# Dry Run Working, Real Run Not **URL:** \ **Category:** Help\ **Created:** [July 14, 2019, 5:39am UTC](https://community.letsencrypt.org/t/dry-run-working-real-run-not/97814 "2019-07-14T05:39:04Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dulux-oz](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@dulux-oz](https://community.letsencrypt.org/u/dulux-oz)\ **Post date:** [July 14, 2019, 5:39am UTC](https://community.letsencrypt.org/t/dry-run-working-real-run-not/97814/1 "2019-07-14T05:39:05Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [www.peregrineit.net](http://www.peregrineit.net) I ran this command: /usr/bin/certbot certonly --dry-run --agree-tos --force-renewal --standalone --preferred-challenges http --http-01-port 54321 -d [www.peregrineit.net](http://www.peregrineit.net) It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator standalone, Installer None Starting new HTTPS connection (1): [acme-staging-v02.api.letsencrypt.org](http://acme-staging-v02.api.letsencrypt.org) Obtaining a new certificate IMPORTANT NOTES: - The dry run was successful. I then immediatemly ran this command: /usr/bin/certbot certonly --agree-tos --force-renewal --standalone --preferred-challenges http --http-01-port 54321 -d [www.peregrineit.net](http://www.peregrineit.net) It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator standalone, Installer None Starting new HTTPS connection (1): [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org) Obtaining a new certificate Performing the following challenges: http-01 challenge for [www.peregrineit.net](http://www.peregrineit.net) Waiting for verification… Challenge failed for domain [www.peregrineit.net](http://www.peregrineit.net) http-01 challenge for [www.peregrineit.net](http://www.peregrineit.net) Cleaning up challenges Some challenges have failed. IMPORTANT NOTES: - The following errors were reported by the server: My web server is (include version): Niginx (latest version, on a differennt server HAproxy (latest version) on this server The operating system my web server runs on is (include version): centos 7 (latest version) My hosting provider, if applicable, is: N/A I can login to a root shell on my machine (yes or no, or I don’t know): Yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): N/A The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): certbot 0.35.1 Any help is greatly appreciated 😄 ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [July 14, 2019, 5:46am UTC](https://community.letsencrypt.org/t/dry-run-working-real-run-not/97814/2 "2019-07-14T05:46:53Z")
As far as dry run working/real run not working goes, this is most likely due to Let’s Encrypt caching a previous successful authorization. You can avoid that by deleting your staging account: ``` mv /etc/letsencrypt/accounts/acme-staging-v02.api.letsencrypt.org \ /etc/letsencrypt/accounts/acme-staging-v02.api.letsencrypt.org.bak ``` After you do that, both should be failing. ---
**Author:** ![dulux-oz](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@dulux-oz](https://community.letsencrypt.org/u/dulux-oz)\ **Post date:** [July 14, 2019, 6:50am UTC](https://community.letsencrypt.org/t/dry-run-working-real-run-not/97814/3 "2019-07-14T06:50:29Z")
> [@\_az](#): > > mv /etc/letsencrypt/accounts/acme-staging-v02.api.letsencrypt.org \ /etc/letsencrypt/accounts/acme-staging-v02.api.letsencrypt.org.bak Yes, both are now failing - so, how do I fix things? 😃 ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [July 14, 2019, 5:35pm UTC](https://community.letsencrypt.org/t/dry-run-working-real-run-not/97814/4 "2019-07-14T17:35:03Z")
Hi @dulux-oz, Do you understand the various parts of this command that you're using? > [@dulux-oz](#): > > /usr/bin/certbot certonly --agree-tos --force-renewal --standalone --preferred-challenges http --http-01-port 54321 -d [www.peregrineit.net](http://www.peregrineit.net) in this case this says that you want Certbot to create its own temporary web server and have it run on port 54321. Something else (like a firewall or reverse proxy) will then be responsible for mapping the publicly-visible port 80, as seen by the rest of the Internet, to that port. I don't think that's happening in this case—or is it? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [July 14, 2019, 9:39pm UTC](https://community.letsencrypt.org/t/dry-run-working-real-run-not/97814/5 "2019-07-14T21:39:10Z")
From their [other thread](https://community.letsencrypt.org/t/error-getting-validation-data/97149), I believe OP is proxying through to 54321 from haproxy. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [July 15, 2019, 2:18am UTC](https://community.letsencrypt.org/t/dry-run-working-real-run-not/97814/6 "2019-07-15T02:18:58Z")
Thanks @_az. In that case, I suspect that the haproxy configuration might be messed up or might be different in some way than it was when this certificate was originally issued. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [August 14, 2019, 2:26am UTC](https://community.letsencrypt.org/t/dry-run-working-real-run-not/97814/7 "2019-08-14T02:26:58Z")
Closed on August 14, 2019, 2:26am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.