Cannot get ssl certificate, timeout error

yg110627 · July 26, 2021, 7:14am

My domain is: www.jatus.top

I ran this command:acme.sh --log --issue --dns dns_namesilo --dnssleep 900 -d '*.jatus.top'

It produced this output:
[Mon Jul 26 11:52:34 CST 2021] Using CA: https://acme.zerossl.com/v2/DV90
[Mon Jul 26 11:52:34 CST 2021] Creating domain key
[Mon Jul 26 11:52:34 CST 2021] The domain key is here: /root/.acme.sh/.jatus.top/.jatus.top.key
[Mon Jul 26 11:52:34 CST 2021] Single domain='.jatus.top'
[Mon Jul 26 11:52:34 CST 2021] Getting domain auth token for each domain
[Mon Jul 26 11:52:38 CST 2021] Getting webroot for domain='.jatus.top'
[Mon Jul 26 11:52:38 CST 2021] Adding txt value: CFliqGNKxk5OMCHlFPj7i51mb6KUzThbSj4SvcPzwQo for domain: _acme-challenge.jatus.top
[Mon Jul 26 11:52:42 CST 2021] Successfully added TXT record, ready for validation.
[Mon Jul 26 11:52:42 CST 2021] The txt record is added: Success.
[Mon Jul 26 11:52:42 CST 2021] Sleep 900 seconds for the txt records to take effect
[Mon Jul 26 12:07:45 CST 2021] Verifying: *.jatus.top
[Mon Jul 26 12:07:48 CST 2021] The replay Nonce is not valid, let's get a new one, Sleeping 1 seconds.
[Mon Jul 26 12:07:52 CST 2021] Processing, The CA is processing your order, please just wait. [Mon Jul 26 12:09:29 CST 2021] *.jatus.top:Timeout
[Mon Jul 26 12:09:29 CST 2021] Removing DNS records.
[Mon Jul 26 12:09:29 CST 2021] Removing txt: CFliqGNKxk5OMCHlFPj7i51mb6KUzThbSj4SvcPzwQo for domain: _acme-challenge.jatus.top
[Mon Jul 26 12:09:32 CST 2021] Successfully retrieved the record id for ACME challenge.
[Mon Jul 26 12:09:33 CST 2021] Successfully removed the TXT record.
[Mon Jul 26 12:09:33 CST 2021] Removed: Success

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

rg305 · July 26, 2021, 7:52am

Hi @yg110627, and welcome to the LE community forum

Unfortunately, you are using an ACME client that isn't maintained by LE.
And that client now defaults to another CA (zerossl.com).
So there isn't much we can help you here with.
Other than to say that you should be able to use LE CA with acme.sh by using:
--set-default-ca --server letsencrypt

If you still have problems after doing that, please feel free to use this forum for help.

yg110627 · July 28, 2021, 12:56am

Thank you @rg305, I try to add "--set-default-ca --server letsencrypt" to my command, the output is following:
[Wed Jul 28 08:34:42 CST 2021] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Wed Jul 28 08:34:42 CST 2021] Create account key ok.
[Wed Jul 28 08:34:42 CST 2021] Registering account: https://acme-v02.api.letsencrypt.org/directory
[Wed Jul 28 08:34:44 CST 2021] Registered
[Wed Jul 28 08:34:44 CST 2021] ACCOUNT_THUMBPRINT='Uejrb4HCovKPj0HzB0aytQF9eHzBOrs1RpoqSYf_SyU'
[Wed Jul 28 08:34:44 CST 2021] Single domain='.jatus.top'
[Wed Jul 28 08:34:44 CST 2021] Getting domain auth token for each domain
[Wed Jul 28 08:34:46 CST 2021] Getting webroot for domain='.jatus.top'
[Wed Jul 28 08:34:47 CST 2021] Adding txt value: RGbuauJwXHe6qeq84i1iypSWcFPRrnt-eN19tT5lZr0 for domain: _acme-challenge.jatus.top
[Wed Jul 28 08:34:51 CST 2021] Successfully added TXT record, ready for validation.
[Wed Jul 28 08:34:51 CST 2021] The txt record is added: Success.
[Wed Jul 28 08:34:51 CST 2021] Sleep 900 seconds for the txt records to take effect
[Wed Jul 28 08:49:54 CST 2021] Verifying: *.jatus.top
[Wed Jul 28 08:49:55 CST 2021] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Wed Jul 28 08:50:00 CST 2021] Pending, The CA is processing your order, please just wait. (1/30)
[Wed Jul 28 08:50:03 CST 2021] *.jatus.top:Verify error:Incorrect TXT record
[Wed Jul 28 08:50:03 CST 2021] Removing DNS records.
[Wed Jul 28 08:50:03 CST 2021] Removing txt: RGbuauJwXHe6qeq84i1iypSWcFPRrnt-eN19tT5lZr0 for domain: _acme-challenge.jatus.top
[Wed Jul 28 08:50:08 CST 2021] Successfully retrieved the record id for ACME challenge.
[Wed Jul 28 08:50:09 CST 2021] Successfully removed the TXT record.
[Wed Jul 28 08:50:09 CST 2021] Removed: Success
[Wed Jul 28 08:50:09 CST 2021] Please check log file for more details: /root/.acme.sh/acme.sh.log

still fail.

rg305 · July 28, 2021, 1:43am

Try removing any unused TXT records that may remain from previous failed renewal attempts.
nslookup -q=soa _acme-challenge.jatus.top ns1.dnsowl.com
[still shows two TXT records]

rg305 · July 28, 2021, 1:48am

On your next attempt, when you see this message:

Try checking the TXT records (with the command I gave above) to ensure the new records are being added and synchronized.

griffin · July 28, 2021, 1:55am

Another good tool to check with:

https://toolbox.googleapps.com/apps/dig/#TXT/

yg110627 · July 29, 2021, 12:38am

Thank you @rg305, finally it works. After removing TXT records and change timeout from 900 to 2000, cert is downloaded.
@griffin, nice tool, very helpful.

system · August 28, 2021, 12:38am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Timeouts looking up CAA for my domain Help	17	54	August 23, 2024
Fetching Timeout Help	8	3519	November 7, 2017
New certificate order fails on Pending, The CA is processing your order, please just wait and gets timeout Help	4	1555	May 5, 2024
Acme.sh cloudflare, timeouts and Error getting validation data Help	7	1478	October 6, 2022
DNS-01 Challenge acme.errors.TimeoutError Client dev	8	1192	August 31, 2023

Cannot get ssl certificate, timeout error

Related topics