# Certs expiring e-mail?

**URL:** <https://community.letsencrypt.org/t/certs-expiring-e-mail/217966>\
**Category:** Help\
**Created:** [May 7, 2024, 10:53pm UTC](https://community.letsencrypt.org/t/certs-expiring-e-mail/217966 "2024-05-07T22:53:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peter1](https://avatars.discourse-cdn.com/v4/letter/p/a587f6/32.png) [@Peter1](https://community.letsencrypt.org/u/Peter1)\
**Post date:** [May 7, 2024, 10:53pm UTC](https://community.letsencrypt.org/t/certs-expiring-e-mail/217966/1 "2024-05-07T22:53:21Z")

</div>

My domain is: [nh6fu.ampr.org](http://nh6fu.ampr.org)

Ok... how do I do this????

---

<div class="post-metadata">

**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\
**Post date:** [May 7, 2024, 11:09pm UTC](https://community.letsencrypt.org/t/certs-expiring-e-mail/217966/2 "2024-05-07T23:09:50Z")

</div>

We don't have much more information than you do. Usually, Let's Encrypt certificates are configured on a system that handles everything automatically, so if you get an expiration email that means that that software isn't working right and you should check on it. It's usually something that's been installed on your web server, so if you don't administrate your web server then you may need to contact somebody that does.

Some additional information on the email which might help:

> **[Expiration Emails - Let's Encrypt](https://letsencrypt.org/docs/expiration-emails/)**
>
> Subscribing If you provide an email address to Let’s Encrypt when you create your account, we’ll do our best to automatically send you expiry notices when your certificate is coming up for renewal. We try to send the first notice at 20...

> [@Received Expiration Email But Already Renewed Certificate: What to Know and Do](https://community.letsencrypt.org/t/received-expiration-email-but-already-renewed-certificate-what-to-know-and-do/151785):
>
> I…

---

<div class="post-metadata">

**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\
**Post date:** [May 8, 2024, 2:22am UTC](https://community.letsencrypt.org/t/certs-expiring-e-mail/217966/3 "2024-05-08T02:22:30Z")

</div>

Hello @Peter1,

You did not say which of the 3 [Challenge Types - Let's Encrypt](https://letsencrypt.org/docs/challenge-types/) you are using;  
so I checked with the most common [HTTP-01 challenge](https://letsencrypt.org/docs/challenge-types/#http-01-challenge);  
it also states "The HTTP-01 challenge can only be done on port 80."

[Best Practice - Keep Port 80 Open](https://letsencrypt.org/docs/allow-port-80/)

Using the online tool [Let's Debug](https://letsdebug.net/) yields these results [https://letsdebug.net/nh6fu.ampr.org/1935257](https://letsdebug.net/nh6fu.ampr.org/1935257)

```nohighlight
ANotWorking
ERROR
nh6fu.ampr.org has an A (IPv4) record (44.62.3.154) but a request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address.
A timeout was experienced while communicating with nh6fu.ampr.org/44.62.3.154: Get "http://nh6fu.ampr.org/.well-known/acme-challenge/letsdebug-test": context deadline exceeded

Trace:
@0ms: Making a request to http://nh6fu.ampr.org/.well-known/acme-challenge/letsdebug-test (using initial IP 44.62.3.154)
@0ms: Dialing 44.62.3.154
@10000ms: Experienced error: context deadline exceeded

```

```nohighlight
IssueFromLetsEncrypt
ERROR
A test authorization for nh6fu.ampr.org to the Let's Encrypt staging service has revealed issues that may prevent any certificate for this domain being issued.
44.62.3.154: Fetching http://nh6fu.ampr.org/.well-known/acme-challenge/HxVa9ATBN0S7gratT0bGzf5vS5Q53eup6DtdrdYL9t0: Timeout during connect (likely firewall problem)

```

And further verified from around the world here [Permanent link to this check report](https://check-host.net/check-report/1917f783kfe9)  
with "Connection timed out".

And using `nmap` shows Port 80 is _filtered_ (i.e. blocked)

```nohighlight
$ nmap -Pn -p80,443 nh6fu.ampr.org
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-07 19:21 PDT
Nmap scan report for nh6fu.ampr.org (44.62.3.154)
Host is up (0.056s latency).

PORT STATE SERVICE
80/tcp filtered http
443/tcp open https

Nmap done: 1 IP address (1 host up) scanned in 6.46 seconds

```

---

<div class="post-metadata">

**Author:** ![Peter1](https://avatars.discourse-cdn.com/v4/letter/p/a587f6/32.png) [@Peter1](https://community.letsencrypt.org/u/Peter1)\
**Post date:** [May 10, 2024, 4:51am UTC](https://community.letsencrypt.org/t/certs-expiring-e-mail/217966/4 "2024-05-10T04:51:02Z")

</div>

What you posted enabled me to renew the cert! just stopped ufw and any possible program that might have run port 80... then rebooted to normal

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [May 10, 2024, 5:12am UTC](https://community.letsencrypt.org/t/certs-expiring-e-mail/217966/6 "2024-05-10T05:12:52Z")

</div>

Well... that is far from an ideal automated renewal procedure ☹

Let's see if we can't improve on that.

I see that the redirection on the current web server is a bit _off_:

```nohighlight
curl -Ii http://nh6fu.ampr.org/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 301 Moved Permanently
Location: https:nh6fu.ampr.org <<<<< missing "//" & the entire challenge path
Date: Fri, 10 May 2024 05:07:16 GMT
Connection: keep-alive
Keep-Alive: timeout=5

```

Compare:

```nohighlight
http://nh6fu.ampr.org/.well-known/acme-challenge/Test_File-1234
https:nh6fu.ampr.org

```

So, we should have a look at where it redirects.  
Also, we should have a look at the renewal config file.  
Not sure where that is; As you have not stated which ACME client you are using.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 9, 2024, 5:13am UTC](https://community.letsencrypt.org/t/certs-expiring-e-mail/217966/7 "2024-06-09T05:13:30Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.