Cannot renew the certificate

zack1 · November 17, 2021, 3:07am

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:zakerynew1.xyz

I ran this command:acme.sh --renew -d zakerynew1.xyz --debug

It produced this output:
[Wed Nov 17 02:49:40 UTC 2021] Changing owner/group of .well-known to acme:certusers
[Wed Nov 17 02:49:40 UTC 2021] url='https://acme.zerossl.com/v2/DV90/chall/zGD4DMoM-lzINphhBHHMvg'
[Wed Nov 17 02:49:40 UTC 2021] payload='{}'
[Wed Nov 17 02:49:40 UTC 2021] Retrying post
[Wed Nov 17 02:49:40 UTC 2021] POST
[Wed Nov 17 02:49:40 UTC 2021] _post_url='https://acme.zerossl.com/v2/DV90/chall/zGD4DMoM-lzINphhBHHMvg'
[Wed Nov 17 02:49:40 UTC 2021] _CURL='curl --silent --dump-header /home/acme/.acme.sh/http.header -L -g '
[Wed Nov 17 02:49:41 UTC 2021] _ret='0'
[Wed Nov 17 02:49:41 UTC 2021] _hcode='0'
[Wed Nov 17 02:49:41 UTC 2021] code='200'
[Wed Nov 17 02:49:41 UTC 2021] trigger validation code: 200
[Wed Nov 17 02:49:41 UTC 2021] Processing, The CA is processing your order, please just wait. [Wed Nov 17 02:50:53 UTC 2021] sleep 2 secs to verify again
[Wed Nov 17 02:50:55 UTC 2021] checking
[Wed Nov 17 02:50:55 UTC 2021] url='https://acme.zerossl.com/v2/DV90/chall/zGD4DMoM-lzINphhBHHMvg'
[Wed Nov 17 02:50:55 UTC 2021] payload
[Wed Nov 17 02:50:55 UTC 2021] Retrying post
[Wed Nov 17 02:50:55 UTC 2021] POST
[Wed Nov 17 02:50:55 UTC 2021] _post_url='https://acme.zerossl.com/v2/DV90/chall/zGD4DMoM-lzINphhBHHMvg'
[Wed Nov 17 02:50:55 UTC 2021] _CURL='curl --silent --dump-header /home/acme/.acme.sh/http.header -L -g '
[Wed Nov 17 02:50:55 UTC 2021] _ret='0'
[Wed Nov 17 02:50:55 UTC 2021] _hcode='0'
[Wed Nov 17 02:50:55 UTC 2021] code='200'
[Wed Nov 17 02:50:55 UTC 2021] zakerynew1.xyz:Timeout
[Wed Nov 17 02:50:55 UTC 2021] Debugging, skip removing: /var/www/acme-challenge/.well-known/acme-challenge/rKK9Jxy2HueTf264krH3xGoQl-OjXkSpYNpoc6h7Ae4
[Wed Nov 17 02:50:55 UTC 2021] pid
[Wed Nov 17 02:50:55 UTC 2021] No need to restore nginx, skip.
[Wed Nov 17 02:50:55 UTC 2021] _clearupdns
[Wed Nov 17 02:50:55 UTC 2021] dns_entries
[Wed Nov 17 02:50:55 UTC 2021] skip dns.
[Wed Nov 17 02:50:56 UTC 2021] _on_issue_err
[Wed Nov 17 02:50:56 UTC 2021] Please add '--debug' or '--log' to check more details.
[Wed Nov 17 02:50:56 UTC 2021] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
[Wed Nov 17 02:50:56 UTC 2021] url='https://acme.zerossl.com/v2/DV90/chall/zGD4DMoM-lzINphhBHHMvg'
[Wed Nov 17 02:50:56 UTC 2021] payload='{}'
[Wed Nov 17 02:50:56 UTC 2021] Retrying post
[Wed Nov 17 02:50:56 UTC 2021] POST
[Wed Nov 17 02:50:56 UTC 2021] _post_url='https://acme.zerossl.com/v2/DV90/chall/zGD4DMoM-lzINphhBHHMvg'
[Wed Nov 17 02:50:56 UTC 2021] _CURL='curl --silent --dump-header /home/acme/.acme.sh/http.header -L -g '
[Wed Nov 17 02:50:56 UTC 2021] _ret='0'
[Wed Nov 17 02:50:56 UTC 2021] _hcode='0'
[Wed Nov 17 02:50:56 UTC 2021] code='200'
[Wed Nov 17 02:50:56 UTC 2021] Diagnosis versions:

My web server is (include version):nginx 1.14.1
The operating system my web server runs on is (include version): CentOS 8
My hosting provider, if applicable, is:hostwinds

I can login to a root shell on my machine (yes or no, or I don't know):yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

MikeMcQ · November 17, 2021, 3:26am

Your most recent certificate was issued by ZeroSSL - not Lets Encrypt. You were using Lets Encrypt before August but those expired. You can see in your debug log that the server used is acme.zerossl.com

I think you may have been affected by a change to acme.sh in early August.

