# 无法和certbot交互，有没有大神帮帮我！！！

**URL:** <https://community.letsencrypt.org/t/certbot/194621>\
**Category:** Help\
**Created:** [March 16, 2023, 8:53am UTC](https://community.letsencrypt.org/t/certbot/194621 "2023-03-16T08:53:51Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Xiaokai](https://avatars.discourse-cdn.com/v4/letter/x/ea666f/32.png) [@Xiaokai](https://community.letsencrypt.org/u/Xiaokai)\
**Post date:** [March 16, 2023, 8:53am UTC](https://community.letsencrypt.org/t/certbot/194621/1 "2023-03-16T08:53:51Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):

certbot.\_internal.log:ValueError: check\_hostname requires server\_hostname

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 16, 2023, 9:18am UTC](https://community.letsencrypt.org/t/certbot/194621/2 "2023-03-16T09:18:38Z")

</div>

> [@Xiaokai](#):
>
> I ran this command:

What command did you run?

---

<div class="post-metadata">

**Author:** ![Xiaokai](https://avatars.discourse-cdn.com/v4/letter/x/ea666f/32.png) [@Xiaokai](https://community.letsencrypt.org/u/Xiaokai)\
**Post date:** [March 16, 2023, 9:29am UTC](https://community.letsencrypt.org/t/certbot/194621/3 "2023-03-16T09:29:57Z")

</div>

certbot certonly --manual --preferred-challenges http -d [cbi.dev-rs.cicc.com](http://cbi.dev-rs.cicc.com)

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 16, 2023, 9:31am UTC](https://community.letsencrypt.org/t/certbot/194621/4 "2023-03-16T09:31:40Z")

</div>

What shows?:  
`certbot --version`

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 16, 2023, 9:34am UTC](https://community.letsencrypt.org/t/certbot/194621/5 "2023-03-16T09:34:09Z")

</div>

You may need to uninstall and then reinstall `certbot`.  
See:  
[Certbot (eff.org)](https://certbot.eff.org/)

---

<div class="post-metadata">

**Author:** ![Xiaokai](https://avatars.discourse-cdn.com/v4/letter/x/ea666f/32.png) [@Xiaokai](https://community.letsencrypt.org/u/Xiaokai)\
**Post date:** [March 16, 2023, 9:46am UTC](https://community.letsencrypt.org/t/certbot/194621/6 "2023-03-16T09:46:54Z")

</div>

certbot 1.21.0  
显示的是上面的那个版本，那个可以嘛

---

<div class="post-metadata">

**Author:** ![Xiaokai](https://avatars.discourse-cdn.com/v4/letter/x/ea666f/32.png) [@Xiaokai](https://community.letsencrypt.org/u/Xiaokai)\
**Post date:** [March 16, 2023, 11:08am UTC](https://community.letsencrypt.org/t/certbot/194621/7 "2023-03-16T11:08:41Z")

</div>

想问一下是否不可以用代理去访问

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [March 16, 2023, 11:20am UTC](https://community.letsencrypt.org/t/certbot/194621/8 "2023-03-16T11:20:53Z")

</div>

Could you please show the entire log file?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 16, 2023, 4:21pm UTC](https://community.letsencrypt.org/t/certbot/194621/9 "2023-03-16T16:21:54Z")

</div>

> [@Xiaokai](#):
>
> certbot 1.21.0

Yes, version 1.21.0 should work.

I agree with @Osiris, you have not shown enough of the log file for us to understand what is happening and why.

> [@Xiaokai](#):
>
> certbot.\_internal.log:ValueError: check\_hostname requires server\_hostname

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 16, 2023, 4:52pm UTC](https://community.letsencrypt.org/t/certbot/194621/10 "2023-03-16T16:52:17Z")

</div>

This error message comes from the `requests` library which Certbot is using to make its outbound connection to the Let's Encrypt API.

It apparently relates to the case where an HTTP proxy is being used for outgoing connections, and `urllib` (the underlying HTTP implementation library that `requests` uses) is confused about the format or content of an environment variable that specifies which proxy to use, or else is confused about whether the proxy itself speaks HTTP or HTTPS.

I haven't ever encountered this before so I'm not sure of the exact solution, but I would say (1) check that the OS and all libraries are the most recent version, (2) check whether you need to use an outbound proxy at all, (3) check whether your proxy settings are correct (including whether they specify a proxy for both HTTP and HTTPS connections).

