Error: Cannot negotiate ALPN protocol when trying to renew my SSL certificate

Help
1

Hi,

I need help, everytime I am trying to renew my SSL certificate I am getting this error:

acme: error: 403 ::
urn:ietf:params:acme:error:unauthorized :: Cannot negotiate ALPN protocol
"acme-tls/1" for tls-alpn-01 challenge

I already tried these steps:

sudo /opt/bitnami/ctlscript.sh stop

- ```
sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="DOMAIN" --path="/opt/bitnami/letsencrypt" renew --days 90

but when I run the second step I get the error.

Please help me on this.

2

Why are you using this option? It says lego to renew even if there are 90 days left until expiry. Please don't do that.

We don't have much to work with, as you've removed the questionnaire which was shown to you when you opened this thread in the Help section.. But from the limited info I see, it looks like Let's Encrypt validation server didn't actually connect to lego, but to something else. Some other webserver answering on port 443, even though you say you stopped something using bitnami..

Is there a specific reason why you're using lego instead of the built-in bncert-tool?

2 Likes
3

I am not quite sure why it has lego in it, here is the command I ran when I installed the SSL cert:
sudo /opt/bitnami/bncert-tool

Here is the steps I followed when renewing it manually

4

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: plumbingandelectrical.net.au

I ran this commands:

  • sudo /opt/bitnami/ctlscript.sh stop
  • sudo /opt/bitnami/letsencrypt/lego --tls --email="{email}" --domains="plumbingandelectrical.net.au" --path="/opt/bitnami/letsencrypt" renew

(I got the solution in this link : Renew an SSL certificate on a Bitnami stack in Lightsail | AWS re:Post)

It produced this output:

2025/01/19 10:38:53 error: one or more domains had a problem:
[www.plumbingandelectrical.net.au] acme: error: 403 :: urn:ietf:params:acme:error:unauthor
ized :: Cannot negotiate ALPN protocol "acme-tls/1" for tls-alpn-01 challenge

My web server is (include version):

The operating system my web server runs on is (include version): Linux

My hosting provider, if applicable, is: AWS Lightsail

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): bncert-tool

5

@doyle I moved the above post from your other thread to here. We like all posts about the same problem to be in the same thread.

In that post you say "I got the solution in this link". Does that mean your problem is solved?

2 Likes
6

No I have not, I still need help, thanks

7

What I meant is, I followed the steps on that link on how to trigger SSL Renew but no luck

I still need help please, thank you.

8

Here’s what https://letsdebug.net/www.plumbingandelectrical.net.au/2340540 shows

image
image1290×2796 291 KB

9

Thanks, hmmm do you have any solution or link to this issue?

10

“It is impossible to obtain a certificate using the TLS-ALPN-01 challenge with the Cloudflare CDN proxy enabled.“

I’m not really familiar with Cloudflare, but I guess I would disable the CDN proxy for at least the duration of the ACME challenge while getting the renewal certificate issued.

Or choose another challenge method.

2 Likes
11

Can we disable the Cloudflare CDN through the SSH?

12

Your DNS config is unusual.

The www subdomain has a DNS CNAME to what looks like a WP service:

www.plumbingandelectrical.net.au 60 IN CNAME wp.wpenginepowered.com.

But, your apex domain points to a single AWS IP address (probably LightSail):

plumbingandelectrical.net.au. 0 IN A 3.24.225.144

Would you explain why you set these domain names up differently?

Further, this service at www is proxied at Cloudflare as Bruce notes. This means you are using its CDN. Yet, you say you use LightSail. That is also a CDN. It is very unusual to have two "layers" of CDN. This makes traffic flows very complicated. It is almost certainly not what you want.

And, you could not possibly have gotten a cert using lego and tls-alpn for your www subdomain with this configuration.

EDIT: I also thought this seemed familiar and you had this exact problem last October. An error occurred creating certificates with Let's Encrypt: - #4 by MikeMcQ

3 Likes
13

This looks similar to the OP’s previous topic in Oct 2024 here An error occurred creating certificates with Let's Encrypt:

2 Likes
14

Yes, we cross-posted :slight_smile:

2 Likes
15

Informational, here is a list of issued certificates crt.sh | plumbingandelectrical.net.au

1 Like
16

try change --tls option to --http from

sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="DOMAIN" --path="/opt/bitnami/letsencrypt" renew --days 90

and you may want try Enable SSL access over HTTPS with Cloudflare if you are plan to use cloudflare anyway

2 Likes
17

I will try to remove wp.wpenginepowered.com in the cname first, and do the SSL renewal would that fix the issue?

18

Thanks! You guys are genius, I removed the wp.wpenginepowered.com in the CNAME in my DNS and redo the command, it seemed to work:

2025/01/20 10:37:40 [INFO] [plumbingandelectrical.net.au] acme: Trying renewal with -70 hours remaining
2025/01/20 10:37:40 [INFO] [plumbingandelectrical.net.au, www.plumbingandelectrical.net.au] acme: Obtaining bundled SAN certificate
2025/01/20 10:37:41 [INFO] [plumbingandelectrical.net.au] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/1999928347/462927957845
2025/01/20 10:37:41 [INFO] [www.plumbingandelectrical.net.au] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/1999928347/463469183835
2025/01/20 10:37:41 [INFO] [plumbingandelectrical.net.au] acme: authorization already valid; skipping challenge
2025/01/20 10:37:41 [INFO] [www.plumbingandelectrical.net.au] acme: use tls-alpn-01 solver
2025/01/20 10:37:41 [INFO] [www.plumbingandelectrical.net.au] acme: Trying to solve TLS-ALPN-01
2025/01/20 10:37:45 http: TLS handshake error from 182.18.198.14:49577: tls: client requested unsupported application protocols ([h2 http/1.1])
2025/01/20 10:37:45 http: TLS handshake error from 182.18.198.14:49578: tls: client requested unsupported application protocols ([h2 http/1.1])
2025/01/20 10:37:47 http: TLS handshake error from 182.18.198.14:49579: tls: client requested unsupported application protocols ([h2 http/1.1])
2025/01/20 10:37:48 http: TLS handshake error from 182.18.198.14:49580: tls: client requested unsupported application protocols ([h2 http/1.1])
2025/01/20 10:37:48 [INFO] [www.plumbingandelectrical.net.au] The server validated our request
2025/01/20 10:37:48 [INFO] [plumbingandelectrical.net.au, www.plumbingandelectrical.net.au] acme: Validations succeeded; requesting certificates
2025/01/20 10:37:50 [INFO] [plumbingandelectrical.net.au] Server responded with a certificate.

My site is finally have SSL

3 Likes