# Error getting ACME certificate for domain **URL:** \ **Category:** Help\ **Created:** [February 8, 2018, 4:36pm UTC](https://community.letsencrypt.org/t/error-getting-acme-certificate-for-domain/52565 "2018-02-08T16:36:23Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![hbellur](https://avatars.discourse-cdn.com/v4/letter/h/91b2a8/32.png) [@hbellur](https://community.letsencrypt.org/u/hbellur)\ **Post date:** [February 8, 2018, 4:36pm UTC](https://community.letsencrypt.org/t/error-getting-acme-certificate-for-domain/52565/1 "2018-02-08T16:36:23Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: evm.xrtc.cloud, pr-evm-east-001.xrtc.cloud I ran this command: launched traefik binary 1.5.1 It produced this output: {“level”:“error”,“msg”:“map[pr-evm-east-001.xrtc.cloud:acme: Error 400 - urn:acme:error:connection - Fetching [http://pr-evm-east-001.xrtc.cloud/.well-known/acme-challenge/KonqIoyYXofIMYD43cBmWmECMhlB5qXg1-NIZrgLxvY:](http://pr-evm-east-001.xrtc.cloud/.well-known/acme-challenge/KonqIoyYXofIMYD43cBmWmECMhlB5qXg1-NIZrgLxvY:) Timeout\nError Detail:\n\tValidation for pr-evm-east-001.xrtc.cloud:80\n\tResolved to:\n\t\t54.173.176.241\n\t\t2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\tUsed: 2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\n]”,“time”:“2018-02-08T17:09:53Z”} {“level”:“error”,“msg”:“Error getting ACME certificate for domain [pr-evm-east-001.xrtc.cloud]: cannot obtain certificates map[pr-evm-east-001.xrtc.cloud:acme: Error 400 - urn:acme:error:connection - Fetching [http://pr-evm-east-001.xrtc.cloud/.well-known/acme-challenge/KonqIoyYXofIMYD43cBmWmECMhlB5qXg1-NIZrgLxvY:](http://pr-evm-east-001.xrtc.cloud/.well-known/acme-challenge/KonqIoyYXofIMYD43cBmWmECMhlB5qXg1-NIZrgLxvY:) Timeout\nError Detail:\n\tValidation for pr-evm-east-001.xrtc.cloud:80\n\tResolved to:\n\t\t54.173.176.241\n\t\t2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\tUsed: 2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\n]”,“time”:“2018-02-08T17:09:53Z”} My web server is (include version): Traefik 1.5.1 The operating system my web server runs on is (include version): Ubuntu 16.04 My hosting provider, if applicable, is: AWS I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [February 8, 2018, 6:17pm UTC](https://community.letsencrypt.org/t/error-getting-acme-certificate-for-domain/52565/2 "2018-02-08T18:17:06Z")
Hi @hbellur, This problem could be a result of a firewall or of an IPv6 routing issue. I can currently connect to port 80 of this host in both IPv4 and IPv6, so I’m somewhat inclined to suspect an IPv6 routing problem. However, do you have any kind of host or network firewall policy that could block incoming connections from some sources on port 80? ---
**Author:** ![hbellur](https://avatars.discourse-cdn.com/v4/letter/h/91b2a8/32.png) [@hbellur](https://community.letsencrypt.org/u/hbellur)\ **Post date:** [February 8, 2018, 6:57pm UTC](https://community.letsencrypt.org/t/error-getting-acme-certificate-for-domain/52565/3 "2018-02-08T18:57:58Z")
> [@schoen](#): > > This problem could be a result of a firewall or of an IPv6 routing issue. I can currently connect to port 80 of this host in both IPv4 and IPv6, so I’m somewhat inclined to suspect an IPv6 routing problem. However, do you have any kind of host or network firewall policy that could block incoming connections from some sources on port 80? So I fixed the routing issue. Now I am getting messed up with my load balancers. I was able to launch the first load balancer