Sorry that I don't know a more specific solution, but this is at least the area that the error is coming from.

---

<div class="post-metadata">

**Author:** ![Xiaokai](https://avatars.discourse-cdn.com/v4/letter/x/ea666f/32.png) [@Xiaokai](https://community.letsencrypt.org/u/Xiaokai)\
**Post date:** [March 17, 2023, 12:48am UTC](https://community.letsencrypt.org/t/certbot/194621/11 "2023-03-17T00:48:29Z")

</div>

```plaintext
2023-03-16 17:34:34,249:DEBUG:certbot._internal.main:certbot version: 1.21.0
2023-03-16 17:34:34,249:DEBUG:certbot._internal.main:Location of certbot entry point: /usr/bin/certbot
2023-03-16 17:34:34,249:DEBUG:certbot._internal.main:Arguments: ['--manual', '--preferred-challenges', 'http', '-d', 'cbi.dev-rs.cicc.com']
2023-03-16 17:34:34,249:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2023-03-16 17:34:34,258:DEBUG:certbot._internal.log:Root logging level set at 30
2023-03-16 17:34:34,259:DEBUG:certbot._internal.plugins.selection:Requested authenticator manual and installer None
2023-03-16 17:34:34,259:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * manual
Description: Manual configuration or run your own shell scripts
Interfaces: Authenticator, Plugin
Entry point: manual = certbot._internal.plugins.manual:Authenticator
Initialized: <certbot._internal.plugins.manual.Authenticator object at 0x7f180015f850>
Prep: True
2023-03-16 17:34:34,259:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot._internal.plugins.manual.Authenticator object at 0x7f180015f850> and installer None
2023-03-16 17:34:34,259:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator manual, Installer None
2023-03-16 17:34:37,853:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2023-03-16 17:34:37,871:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2023-03-16 17:34:37,928:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/certbot", line 33, in <module>
    sys.exit(load_entry_point('certbot==1.21.0', 'console_scripts', 'certbot')())
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 15, in main
    return internal_main.main(cli_args)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1574, in main
    return config.func(config, plugins)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1416, in certonly
    le_client = _init_le_client(config, auth, installer)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 763, in _init_le_client
    acc, acme = _determine_account(config)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 680, in _determine_account
    acc, acme = client.register(
  File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 184, in register
    acme = acme_from_config_key(config, key)
  File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 48, in acme_from_config_key
    client = acme_client.BackwardsCompatibleClientV2(net, key, config.server)
  File "/usr/lib/python3/dist-packages/acme/client.py", line 875, in __init__
    directory = messages.Directory.from_json(net.get(server).json())
  File "/usr/lib/python3/dist-packages/acme/client.py", line 1236, in get
    self._send_request('GET', url, **kwargs), content_type=content_type)
  File "/usr/lib/python3/dist-packages/acme/client.py", line 1174, in _send_request
    response = self.session.request(method, url, *args, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 655, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 696, in urlopen
    self._prepare_proxy(conn)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 966, in _prepare_proxy
    conn.connect()
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 359, in connect
    conn = self._connect_tls_proxy(hostname, conn)
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 500, in _connect_tls_proxy
    return ssl_wrap_socket(
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 453, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls)
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 495, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock)
  File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1028, in _create
    raise ValueError("check_hostname requires server_hostname")
ValueError: check_hostname requires server_hostname
2023-03-16 17:34:37,930:ERROR:certbot._internal.log:An unexpected error occurred:
2023-03-16 17:34:37,930:ERROR:certbot._internal.log:ValueError: check_hostname requires server_hostname
2023-03-16 18:37:09,920:DEBUG:certbot._internal.main:certbot version: 1.21.0
2023-03-16 18:37:09,920:DEBUG:certbot._internal.main:Location of certbot entry point: /usr/bin/certbot
2023-03-16 18:37:09,920:DEBUG:certbot._internal.main:Arguments: ['--manual', '--preferred-challenges', 'http', '-d', 'cbi.dev-rs.cicc.com']
2023-03-16 18:37:09,920:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2023-03-16 18:37:09,927:DEBUG:certbot._internal.log:Root logging level set at 30
2023-03-16 18:37:09,928:DEBUG:certbot._internal.plugins.selection:Requested authenticator manual and installer None
2023-03-16 18:37:09,928:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * manual
Description: Manual configuration or run your own shell scripts
Interfaces: Authenticator, Plugin
Entry point: manual = certbot._internal.plugins.manual:Authenticator
Initialized: <certbot._internal.plugins.manual.Authenticator object at 0x7f95734db850>
Prep: True
2023-03-16 18:37:09,928:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot._internal.plugins.manual.Authenticator object at 0x7f95734db850> and installer None
2023-03-16 18:37:09,928:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator manual, Installer None
2023-03-16 18:37:14,985:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2023-03-16 18:37:15,006:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2023-03-16 18:37:15,062:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/certbot", line 33, in <module>
    sys.exit(load_entry_point('certbot==1.21.0', 'console_scripts', 'certbot')())
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 15, in main
    return internal_main.main(cli_args)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1574, in main
