Connection reset by peer

[tianxiadys]

I encountered the "Connection reset by peer" problem. I used WireShark to capture packets. I found that the connection was established correctly, but after my server completed the response, the Let's Encrypt server sent an RST to reset the connection, causing the connection to fail.

[tianxiadys]

Subsequently, Let's Encrypt initiated another request from a different IP address, but this time the request was shorter. Before my server sent a response, it received an RST.

[rg305]

Hi @tianxiadys, and welcome to the LE community forum

@tianxiadys

I encountered the "Connection reset by peer" problem.

Please show the logfile:
/var/log/letsencrypt/letsencrypt.log

[tianxiadys]

1.pcap (80.9 KB)
letsencrypt.log.txt (57.1 KB)

[rg305]

I'm seeing:
curl: (56) Recv failure: Connection reset by peer
for all HTTP connections to your site.

You may be capturing packets on the wrong side of the firewall.

[tianxiadys]

You are right, but that may be because my server was not listening on port 80. Now I have started nginx to listen to it. Please try again.

[rg305]

They changed to:
curl: (52) Empty reply from server

[tianxiadys]

ohhhhh, my server is in Beijing. This may be a network issue unique to mainland China. Maybe it will resolve itself in a few days.

[Osiris]

Those replies might contain the Let's Encrypt IP addresses, but that doesn't necessarily mean they actualle came from LE.

[rg305]

hint: There may be a great firewall involved...

[webprofusion]

Check that you don't have any geographic or IP range filtering on incoming connections either on your own server or your router/firewall. Something on your side is closing the connection.

[schoen]

Chinese hosting providers sometimes also enforce the ICP license by blocking connections to a server until they're satisfied that it is licensed to operate a public service.

[tianxiadys]

Thank you for all the replies. Specifically, my server is purchased from Alibaba Cloud and located in Beijing, and I have already obtained an ICP license. I am seeking help from Alibaba Cloud, but they also do not seem to have any effective solutions. Here is a global connectivity test showing that access to any servers located outside of China are reset.

阿里云网站运维检测平台

[webprofusion]

The thing that's failing is when Let's Encrypt tries to validate your domain using http, so if that is outside your control you could instead validate your domain using DNS.