successfully. I get these errors on the second load balancer {"level":"error","msg":"map[evm.xrtc.cloud:acme: Error 400 - urn:acme:error:connection - Fetching [http://evm.xrtc.cloud/.well-known/acme-challenge/tg2dLS37EgpdIMfmiVdFGTudm49uvHOJ\_IxuFmKUF4M:](http://evm.xrtc.cloud/.well-known/acme-challenge/tg2dLS37EgpdIMfmiVdFGTudm49uvHOJ_IxuFmKUF4M:) Timeout\nError Detail:\n\tValidation for evm.xrtc.cloud:80\n\tResolved to:\n\t\t54.173.176.241\n\t\t2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\tUsed: 2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\n]","time":"2018-02-08T18:33:38Z"} {"level":"error","msg":"Error getting ACME certificate for domain [evm.xrtc.cloud]: cannot obtain certificates map[evm.xrtc.cloud:acme: Error 400 - urn:acme:error:connection - Fetching [http://evm.xrtc.cloud/.well-known/acme-challenge/tg2dLS37EgpdIMfmiVdFGTudm49uvHOJ\_IxuFmKUF4M:](http://evm.xrtc.cloud/.well-known/acme-challenge/tg2dLS37EgpdIMfmiVdFGTudm49uvHOJ_IxuFmKUF4M:) Timeout\nError Detail:\n\tValidation for evm.xrtc.cloud:80\n\tResolved to:\n\t\t54.173.176.241\n\t\t2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\tUsed: 2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\n]","time":"2018-02-08T18:33:38Z"} {"level":"error","msg":"map[[testevm.comcast.net](http://testevm.comcast.net):acme: Error 400 - urn:acme:error:connection - Fetching [http://testevm.comcast.net/.well-known/acme-challenge/JbCKom8tlNB4SPFCwLGaVQ18hQm9v1LNYb7prfkpDNU:](http://testevm.comcast.net/.well-known/acme-challenge/JbCKom8tlNB4SPFCwLGaVQ18hQm9v1LNYb7prfkpDNU:) Timeout\nError Detail:\n\tValidation for [testevm.comcast.net:80](http://testevm.comcast.net:80)\n\tResolved to:\n\t\t54.173.176.241\n\t\t2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\tUsed: 2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\n]","time":"2018-02-08T18:33:49Z"} {"level":"error","msg":"Error getting ACME certificate for domain [[testevm.comcast.net](http://testevm.comcast.net)]: cannot obtain certificates map[[testevm.comcast.net](http://testevm.comcast.net):acme: Error 400 - urn:acme:error:connection - Fetching [http://testevm.comcast.net/.well-known/acme-challenge/JbCKom8tlNB4SPFCwLGaVQ18hQm9v1LNYb7prfkpDNU:](http://testevm.comcast.net/.well-known/acme-challenge/JbCKom8tlNB4SPFCwLGaVQ18hQm9v1LNYb7prfkpDNU:) Timeout\nError Detail:\n\tValidation for [testevm.comcast.net:80](http://testevm.comcast.net:80)\n\tResolved to:\n\t\t54.173.176.241\n\t\t2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\tUsed: 2600:1f18:228a:ef00:7c2a:32b9:43a7:918d\n\n]","time":"2018-02-08T18:33:49Z"} Note that the IP addresses belong to the first load balancer. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [February 8, 2018, 7:02pm UTC](https://community.letsencrypt.org/t/error-getting-acme-certificate-for-domain/52565/4 "2018-02-08T19:02:25Z")
So could incoming requests go to either load balancer? What we’ve often suggested in this case is to treat `/.well-known/acme-challenge` specially in this case. There are various ways to do that. One is to cause it to generate an HTTP 301 redirect (which the certificate authority will follow!) to a special hostname that is only used for ACME challenges, and which is always routed to the machine that’s running the ACME client. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 10, 2018, 7:02pm UTC](https://community.letsencrypt.org/t/error-getting-acme-certificate-for-domain/52565/5 "2018-03-10T19:02:25Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.