# Certbot renewal fails for unknow reason **URL:** \ **Category:** Help\ **Created:** [October 15, 2026, 12:24pm UTC](https://community.letsencrypt.org/t/certbot-renewal-fails-for-unknow-reason/252164 "2026-10-15T12:24:03Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![michael-kugel-setu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/michael-kugel-setu/32/92291_2.png) [@michael-kugel-setu](https://community.letsencrypt.org/u/michael-kugel-setu)\ **Post date:** [October 15, 2026, 12:24pm UTC](https://community.letsencrypt.org/t/certbot-renewal-fails-for-unknow-reason/252164/1 "2026-10-15T12:24:03Z")
Detail below: certbot --renew is failing to renew, and this has worked in the past. We know we must be missing something, but can't see it. My domain is: cloud.waltoninstitute.ie I ran this command: certbot renew We have been using a configuration file # Options used in the renewal process [renewalparams] account = XXXXXXXXXXXXXXXX authenticator = standalone server = [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory) http01\_port = 8888 -- If we start up a mini webserver on port 8888 we can hit it from outside. There is a Haproxy on the external IP, with tcptump we have verified that port 8888 is accessible from outside and can see the requests coming in as far as certbot by running tcpdump on the same host as certbot is running. Here is the message from the logfile. It produced this output: Domain: YYYY.YYYY.YYYY Type: connection Detail: During secondary validation: XX.XX.XX.XX: Fetching [http://YYYY.YYYY.YYYY/.well-known/acme-challenge/\_VIb587g1Og3Ch9kgx0K\_mevt62ys4wgZj1\_RVcqIGc:](http://YYYY.YYYY.YYYY/.well-known/acme-challenge/_VIb587g1Og3Ch9kgx0K_mevt62ys4wgZj1_RVcqIGc:) Error getting validation data To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address. Additionally, please check that your computer has a publicly routable IP address and that no firewalls are preventing the server from communicating with the client. If you're using the webroot plugin, you should also verify that you are serving files from the webroot path you provided. 2026-10-15 12:58:05,569:DEBUG:certbot.error\_handler:Encountered exception: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/certbot/auth\_handler.py", line 91, in handle\_authorizations self.\_poll\_authorizations(authzrs, max\_retries, best\_effort) File "/usr/lib/python3/dist-packages/certbot/auth\_handler.py", line 180, in \_poll\_authorizations raise errors.AuthorizationError('Some challenges have failed.') certbot.errors.AuthorizationError: Some challenges have failed. 2026-10-15 12:58:05,569:DEBUG:certbot.error\_handler:Calling registered functions 2026-10-15 12:58:05,570:INFO:certbot.auth\_handler:Cleaning up challenges 2026-10-15 12:58:05,570:DEBUG:certbot.plugins.standalone:Stopping server at :::8888... 2026-10-15 12:58:05,632:WARNING:certbot.renewal:Attempting to renew cert (YYYY.YYYY.YYYY) from /etc/letsencrypt/renewal/YYYY.YYYY.YYYY.ie.conf produced an unexpected error: Some challenges have failed.. Skipping. 2026-10-15 12:58:05,635:DEBUG:certbot.renewal:Traceback was: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/certbot/renewal.py", line 462, in handle\_renewal\_request main.renew\_cert(lineage\_config, plugins, renewal\_candidate) File "/usr/lib/python3/dist-packages/certbot/main.py", line 1208, in renew\_cert renewed\_lineage = \_get\_and\_save\_cert(le\_client, config, lineage=lineage) File "/usr/lib/python3/dist-packages/certbot/main.py", line 116, in \_get\_and\_save\_cert renewal.renew\_cert(config, domains, le\_client, lineage) File "/usr/lib/python3/dist-packages/certbot/renewal.py", line 320, in renew\_cert new\_cert, new\_chain, new\_key, \_ = le\_client.obtain\_certificate(domains, new\_key) File "/usr/lib/python3/dist-packages/certbot/client.py", line 348, in obtain\_certificate orderr = self.\_get\_order\_and\_authorizations(csr.data, self.config.allow\_subset\_of\_names) File "/usr/lib/python3/dist-packages/certbot/client.py", line 396, in \_get\_order\_and\_authorizations authzr = self.auth\_handler.handle\_authorizations(orderr, best\_effort) File "/usr/lib/python3/dist-packages/certbot/auth\_handler.py", line 91, in handle\_authorizations self.\_poll\_authorizations(authzrs, max\_retries, best\_effort) File "/usr/lib/python3/dist-packages/certbot/auth\_handler.py", line 180, in \_poll\_authorizations raise errors.AuthorizationError('Some challenges have failed.') certbot.errors.AuthorizationError: Some challenges have failed. My web server is (include version): apache2 The operating system my web server runs on is (include version): ubuntu 20.04 My hosting provider, if applicable, is: NA I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): NO The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): ---
**Author:** ![MaxHearnden](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maxhearnden/32/87555_2.png) [@MaxHearnden](https://community.letsencrypt.org/u/MaxHearnden)\ **Post date:** [October 15, 2026, 12:26pm UTC](https://community.letsencrypt.org/t/certbot-renewal-fails-for-unknow-reason/252164/2 "2026-10-15T12:26:05Z")
http-01 needs to use port 80, this might mean that your haproxy instance runs on port 80 and forwards to port 8888, however you should test your setup by connecting to the external IP address on port 80. ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [October 15, 2026, 12:31pm UTC](https://community.letsencrypt.org/t/certbot-renewal-fails-for-unknow-reason/252164/3 "2026-10-15T12:31:49Z")
> [@michael-kugel-setu](#): > > and can see the requests coming in as far as certbot by running tcpdump on the same host as certbot is running. So the requests from the outside are on port 80, but if something is forwarding them to that host on port 8888 then sure that should work. How many incoming requests do you see? Since there should be at least 5. You can run certbot with `--debug-challenges` to keep the standalone server running, and try from many external locations to confirm connectivity. A failure "During secondary validation" usually means that it's a problem with connectivity from some parts of the Internet, even if there is connectivity from the "primary" validation location.