# Certification renewal error (only dry run sometimes works) **URL:** \ **Category:** Help\ **Created:** [July 29, 2024, 7:34am UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652 "2024-07-29T07:34:26Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![seungho](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@seungho](https://community.letsencrypt.org/u/seungho)\ **Post date:** [July 29, 2024, 7:34am UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652/1 "2024-07-29T07:34:26Z")
I've been using Certbot to manage my SSL/TLS certificates for my website, and everything was working fine until May 17th. My certificates were automatically renewed every three months without any issues. However, now I'm encountering a "Redirect Loop Detected" error, and my attempts to renew the certificate are failing. Also 1. Using '--dry-run': Sometimes it works, and sometimes it doesn't, even if I run it again shortly after a successful attempt. 2. Actual Renewal: It consistently fails, never successfully renewing the certificates. How can I resolve this issue? My domain is: mics.snu.ac.kr I ran this command: sudo /usr/local/bin/certbot-auto renew --no-self-upgrade It produced this output: > IMPORTANT NOTES: > > - The following errors were reported by the server: The operating system my web server runs on is (include version): Ubuntu 12.04, apache2.2.22 ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 29, 2024, 11:48am UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652/2 "2024-07-29T11:48:19Z")
> [@seungho](#): > > Redirect loop detected Have you looked into that error message? ---
**Author:** ![dongho0519](https://avatars.discourse-cdn.com/v4/letter/d/7993a0/32.png) [@dongho0519](https://community.letsencrypt.org/u/dongho0519)\ **Post date:** [July 29, 2024, 12:16pm UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652/3 "2024-07-29T12:16:53Z")
Yes, I have verified that the DNS and IP addresses are correctly configured, and during the DRY-run, the renewal success was confirmed. However, when attempting the actual renewal, an error occurs, preventing the update. I researched the "redirect loop detected" error on the LE forum and followed the suggested configuration file modifications, but they did not provide any helpful information for our situation. The most puzzling aspect is the failure of the actual renewal after the success of the DRY-run, which I thought was a renewal simulation. Could you provide assistance on what adjustments might be needed? ---
**Author:** ![linkp](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/linkp/32/60089_2.png) [@linkp](https://community.letsencrypt.org/u/linkp)\ **Post date:** [July 29, 2024, 12:44pm UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652/4 "2024-07-29T12:44:16Z")
> [@seungho](#): > > certbot-auto That application hasn't been supported for years. > [@seungho](#): > > Ubuntu 12.04, apache2.2.22 Neither have those. Ubuntu 12.04 LTS was end of life over seven years ago! Apache 2.2 also went end of life the same year at version 2.2.34. Such ancient and unmaintained software should not be expected to work and definitely is not safe to connect to the internet. You really need to move your workloads to current and supported versions of software. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [July 29, 2024, 1:40pm UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652/5 "2024-07-29T13:40:35Z")
It looks like some sort of firewall is interfering with access We have seen this before but I don't remember the exact product that causes this problem. But, I can demonstrate what is happening. In words, the first attempt from a "new" IP to your domain gets an odd set of redirects which LE detects as a redirect loop. But, repeated attempts from the same origin IP work. This is why you sometimes see this work and other times not. You are getting lucky that the same LE Auth Server IP is used on later attempt. These change often. This is also why browsers won't see this as a problem because they will try redirects many many times before issuing a "redirect loop" error. You should disable the firewall feature when seeing requests that include `/.well-known/acme-challenge` Here are HTTP requests that show this ```nohighlight # A request to your domain gets redirected to a URL with a number added curl -i http://mics.snu.ac.kr HTTP/1.0 302 Found Location: http://mics.snu.ac.kr/002705864258/ # Following that location gets redirected back to the original URL # The Let's Encrypt server detects this as a "redirect loop" curl -i http://mics.snu.ac.kr/002705864258/ HTTP/1.0 302 Found Location: http://mics.snu.ac.kr/ # If someone (like a browser) would try this redirect anyway it works curl -i http://mics.snu.ac.kr/ HTTP/1.1 301 Moved Permanently Date: Mon, 29 Jul 2024 13:32:03 GMT Server: Apache/2.2.22 (Ubuntu) Location: https://mics.snu.ac.kr/ ``` If I repeat this request rapidly I get good responses. If I wait a bit (like 5 minutes) the sequence above starts over. It is as if it remembers my IP for a short while. ---
**Author:** ![dongho0519](https://avatars.discourse-cdn.com/v4/letter/d/7993a0/32.png) [@dongho0519](https://community.letsencrypt.org/u/dongho0519)\ **Post date:** [July 29, 2024, 3:30pm UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652/6 "2024-07-29T15:30:14Z")
If I repeatedly enter the following command in a short period of time, does it increase the likelihood of success? `certbot-auto renew --no-self-upgrade` Based on my experience, running `certbot-auto renew --dry-run` multiple times in a row often results in success. However, when attempting the actual renewal, there's a limitation where if it fails more than five times, renewal is blocked for an hour, preventing continuous attempts as with the dry run. If attempting consecutively does indeed increase the chances of success, is there a way to remove this five-attempt failure limit? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 29, 2024, 3:33pm UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652/7 "2024-07-29T15:33:33Z")
> [@dongho0519](#): > > is there a way to remove this five-attempt failure limit? No. That is there to prevent abuse/misuse. You should correct the problem. So that it can work on every attempt. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [July 29, 2024, 3:41pm UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652/8 "2024-07-29T15:41:13Z")
> [@dongho0519](#): > > If attempting consecutively does indeed increase the chances of success As you note, it does _not_ increase the odds of success with the production system. If you can't resolve your (likely) firewall related problem you could consider the DNS Challenge. Although, with your DNS provider you may need to use a manual method unless you can work out a hook for automated API updates to it. You should ask your ISP or network team about this problem. Another option is to use a different ACME Certificate Authority. It is possible one of those will not reject this peculiar set of redirects in the same way. I do not know which would work for sure. BuyPass is the easiest to try as it does not require EAB setup. > **[ACME CA Comparison - Posh-ACME](https://poshac.me/docs/v4/Guides/ACME-CA-Comparison/)** > > Documentation for the Posh-ACME PowerShell module ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [August 28, 2024, 3:41pm UTC](https://community.letsencrypt.org/t/certification-renewal-error-only-dry-run-sometimes-works/222652/9 "2024-08-28T15:41:58Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.