By the author of acme.sh, see:

Renewal problems with Zerossl should be sent to their forum or acme.sh github (links in above link).

Or, reissue your cert with Lets Encrypt following the instructions in above link (--server letsencrypt).

rg305 · November 17, 2021, 4:10am

I love how it just throws this message out there (several times):

[Like should that make any reader feel better about the "failure" or what?]
[Why even say it that way? Just reading it makes me feel like a toddler - LOL]

This seems contradictory:

[unless 200 doesn't really mean 200 in this case...]

As @MikeMcQ mentioned, there isn't much help for those types of issues to be found here.
I would however ensure that Internet TCP port 80 (HTTP) requests can reach your system before continue with either CA.
And also, since you are already having trouble, you should be in the troubleshooting phase and using a staging environment until the problem has been resolved (not the production environment of any CA).

MikeMcQ · November 17, 2021, 4:22am

I think the 200 means the acme.sh client successfully retrieved the error message from the zerossl acme server. In this case that message was a very terse "timeout". The 200 is more helpful to Neil when debugging acme.sh rather than for people using it

A more verbose error message including any http code it saw would be nice. Perhaps there would be one in cases other than timeout - like 403 or 404?

rg305 · November 17, 2021, 4:28am

Looking deeper in to this (really didn't want to):

curl -Ii http://zakerynew1.xyz/
curl: (56) Recv failure: Connection reset by peer

echo | openssl s_client -connect zakerynew1.xyz:443 | head
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=1 C = AT, O = ZeroSSL, CN = ZeroSSL RSA Domain Secure Site CA
verify return:1
depth=0 CN = zakerynew1.xyz
verify error:num=10:certificate has expired
notAfter=Nov 16 23:59:59 2021 GMT
verify return:1
depth=0 CN = zakerynew1.xyz
notAfter=Nov 16 23:59:59 2021 GMT
verify return:1
DONE
CONNECTED(00000005)
---
Certificate chain
 0 s:CN = zakerynew1.xyz
   i:C = AT, O = ZeroSSL, CN = ZeroSSL RSA Domain Secure Site CA
 1 s:C = AT, O = ZeroSSL, CN = ZeroSSL RSA Domain Secure Site CA
   i:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
 2 s:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
   i:C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN = AAA Certificate Services
---

HTTPS returns a valid reply albeit recently expired:

To which I can only reiterate:

zack1 · November 17, 2021, 6:15am

thanks for you guys, i have received all responds.
i will check the info shared by @MikeMcQ later, actually i saw that change in august.it said i have nothing to do, so i just renewed the cert, as usual.
sorry for your reading experience @rg305 , i also hope there were some impressive words like "error" or "failure" so that i can find the solution easier. But there weren't."Processing, The CA is processing your order, please just wait." were repeat in log file 30 times, i checked them line by line.And i still got no idea what happened because it looks everything was ok. i tried to find solution online but i didnt find any useful stuff.Thats why i am here.looking for help.
i am sure the 80 port is working.Actually i built proxy service on that server, and it had worked for almost six months.untill yesterday this issue happened.

rg305 · November 17, 2021, 6:16am

If there is a (reverse) proxy, then we need to be sure it is handling the HTTP authentication requests correctly.

Sorry, and welcome to the LE community forum
[better late than never]

zack1 · November 17, 2021, 6:31am

thanks for mention that.i just checked the status of nginx.To my surprise,its not working!
i restart nginx service successfully, and then i renew the cert. The proxy service is working again now.
Thanks to all the people contributed。

system · December 17, 2021, 6:32am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Unable to renew certificate Help	9	1001	August 30, 2021
Cannot renew certificate Help	16	1150	May 15, 2021
Acme cert renewal no luck even after following the blog Help	5	514	September 2, 2020
My certificate expired and I can not get acme.sh to renew it Help	21	7511	September 12, 2021
Can't renew certificate. acme.sh Help	8	398	September 30, 2023

Cannot renew the certificate

Related topics