# Cannot renew my certificate **URL:** \ **Category:** Help\ **Created:** [November 23, 2018, 7:33pm UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297 "2018-11-23T19:33:03Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![vovim](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vovim](https://community.letsencrypt.org/u/vovim)\ **Post date:** [November 23, 2018, 7:33pm UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297/1 "2018-11-23T19:33:03Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [vovim.hopto.org](http://vovim.hopto.org) I ran this command: certbot -c /etc/letsencrypt/cli.ini renew --standalone --dry-run It produced this output: bash-4.4# certbot -c /etc/letsencrypt/cli.ini renew --standalone --dry-run Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * Processing /etc/letsencrypt/renewal/vovim.hopto.org.conf * * * Cert is due for renewal, auto-renewing… Plugins selected: Authenticator standalone, Installer None Renewing an existing certificate Performing the following challenges: tls-sni-01 challenge for [vovim.hopto.org](http://vovim.hopto.org) Waiting for verification… Cleaning up challenges Attempting to renew cert ([vovim.hopto.org](http://vovim.hopto.org)) from /etc/letsencrypt/renewal/vovim.hopto.org.conf produced an unexpected error: Failed authorization procedure. [vovim.hopto.org](http://vovim.hopto.org) (tls-sni-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Timeout during connect (likely firewall problem). Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/vovim.hopto.org/fullchain.pem (failure) * * * \*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry \*\* (The test certificates below have not been saved.) All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/vovim.hopto.org/fullchain.pem (failure) \*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry \*\* (The test certificates above have not been saved.) * * * 1 renew failure(s), 0 parse failure(s) IMPORTANT NOTES: - The following errors were reported by the server: My web server is (include version): Apache version 2.4.29 The operating system my web server runs on is (include version): Slackware Linux x86\_64 version 14.2 My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [November 23, 2018, 8:01pm UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297/2 "2018-11-23T20:01:27Z")
I can’t connect to `vovim.hopto.org` on port 80 nor 443. The IP address I’ve got is `143.159.144.191`. I _can_ ping the IP address. Is there a firewall or router blocking port 80 or 443 perhaps? ---
**Author:** ![vovim](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vovim](https://community.letsencrypt.org/u/vovim)\ **Post date:** [November 23, 2018, 8:44pm UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297/3 "2018-11-23T20:44:10Z")
Hi, Sorry, it was the router. I had the firewall all set up for the web server but I had disabled the necessary on ports on the outer because I was doing some testing. I had just forgotten to re-enable the ports on the router. I have now run the --dry-run command and it has succeeded. Thanks for the quick reply and very sorry for missing the obvious. bash-4.4# certbot -c /etc/letsencrypt/cli.ini renew --standalone --dry-run Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * Processing /etc/letsencrypt/renewal/vovim.hopto.org.conf * * * Cert is due for renewal, auto-renewing… Plugins selected: Authenticator standalone, Installer None Renewing an existing certificate Performing the following challenges: tls-sni-01 challenge for [vovim.hopto.org](http://vovim.hopto.org) Waiting for verification… Cleaning up challenges * * * new certificate deployed without reload, fullchain is /etc/letsencrypt/live/vovim.hopto.org/fullchain.pem * * * * * * \*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry \*\* (The test certificates below have not been saved.) Congratulations, all renewals succeeded. The following certs have been renewed: /etc/letsencrypt/live/vovim.hopto.org/fullchain.pem (success) \*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry \*\* (The test certificates above have not been saved.) * * * bash-4.4# ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [November 23, 2018, 8:51pm UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297/4 "2018-11-23T20:51:03Z")
Hi @vovim > [@vovim](#): > > tls-sni-01 challenge for [vovim.hopto.org](http://vovim.hopto.org) your check doesn't really help. Because the tls-sni-01 - validation is deprecated, support ends 2019-02-13. > [@March 13, 2019: End-of-Life for All TLS-SNI-01 Validation Support](https://community.letsencrypt.org/t/february-13-2019-end-of-life-for-all-tls-sni-01-validation-support/74209): > > L… So you should change to http - validation. ```nohighlight --preferred-challenges http ``` ---
**Author:** ![vovim](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vovim](https://community.letsencrypt.org/u/vovim)\ **Post date:** [November 23, 2018, 9:03pm UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297/5 "2018-11-23T21:03:16Z")
Will the ``` –preferred-challenges http ```auto ``` ---
**Author:** ![vovim](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vovim](https://community.letsencrypt.org/u/vovim)\ **Post date:** [November 23, 2018, 9:06pm UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297/6 "2018-11-23T21:06:52Z")
Sorry, copy and paste error. I should have said Will the --preferred-challenges http command only validate an http web server on port 80 or will it validate a secure https web server ? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [November 23, 2018, 9:39pm UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297/7 "2018-11-23T21:39:53Z")
I don’t really understand your question. The `http` challenge will authorise your **domain** through port 80, so you can get a _new_ certificate (also called a “renewal”) so your secure HTTPS web server will keep secure. ---
**Author:** ![vovim](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vovim](https://community.letsencrypt.org/u/vovim)\ **Post date:** [November 23, 2018, 9:41pm UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297/8 "2018-11-23T21:41:39Z")
Learning all the time. Thanks Osiris. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [December 18, 2018, 9:58am UTC](https://community.letsencrypt.org/t/cannot-renew-my-certificate/78297/10 "2018-12-18T09:58:49Z")