl https://www.nifty.works
curl: (60) SSL certificate problem: Invalid certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

```

Please advise how to fix and how to debug.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [February 21, 2022, 10:21am UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/7 "2022-02-21T10:21:14Z")

</div>

> [@gg4u](#):
>
> `dig _acme-challenge.nifty.works` does not return error.

Oh, but it does.

```nohighlight
# dig txt _acme-challenge.nifty.works

; <<>> DiG 9.16.1-Ubuntu <<>> txt _acme-challenge.nifty.works
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40537
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;_acme-challenge.nifty.works. IN TXT

;; ANSWER SECTION:
_acme-challenge.nifty.works. 300 IN TXT "2c483785-ae9b-446b-8fc6-4fe5c59c8f43.auth.acme-dns.io"

;; Query time: 15 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Mon Feb 21 11:20:10 CET 2022
;; MSG SIZE rcvd: 122

```

You have to use a CNAME record, not a TXT one.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [February 21, 2022, 10:26am UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/8 "2022-02-21T10:26:48Z")

</div>

Well, while incorrect it _technically_ isn't returning an error 😉

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [February 21, 2022, 10:27am UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/9 "2022-02-21T10:27:55Z")

</div>

> [@gg4u](#):
>
> `curl: (60) SSL certificate problem: Invalid certificate chain`

I cannot reproduce this.

```nohighlight
# curl -I https://www.nifty.works
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 21 Feb 2022 10:26:49 GMT
Content-Type: text/html
Content-Length: 25387
Last-Modified: Tue, 28 Jan 2020 21:02:35 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "5e30a16b-632b"
Accept-Ranges: bytes

```

Is ISRG Root X1 in your system trust store? (Or did you fix your chain by yourself?)

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [February 21, 2022, 3:05pm UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/10 "2022-02-21T15:05:29Z")

</div>

@gg4u You probably have an out of date CA certificate store on that machine. Your server responds saying it is nginx 1.10.3 which is very old so I guess your Ubuntu and CA cert store might also be very old.

If you need help debugging your curl chain problem please run this:

```nohighlight
curl -v https://letsencrypt.org 2>&1 |grep CAfile

```

Then, show results of this command replacing CAfile with the name shown from above:

```nohighlight
grep -Ei 'ISRG|DST|R3' CAfile | grep '#'

```

(example: `grep -Ei 'ISRG|DST|R3' /etc/ssl/certs/ca-certificates.crt`)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [March 23, 2022, 3:06pm UTC](https://community.letsencrypt.org/t/after-update-and-renewal-server-empty-response-curl-error-52/172406/11 "2022-03-23T15:06:04Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.