Certificate Expired, now I can't create a new one

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: burdicks.net
I ran this command: certbot --apache -d stitchedblessings.burdicks.net -d wiki.burdicks.net -d www.burdicks.net

It produced this output: During secondary validation: 173.72.165.146: Fetching http://stitchedblessings.burdicks.net/.well-known/acme-challenge/koiKNKLutVLYOZyogveXGdI2YBBjCLX369msVW6Uw0M: Timeout during connect (likely firewall problem)

I can reach my website using my cell phone using cellular service, so I don't see how it could be a firewall issue. It seems it's not creating the challenge files. I watch the directory while running the certbot command, and I never see anything created. It doesn't complain; it just doesn't create anything. I am able to manually create a file in that directory using the userid for Apache.

My web server is (include version): Apache/2.4.66 (Fedora Linux)

The operating system my web server runs on is (include version): Fedora release 43

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 4.1.1

2

Do you have some GeoBlocking going on?

Also see Multi-Perspective Validation & Geoblocking FAQ

3

Thank you Bruce. You're brilliant :slight_smile: That was exactly it.

I enabled GeoBlocking because I was getting slammed by requests coming from some countries. Does Let's Encrypt operate out of a country I can allow?

4

Read that FAQ that was linked. You can identify validation traffic by URL to allow it, but Let's Encrypt has to confirm that the request controls the name worldwide (because the certificate is valid to use worldwide).

5

Thank you, Peter. I understand their stance. I think I'll just write myself a note to disable the Geoblocking when I need to renew my certificate.

6

Certbot has --pre-hook and --post-hook options to run a script before and after. If your firewall has an API this could automate that.

7

Note that you might not know just based on the calendar when you need to renew. If Let's Encrypt messes some technical procedure up when issuing certificates, they may need to revoke those and reissue new ones. Newer versions of Certbot will run a couple times a day and will use ARI to know if they need to renew.