    return config.func(config, plugins)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1416, in certonly
    le_client = _init_le_client(config, auth, installer)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 763, in _init_le_client
    acc, acme = _determine_account(config)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 680, in _determine_account
    acc, acme = client.register(
  File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 184, in register
    acme = acme_from_config_key(config, key)
  File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 48, in acme_from_config_key
    client = acme_client.BackwardsCompatibleClientV2(net, key, config.server)
  File "/usr/lib/python3/dist-packages/acme/client.py", line 875, in __init__
    directory = messages.Directory.from_json(net.get(server).json())
  File "/usr/lib/python3/dist-packages/acme/client.py", line 1236, in get
    self._send_request('GET', url, **kwargs), content_type=content_type)
  File "/usr/lib/python3/dist-packages/acme/client.py", line 1174, in _send_request
    response = self.session.request(method, url, *args, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 655, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 696, in urlopen
    self._prepare_proxy(conn)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 966, in _prepare_proxy
    conn.connect()
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 359, in connect
    conn = self._connect_tls_proxy(hostname, conn)
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 500, in _connect_tls_proxy
    return ssl_wrap_socket(
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 453, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls)
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 495, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock)
  File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1028, in _create
    raise ValueError("check_hostname requires server_hostname")
ValueError: check_hostname requires server_hostname
2023-03-16 18:37:15,064:ERROR:certbot._internal.log:An unexpected error occurred:
2023-03-16 18:37:15,064:ERROR:certbot._internal.log:ValueError: check_hostname requires server_hostname
2023-03-16 18:39:07,643:DEBUG:certbot._internal.main:certbot version: 1.21.0
2023-03-16 18:39:07,643:DEBUG:certbot._internal.main:Location of certbot entry point: /usr/bin/certbot
2023-03-16 18:39:07,643:DEBUG:certbot._internal.main:Arguments: ['--manual', '--preferred-challenges', 'http', '-d', 'cbi.dev-rs.cicc.com']
2023-03-16 18:39:07,643:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2023-03-16 18:39:07,651:DEBUG:certbot._internal.log:Root logging level set at 30
2023-03-16 18:39:07,651:DEBUG:certbot._internal.plugins.selection:Requested authenticator manual and installer None
2023-03-16 18:39:07,651:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * manual
Description: Manual configuration or run your own shell scripts
Interfaces: Authenticator, Plugin
Entry point: manual = certbot._internal.plugins.manual:Authenticator
Initialized: <certbot._internal.plugins.manual.Authenticator object at 0x7fc22f8ff850>
Prep: True
2023-03-16 18:39:07,652:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot._internal.plugins.manual.Authenticator object at 0x7fc22f8ff850> and installer None
2023-03-16 18:39:07,652:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator manual, Installer None
2023-03-16 18:39:14,821:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2023-03-16 18:39:14,840:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2023-03-16 18:39:14,895:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/certbot", line 33, in <module>
    sys.exit(load_entry_point('certbot==1.21.0', 'console_scripts', 'certbot')())
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 15, in main
    return internal_main.main(cli_args)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1574, in main
    return config.func(config, plugins)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1416, in certonly
    le_client = _init_le_client(config, auth, installer)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 763, in _init_le_client
    acc, acme = _determine_account(config)
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 680, in _determine_account
    acc, acme = client.register(
  File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 184, in register
    acme = acme_from_config_key(config, key)
  File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 48, in acme_from_config_key
    client = acme_client.BackwardsCompatibleClientV2(net, key, config.server)
  File "/usr/lib/python3/dist-packages/acme/client.py", line 875, in __init__
    directory = messages.Directory.from_json(net.get(server).json())
  File "/usr/lib/python3/dist-packages/acme/client.py", line 1236, in get
    self._send_request('GET', url, **kwargs), content_type=content_type)
  File "/usr/lib/python3/dist-packages/acme/client.py", line 1174, in _send_request
    response = self.session.request(method, url, *args, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 655, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 696, in urlopen
    self._prepare_proxy(conn)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 966, in _prepare_proxy
    conn.connect()
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 359, in connect
    conn = self._connect_tls_proxy(hostname, conn)
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 500, in _connect_tls_proxy
    return ssl_wrap_socket(
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 453, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls)
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 495, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock)
  File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1028, in _create
    raise ValueError("check_hostname requires server_hostname")
ValueError: check_hostname requires server_hostname
2023-03-16 18:39:14,897:ERROR:certbot._internal.log:An unexpected error occurred:
2023-03-16 18:39:14,898:ERROR:certbot._internal.log:ValueError: check_hostname requires server_hostname

