Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: asp-services.de
I ran this command:
https://letsdebug.net/asp-services.de/122682
It produced this output:
## est result for asp-services.de using http-01
All OK!
OK
No issues were found with asp-services.de
My web server is (include version):
Apache/2.4.43
The operating system my web server runs on is (include version):
FreeBSD 11.3
My hosting provider, if applicable, is:
Hetzner
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
mod_md (version 2.2.7)
+++ PROBLEM +++
I am always only getting back FALLBACK-perm-files although the tests mentioned before were positive.
Kind regards
testit
======================================================
CURL
Blockquote
curl -v https://acme-v02.api.letsencrypt.org/directory
- Trying 172.65.32.248:443…
- Connected to acme-v02.api.letsencrypt.org (172.65.32.248) port 443 (#0)
- ALPN, offering h2
- ALPN, offering http/1.1
- Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
- successfully set certificate verify locations:
- CAfile: /usr/local/share/certs/ca-root-nss.crt
CApath: none - TLSv1.2 (OUT), TLS header, Certificate Status (22):
- TLSv1.2 (OUT), TLS handshake, Client hello (1):
- TLSv1.2 (IN), TLS handshake, Server hello (2):
- TLSv1.2 (IN), TLS handshake, Certificate (11):
- TLSv1.2 (IN), TLS handshake, Server key exchange (12):
- TLSv1.2 (IN), TLS handshake, Server finished (14):
- TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
- TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
- TLSv1.2 (OUT), TLS handshake, Finished (20):
- TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
- TLSv1.2 (IN), TLS handshake, Finished (20):
- SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
- ALPN, server accepted to use h2
- Server certificate:
- subject: CN=acme-v01.api.letsencrypt.org
- start date: Mar 12 18:07:07 2020 GMT
- expire date: Jun 10 18:07:07 2020 GMT
- subjectAltName: host “acme-v02.api.letsencrypt.org” matched cert’s “acme-v02.api.letsencrypt.org”
- issuer: C=US; O=Let’s Encrypt; CN=Let’s Encrypt Authority X3
- SSL certificate verify ok.
- Using HTTP2, server supports multi-use
- Connection state changed (HTTP/2 confirmed)
- Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
- Using Stream ID: 1 (easy handle 0x803aa5800)
GET /directory HTTP/2
Host: acme-v02.api.letsencrypt.org
user-agent: curl/7.69.1
accept: /
- Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 200
< server: nginx
< date: Mon, 13 Apr 2020 16:52:07 GMT
< content-type: application/json
< content-length: 658
< cache-control: public, max-age=0, no-cache
< x-frame-options: DENY
< strict-transport-security: max-age=604800
<
{
“PzNW0vUoHxc”: “Adding random entries to the directory”,
“keyChange”: “https://acme-v02.api.letsencrypt.org/acme/key-change”,
“meta”: {
“caaIdentities”: [
“letsencrypt.org”
],
“termsOfService”: “https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf”,
“website”: “https://letsencrypt.org”
},
“newAccount”: “https://acme-v02.api.letsencrypt.org/acme/new-acct”,
“newNonce”: “https://acme-v02.api.letsencrypt.org/acme/new-nonce”,
“newOrder”: “https://acme-v02.api.letsencrypt.org/acme/new-order”,
“revokeCert”: “https://acme-v02.api.letsencrypt.org/acme/revoke-cert” - Connection #0 to host acme-v02.api.letsencrypt.org left intact
=======================================================
md-status-handler output of mod_md
{
“version”: “2.2.7”,
“managed-domains”: [
{
“name”: “www.asp-services.de”,
“domains”: [
“www.asp-services.de”,
“asp-services.de”
],
“contacts”: [
“mailto:you@example.com”,
“mailto:anomized@anonmail.de”
],
“transitive”: 1,
“ca”: {
“proto”: “ACME”,
“url”: “https://acme-v02.api.letsencrypt.org/directory”,
“agreement”: “accepted”
},
“state”: 1,
“renew-mode”: 1,
“renew-window”: “33%”,
“warn-window”: “10%”,
“must-staple”: true,
“proto”: {
“acme-tls/1”:
},
“stapling”: false,
“watched”: true,
“renew”: true,
“renewal”: {
“name”: “www.asp-services.de”,
“finished”: false,
“notified”: false,
“next-run”: “Mon, 13 Apr 2020 17:15:34 GMT”,
“last-run”: “Mon, 13 Apr 2020 17:04:54 GMT”,
“errors”: 8,
“last”: {
“status”: 20014,
“status-description”: “Internal error (specific information not available)”,
“detail”: “Unsuccessful in contacting ACME server at https://acme-v02.api.letsencrypt.org/directory. If this problem persists, please check your network connectivity from your Apache server to the ACME server. Also, older servers might have trouble verifying the certificates of the ACME server. You can check if you are able to contact it manually via the curl command. Sometimes, the ACME server might be down for maintenance, so failing to contact it is not an immediate problem. Apache will continue retrying this.”,
“activity”: “Contacting ACME server for www.asp-services.de at https://acme-v02.api.letsencrypt.org/directory”
}
}
}
]
}