Can’t access acme-v02.api.letsencrypt.org

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
epson.oktree.com

I ran this command:
certbot-auto certonly --standalone -d epson.oktree.com

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Enter email address (used for urgent renewal and security notices) (Enter ‘c’ to
cancel): bjkim@oktree.com
An unexpected error occurred:
ConnectTimeout: HTTPSConnectionPool(host=‘acme-v02.api.letsencrypt.org’, port=443): Max retries exceeded with url: /directory (Caused by ConnectTimeoutError(<urllib3.connection.VerifiedHTTPSConnection object at 0x7fc705c2ee50>, ‘Connection to acme-v02.api.letsencrypt.org timed out. (connect timeout=45)’))
Please see the logfiles in /var/log/letsencrypt for more details.

My web server is (include version):
root@okt8:/data# nginx -V
nginx version: nginx/1.10.3 (Ubuntu)
built with OpenSSL 1.0.2g 1 Mar 2016
TLS SNI support enabled
configure arguments: --with-cc-opt=’-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2’ --with-ld-opt=’-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now’ --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_addition_module --with-http_dav_module --with-http_geoip_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module --with-http_v2_module --with-http_sub_module --with-http_xslt_module --with-stream --with-stream_ssl_module --with-mail --with-mail_ssl_module --with-threads

The operating system my web server runs on is (include version):
Ubuntu 16.04.2 LTS \n \l

My hosting provider, if applicable, is:
self-hosting from IDC

I can login to a root shell on my machine (yes or no, or I don’t know):
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
root@okt8:/data# certbot-auto --version
certbot 0.39.0

I have almost same issue with: Can't access acme-v02.api.letsencrypt.org from ColoCrossing

So I putting the result of commands someone requested at that thread:

root@okt8:/data# curl http://ipv4.whatismyip.akamai.com/ ; echo
121.78.237.198
root@okt8:/data# curl http://ipv6.whatismyip.akamai.com/ ; echo
curl: (7) Couldn’t connect to server

root@okt8:/data# dig +short whoami.ipv4.akahelp.net TXT
“ecs” “121.78.237.0/24/0”
“ns” “173.194.168.5”
“ip” “121.78.237.129”
root@okt8:/data# dig +short whoami.ipv6.akahelp.net TXT
“ip” “121.78.237.64”
“ns” “2404:6800:400b:c002::105”
“ecs” “121.78.237.0/24/0”
root@okt8:/data# dig +short whoami.ds.akahelp.net TXT
“ns” “172.253.3.3”
“ecs” “121.78.237.0/24/0”
“ip” “121.78.237.77”
root@okt8:/data# dig +short whoami.ds.akahelp.net TXT
“ecs” “121.78.237.0/24/0”
“ns” “2404:6800:400b:c002::105”
“ip” “121.78.237.255”
root@okt8:/data# dig +short whoami.ds.akahelp.net TXT
“ip” “121.78.237.67”
“ns” “173.194.168.67”
“ecs” “121.78.237.0/24/0”
root@okt8:/data# mtr -c 20 -w -r acme-v02.api.letsencrypt.org
Start: Sun Oct 20 12:45:52 2019
HOST: okt8.oktree.com Loss% Snt Last Avg Best Wrst StDev
1.|-- 121.78.237.1 0.0% 20 3.0 2.9 1.3 14.7 2.9
2.|-- 192.168.200.1 5.0% 20 0.9 0.6 0.4 1.7 0.2
3.|-- 203.246.170.101 0.0% 20 0.3 0.5 0.2 4.5 0.9
4.|-- 203.246.169.173 0.0% 20 0.6 1.1 0.6 10.1 2.1
5.|-- 192.145.251.68 0.0% 20 1.5 1.5 1.1 2.5 0.2
6.|-- ??? 100.0 20 0.0 0.0 0.0 0.0 0.0
root@okt8:/data#

You need to talk to your host/NOC. There is a routing issue from one of your iSPs preventing the connection to acme-v02.api.letsencrypt.org.

I wonder if all these reports that have appeared all of a sudden is because of the relative proximity to 172.16.0.0/12 ...

1 Like

They would have to be using /9 (or lower) to overlap 172.65.32.248
But that just might be the reason…

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.