```

---

<div class="post-metadata">

**Author:** ![Xiaokai](https://avatars.discourse-cdn.com/v4/letter/x/ea666f/32.png) [@Xiaokai](https://community.letsencrypt.org/u/Xiaokai)\
**Post date:** [March 17, 2023, 12:48am UTC](https://community.letsencrypt.org/t/certbot/194621/12 "2023-03-17T00:48:52Z")

</div>

上面我提供的就是完整的日志

---

<div class="post-metadata">

**Author:** ![Xiaokai](https://avatars.discourse-cdn.com/v4/letter/x/ea666f/32.png) [@Xiaokai](https://community.letsencrypt.org/u/Xiaokai)\
**Post date:** [March 17, 2023, 12:49am UTC](https://community.letsencrypt.org/t/certbot/194621/13 "2023-03-17T00:49:52Z")

</div>

想问的一个问题是，我是否可以通过一个代理去访问certbot，从而和他进行交互  
还是certbot会拒绝一切通过代理来访问的连接呢？

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 17, 2023, 12:57am UTC](https://community.letsencrypt.org/t/certbot/194621/14 "2023-03-17T00:57:13Z")

</div>

What shows?:  
`echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head`

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 17, 2023, 1:45am UTC](https://community.letsencrypt.org/t/certbot/194621/15 "2023-03-17T01:45:23Z")

</div>

> [@Xiaokai](#):
>
> 想问的一个问题是，我是否可以通过一个代理去访问certbot，从而和他进行交互  
> 还是certbot会拒绝一切通过代理来访问的连接呢？

Yes, you can use a proxy to connect to the Let's Encrypt API. I think your proxy configuration (with an environment variable?) might not be detected properly by Certbot currently.

This is not a very well-tested or well-documented situation because not very many people use HTTP proxies to connect to the API. I have personally never tried it, so I don't even remember what the syntax should be (!). Sorry about that!

The Let's Encrypt servers will need to be able to connect directly to your web server in order to verify the challenges.

> **[验证方式 - Let's Encrypt - 免费的SSL/TLS证书](https://letsencrypt.org/zh-cn/docs/challenge-types/)**
>
> 当您从 Let’s Encrypt 获得证书时，我们的服务器会验证您是否使用 ACME 标准定义的验证方式来验证您对证书中域名的控制权。 大多数情况下，验证由 ACME 客户端自动处理，但如果您需要做出一些更复杂的配置决策，那么了解更多有关它们的信息会很有用。 如果您不确定怎么做，请使用您的客户端的默认设置或使用 HTTP-01。
> HTTP-01 验证 这是当今最常见的验证方式。 Let’s Encrypt 向您的 ACME 客户端提供一个令牌，然后您的 ACME 客户端将在您对...

The certificate request process includes _both_ outbound connections (to the API to request the certificate) and inbound connections (from Let's Encrypt servers to verify the challenge files). (These connections do not use the same IP addresses, as they are using totally different parts of the Let's Encrypt infrastructure.)

