Cert renew timeout at validation (likely firewall problem)

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: maillebymicah.com

I ran this command: sudo certbot renew

It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/maillebymicah.com.conf

Renewing an existing certificate for maillebymicah.com and www.maillebymicah.com

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: maillebymicah.com
Type: connection
Detail: 98.60.54.35: Fetching http://maillebymicah.com/.well-known/acme-challenge/-ECm1jfade_H_xXRlZ2qGfQC4ikqpQBbOAUSCs1erlk: Timeout during connect (likely firewall problem)

Domain: www.maillebymicah.com
Type: connection
Detail: 98.60.54.35: Fetching http://www.maillebymicah.com/.well-known/acme-challenge/XNov328oLMddq4R2o-AEGYStT3LSjQJe1stlUtFbtfY: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Failed to renew certificate maillebymicah.com with error: Some challenges have failed.

All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/maillebymicah.com/fullchain.pem (failure)

1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

I ran this command: sudo certbot -auto --apache

It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.

1: maillebymicah.com
2: www.maillebymicah.com

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Attempting to parse the version 3.0.1 renewal configuration file found at /etc/letsencrypt/renewal/maillebymicah.com.conf with version 2.9.0 of Certbot. This might not work.
Certificate is due for renewal, auto-renewing...
Renewing an existing certificate for maillebymicah.com and www.maillebymicah.com
Performing the following challenges:
http-01 challenge for maillebymicah.com
http-01 challenge for www.maillebymicah.com
Waiting for verification...
Challenge failed for domain maillebymicah.com
Challenge failed for domain www.maillebymicah.com
http-01 challenge for maillebymicah.com
http-01 challenge for www.maillebymicah.com

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: maillebymicah.com
Type: connection
Detail: 98.60.54.35: Fetching http://maillebymicah.com/.well-known/acme-challenge/xMcLL5-s8f8V-HTeijIzS5pCRQYMxUKyLMScrtF48mU: Timeout during connect (likely firewall problem)

Domain: www.maillebymicah.com
Type: connection
Detail: 98.60.54.35: Fetching http://www.maillebymicah.com/.well-known/acme-challenge/aqBTRIz86xUkdWZ6Qfz0Lw4z7NPJTvLXz5TbDudTi2I: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): apache2 2.4.58

The operating system my web server runs on is (include version): Ubuntu 24.04.2

My hosting provider, if applicable, is:N/A

I can login to a root shell on my machine (yes or no, or I don't know):yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):direct access and through Webmin 2.303

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):certbot 2.9.0

Am running UFW and have attempted renewing my cert with firewall enabled and disabled.
I have tried reconfiguring and disabling IPv6 (have reset to autocinfig settings).
apachectl -t -D DUMP_VHOSTS
VirtualHost configuration:
*:443 maillebymicah.com (/etc/apache2/sites-enabled/maillebymicah-le-ssl.conf:2)
*:80 maillebymicah.com (/etc/apache2/sites-enabled/maillebymicah.conf:1)

sudo ufw status
Status: active

To Action From

Apache Full ALLOW Anywhere
OpenSSH ALLOW Anywhere
8080 ALLOW Anywhere
10000 ALLOW Anywhere
22 ALLOW Anywhere
17540 ALLOW Anywhere
443 ALLOW Anywhere
Apache Full (v6) ALLOW Anywhere (v6)
OpenSSH (v6) ALLOW Anywhere (v6)
8080 (v6) ALLOW Anywhere (v6)
10000 (v6) ALLOW Anywhere (v6)
22 (v6) ALLOW Anywhere (v6)
17540 (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)

I am using a wired connection to an Xfinity router, for my sins. Port forwarding has been set up and the server has a dedicated IP address.

2

Hello @MicahMaiiTso,

The HTTP-01 challenge states "The HTTP-01 challenge can only be done on port 80."

Best Practice - Keep Port 80 Open

I see Port 80 being filtered (i.e. not accessible from the Public Facing Internet).

$ nmap -Pn -p80,443 maillebymicah.com
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-11 23:45 UTC
Nmap scan report for maillebymicah.com (98.60.54.35)
Host is up (0.065s latency).
rDNS record for 98.60.54.35: c-98-60-54-35.hsd1.nm.comcast.net

PORT    STATE    SERVICE
80/tcp  filtered http
443/tcp open     https

Nmap done: 1 IP address (1 host up) scanned in 1.86 seconds
3 Likes
3

Hi @MicahMaiiTso,

Additionally the online tool Let's Debug yields these results (basically the same information). https://letsdebug.net/maillebymicah.com/2417862

image
image998×478 27.5 KB

And the online too https://www.yougetsignal.com/tools/open-ports/ shows

image
image763×660 57 KB

And from around the world Permanent link to this check report using https://check-host.net/
shows "Connection timed out".

Please check all your firewalls and routers (maybe even called modems) between your server and the Public Facing Internet.

One way to check is to use a cellphone with Wi-Fi disable so that you are going through the cell carrier's network instead of the LAN.

1 Like
4

thank you for catching this. I had switched out my server hardware to something a little newer/faster, and the router was being awkward with the static IP address. I got that sorted out and it threw the port forwarding out...

3 Likes