# Curl returned with 35 error **URL:** \ **Category:** Help\ **Created:** [December 26, 2022, 1:21pm UTC](https://community.letsencrypt.org/t/curl-returned-with-35-error/190080 "2022-12-26T13:21:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Blizzerand](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/blizzerand/32/66677_2.png) [@Blizzerand](https://community.letsencrypt.org/u/Blizzerand)\ **Post date:** [December 26, 2022, 1:21pm UTC](https://community.letsencrypt.org/t/curl-returned-with-35-error/190080/1 "2022-12-26T13:21:19Z")
I am using lua-resty-auto-ssl package with openresty to dynamically generate certificates for my clients (tenants). I got reports that generation of new certificates stopped working, and I was checking the logs and I found this. 2022/12/26 13:08:48 [error] 3722673#0: _97 [lua] ssl\_certificate.lua:97: issue\_cert(): auto-ssl: issuing new certificate failed: dehydrated failure, context: ssl\_certificate\_by\_lua_, client: 157.46.154.48, server: 0.0.0.0:443 2022/12/26 13:08:48 [error] 3722673#0: _97 [lua] ssl\_certificate.lua:291: auto-ssl: could not get certificate for codedesign.network - using fallback - failed to get or issue certificate, context: ssl\_certificate\_by\_lua_, client: 157.46.154.48, server: 0.0.0.0:443 2022/12/26 13:08:52 [error] 3722673#0: _100 [lua] lets\_encrypt.lua:40: issue\_cert(): auto-ssl: dehydrated failed: env HOOK\_SECRET=_\*\* HOOK\_SERVER\_PORT=8999 /usr/local/bin/resty-auto-ssl/dehydrated --cron --accept-terms --no-lock --domain codedesign.network --challenge http-01 --config /etc/resty-auto-ssl/letsencrypt/config --hook /usr/local/bin/resty-auto-ssl/letsencrypt\_hooks status: 256 out: # INFO: Using main config file /etc/resty-auto-ssl/letsencrypt/config err: ERROR: Problem connecting to server (get for [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory); curl returned with 35) Is this an issue with our end or has LetsEncrypt blocked our Ip address? The ip address in question is 20.219.20.151. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 26, 2022, 1:51pm UTC](https://community.letsencrypt.org/t/curl-returned-with-35-error/190080/2 "2022-12-26T13:51:05Z")
> [@Blizzerand](#): > > could not get certificate for codedesign.network > [@Blizzerand](#): > > dehydrated --cron --accept-terms --no-lock --domain codedesign.network --challenge http-01 A curl(35) is not the typical response when your IP is blocked. This is more likely on your end. Testing connections to `codedesign.network` results in a couple problems. One is that connections from various locations often take 30 seconds or more. I think it likely you also have issues on outbound connections. More importantly, the cert returned is wrong. The cert being used names `*.codedesign.app` (not `codedesign.network`). The only certs in the history for `codedesign.network` are wildcards ([link here](https://crt.sh/?q=codedesign.network&deduplicate=Y)). Yet, the dehydrated request uses the http challenge. An http challenge does not support a wildcard cert. You must use DNS challenge instead for that. As for the curl, do these succeed and how long do they take? ```nohighlight curl -i https://cloudflare.com curl -i https://google.com ``` ---
**Author:** ![Blizzerand](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/blizzerand/32/66677_2.png) [@Blizzerand](https://community.letsencrypt.org/u/Blizzerand)\ **Post date:** [December 26, 2022, 2:04pm UTC](https://community.letsencrypt.org/t/curl-returned-with-35-error/190080/3 "2022-12-26T14:04:11Z")
Hi Mike, Thank you for the reply. The wildcard certs are configured to \*.codedesign.app as a fallback so that the nginx doesn't complain when starting up. Our configuration is similar to that of [https://github.com/auto-ssl/lua-resty-auto-ssl](https://github.com/auto-ssl/lua-resty-auto-ssl). This used to work for the last 5 months. > [@MikeMcQ](#): > > The only certs in the history for `codedesign.network` are wildcards ([link here](https://crt.sh/?q=codedesign.network&deduplicate=Y)). Yet, the dehydrated request uses the http challenge. An http challenge does not support a wildcard cert. You must use DNS challenge instead for that. The certs are generated on the fly and codedesign.network doesn't have any prior certificates. > [@MikeMcQ](#): > > ```nohighlight > curl -i https://cloudflare.com > > curl -i https://google.com > > ``` Both the commands return data. However, I found a suggestion to run ```nohighlight $curl https://acme-v02.api.letsencrypt.org/directory curl: (35) OpenSSL SSL_connect: Connection reset by peer in connection to acme-v02.api.letsencrypt.org:443 ``` and as you can see, that's what I get. On my local machine, it doesn't throw the error. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 26, 2022, 2:08pm UTC](https://community.letsencrypt.org/t/curl-returned-with-35-error/190080/4 "2022-12-26T14:08:18Z")
What about this? ```nohighlight echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head ``` And, an aside, > [@Blizzerand](#): > > codedesign.network doesn't have any prior certificates It absolutely does as shown by the link I provided ([here](https://crt.sh/?q=codedesign.network&deduplicate=Y)) ---
**Author:** ![Blizzerand](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/blizzerand/32/66677_2.png) [@Blizzerand](https://community.letsencrypt.org/u/Blizzerand)\ **Post date:** [December 26, 2022, 4:13pm UTC](https://community.letsencrypt.org/t/curl-returned-with-35-error/190080/5 "2022-12-26T16:13:02Z")
It automatically appears to have resolved on its own. The curl call and the certificate generation are now working as expected. Not sure what went wrong, but thank you for the help Mike. 🙂 ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 25, 2023, 4:13pm UTC](https://community.letsencrypt.org/t/curl-returned-with-35-error/190080/6 "2023-01-25T16:13:04Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.