# Cant renew cert http-01 challenge error **URL:** \ **Category:** Help\ **Created:** [February 27, 2019, 10:33pm UTC](https://community.letsencrypt.org/t/cant-renew-cert-http-01-challenge-error/87336 "2019-02-27T22:33:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 27, 2019, 10:33pm UTC](https://community.letsencrypt.org/t/cant-renew-cert-http-01-challenge-error/87336/1 "2019-02-27T22:33:41Z")
hi all, im trying to renew my cert via certbot but i get this error, i dont know why as i have done a port forward to my server (443) and i can connect to my apache welcome page externally ie not in my company ie [https://blah.com](https://blah.com) certbot --apache Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Starting new HTTPS connection (1): [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org) Which names would you like to activate HTTPS for? * * * 1: [hftp.hackenbacker.com](http://hftp.hackenbacker.com) * * * Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter ‘c’ to cancel): 1 Cert is due for renewal, auto-renewing… Renewing an existing certificate Performing the following challenges: http-01 challenge for [hftp.hackenbacker.com](http://hftp.hackenbacker.com) Waiting for verification… Cleaning up challenges Failed authorization procedure. [hftp.hackenbacker.com](http://hftp.hackenbacker.com) (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to v erify the domain :: Fetching [http://hftp.hackenbacker.com/.well-known/acme-challenge/OqduhAT2VW2BdnJ3f0\_lrdiOq0l\_UHoIfZDub0HzoWA:](http://hftp.hackenbacker.com/.well-known/acme-challenge/OqduhAT2VW2BdnJ3f0_lrdiOq0l_UHoIfZDub0HzoWA:) Timeout during connect (likely firewall problem) IMPORTANT NOTES: - The following errors were reported by the server: this error seems to me its trying to renew my cert via 80? cheers, rob ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 27, 2019, 10:39pm UTC](https://community.letsencrypt.org/t/cant-renew-cert-http-01-challenge-error/87336/2 "2019-02-27T22:39:22Z")
Hi @robertkwild > [@robertkwild](#): > > 1: [hftp.hackenbacker.com](http://hftp.hackenbacker.com) you have two different ip addresses (non-www and www): | Host | T | IP-Address | is auth. | ∑ Queries | ∑ Timeout | | --- | --- | --- | --- | --- | --- | | [hftp.hackenbacker.com](http://hftp.hackenbacker.com) | A | 217.138.11.250 | yes | 1 | 0 | | | AAAA | | yes | | | | [www.hftp.hackenbacker.com](http://www.hftp.hackenbacker.com) | A | 23.251.134.60 | yes | 1 | 0 | | | AAAA | | yes | | | But your non-www doesn't answer (checked with [https://check-your-website.server-daten.de/?q=hftp.hackenbacker.com](https://check-your-website.server-daten.de/?q=hftp.hackenbacker.com) ): | Domainname | Http-Status | redirect | Sec. | G | | --- | --- | --- | --- | --- | | • [http://www.hftp.hackenbacker.com/](http://www.hftp.hackenbacker.com/) | | | | | | 23.251.134.60 | 302 | [http://www.hftp.hackenbacker.com/holdingpage/](http://www.hftp.hackenbacker.com/holdingpage/) | 0.053 | D | | | | | | | | • [http://hftp.hackenbacker.com/](http://hftp.hackenbacker.com/) | | | | | | 217.138.11.250 | -14 | | 10.024 | T | | Timeout - The operation has timed out | | | | | | | | | | | | • [http://www.hftp.hackenbacker.com/holdingpage/](http://www.hftp.hackenbacker.com/holdingpage/) | 200 | | 0.050 | H | | | | | | | | • [https://hftp.hackenbacker.com/](https://hftp.hackenbacker.com/) | | | | | | 217.138.11.250 | 403 | | 5.676 | M | | Forbidden | | | | | | | | | | | | • [https://www.hftp.hackenbacker.com/](https://www.hftp.hackenbacker.com/) | | | | | | 23.251.134.60 | -4 | | 0.083 | W | | SendFailure - The underlying connection was closed: An unexpected error occurred on a send. Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. | | | | | | | | | | | | • [http://www.hftp.hackenbacker.com:443/](http://www.hftp.hackenbacker.com:443/) | | | | | | 23.251.134.60 | -3 | | 0.083 | A | | ReceiveFailure - The underlying connection was closed: An unexpected error occurred on a receive. Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. | | | | | | | | | | | | • [http://hftp.hackenbacker.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://hftp.hackenbacker.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | | | 217.138.11.250 | -14 | | 10.023 | T | | Timeout - The operation has timed out | | | | | | | | | | | | • [http://www.hftp.hackenbacker.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://www.hftp.hackenbacker.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | | | 23.251.134.60 | 404 | | 0.050 | A | | Not Found | | | | | | | | | | | Letsencrypt checks a file in /.well-known/acme-challenge, but the 217.\* - ip address doesn't answer. So first step: Check your configuration so http + non-www answers. The www version answers correct with a http status 404 - not found. ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 27, 2019, 10:53pm UTC](https://community.letsencrypt.org/t/cant-renew-cert-http-01-challenge-error/87336/3 "2019-02-27T22:53:55Z")
mmm… thats wierd as when you go on the website it does answer as i get the apache welcome page - [https://hftp.hackenbacker.com](https://hftp.hackenbacker.com) the www doesnt answer atall [https://www.hftp.hackenbacker.com](https://www.hftp.hackenbacker.com) we host the non www one but not the www one, an external company manages the www one for us do you think i should change the public DNS a name for 217.138.11.250 to [ftp.hackenbacker.co](http://ftp.hackenbacker.co), will that work as that ip points to our firewall/router ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 27, 2019, 10:56pm UTC](https://community.letsencrypt.org/t/cant-renew-cert-http-01-challenge-error/87336/4 "2019-02-27T22:56:38Z")
> [@robertkwild](#): > > [https://hftp.hackenbacker.com](https://hftp.hackenbacker.com) That's the https version, not the http version. If you want to use http-01 validation, an open port 80 is required. That port may redirect to https. ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 27, 2019, 10:59pm UTC](https://community.letsencrypt.org/t/cant-renew-cert-http-01-challenge-error/87336/5 "2019-02-27T22:59:00Z")
yes, i want to validate or renew the https one ([hftp.hackenbacker.com](http://hftp.hackenbacker.com)) the non-www via port 443 and NOT port 80 as i havnt got that open on my firewall/router, the only nat i have open or done is the port 443 with the address 217.138.11.250 so how do i get certbot to renew the https one please ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 27, 2019, 11:12pm UTC](https://community.letsencrypt.org/t/cant-renew-cert-http-01-challenge-error/87336/6 "2019-02-27T23:12:48Z")
so the only option is to port forward port 80 and then the renew process will work? ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 28, 2019, 9:31am UTC](https://community.letsencrypt.org/t/cant-renew-cert-http-01-challenge-error/87336/7 "2019-02-28T09:31:03Z")
> [@robertkwild](#): > > so how do i get certbot to renew the https one please That's not possible if you want to use http-01 - validation. First request - port 80. > [@robertkwild](#): > > so the only option is to port forward port 80 and then the renew process will work? Is this a home server? Letsencrypt connects your domain via port 80, that must be possible. Then you can send a http redirect to port 443. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 30, 2019, 9:31am UTC](https://community.letsencrypt.org/t/cant-renew-cert-http-01-challenge-error/87336/8 "2019-03-30T09:31:04Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.