One thing that some related forum posts (not on this forum but on forums about the Python libraries that Certbot is using) mention is that there could be an error in the proxy configuration related to the protocol that is used between your server and the proxy (HTTP vs. HTTPS). Apparently that protocol needs to be specified, and needs to be specified correctly, in the proxy configuration environment variable or proxy configuration file.

Sorry that I don't remember more suggestions. If you can't figure it out but you agree that this could be the problem, we can also get a current Certbot developer to give some advice about the proxy configuration.

---

<div class="post-metadata">

**Author:** ![Xiaokai](https://avatars.discourse-cdn.com/v4/letter/x/ea666f/32.png) [@Xiaokai](https://community.letsencrypt.org/u/Xiaokai)\
**Post date:** [March 17, 2023, 6:24am UTC](https://community.letsencrypt.org/t/certbot/194621/16 "2023-03-17T06:24:42Z")

</div>

403785E70B7F0000:error:10080002:BIO routines:BIO\_lookup\_ex:system lib:../crypto/bio/bio\_addr.c:738:Temporary failure in name resolution  
connect:errno=11

---

<div class="post-metadata">

**Author:** ![Xiaokai](https://avatars.discourse-cdn.com/v4/letter/x/ea666f/32.png) [@Xiaokai](https://community.letsencrypt.org/u/Xiaokai)\
**Post date:** [March 17, 2023, 6:27am UTC](https://community.letsencrypt.org/t/certbot/194621/17 "2023-03-17T06:27:01Z")

</div>

我已经开通代理ip到172.65.32.248这个ip的防火墙，没有理解您说的开通到他的api是什么意思

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 17, 2023, 6:56am UTC](https://community.letsencrypt.org/t/certbot/194621/18 "2023-03-17T06:56:26Z")

</div>

There are multiple connections that will happen:

(1) Your Let's Encrypt client software (like Certbot) makes an HTTPS connection on port 443 to [https://acme-v02.api.letsencrypt.org/](https://acme-v02.api.letsencrypt.org/) in order to talk to the Let's Encrypt service's API and request a certificate. (I think this is the stage at which the process was originally failing for you. It appeared that Certbot could not correctly use your proxy in order to make this outgoing connection.)

That API is served by the Cloudflare CDN, so it might not have the same public API address as seen from everywhere in the world, or over time.

(2) After your client software requests a certificate, Let's Encrypt has to check that you really control the domain name for which you are requesting the certificate. There are three different ways that Let's Encrypt can do this (called "challenge methods"); most commonly, they involve a connection _from_ multiple Let's Encrypt data centers back to your web site, where your client software will be told to prove your control over the site by posting a text file, with contents chosen by the certificate authority, at a location on your site also chosen by the certificate authority.

Normally, in the most common situations, Certbot can automatically complete the steps requested by the certificate authority (for example, when run as root on a server with Apache or nginx, it will automatically create the requested file at the requested location).

The details of that are described in the "challenge types" document that I posted a link to (in official Chinese translation).

There are many possible failures related to this step of the process, but I don't think your certificate request has gotten far enough to know whether or not there are any problems with this.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 17, 2023, 6:56am UTC](https://community.letsencrypt.org/t/certbot/194621/19 "2023-03-17T06:56:38Z")

</div>

> [@Xiaokai](#):
>
> Temporary failure in name resolution

What shows?:  
`nslookup acme-v02.api.letsencrypt.org`

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 17, 2023, 6:59am UTC](https://community.letsencrypt.org/t/certbot/194621/20 "2023-03-17T06:59:07Z")

</div>

Yes, @rg305 has a good point—the most recent error looks like your server possibly also can't perform DNS lookups. It isn't enough to hard-code the ability to access a specific IP address for the Let's Encrypt API server, because the client software doesn't know that address, and will always try to access

[https://acme-v02.api.letsencrypt.org/](https://acme-v02.api.letsencrypt.org/)

by name. You can also simulate this access with a command like

`curl -v https://acme-v02.api.letsencrypt.org/directory`

to find out more about specific reasons that your server currently can't access this service. (If you have an outbound HTTP proxy, then `curl` also needs to be able to find and use that.)

[Next page](https://community.letsencrypt.org/t/certbot/194621.md?page=2)