Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com ), so withholding your domain name here does not increase secrecy, but …

Indeed! The as I mentioned, the ipfw firewall has always been temporarily disabled when updating. So the firewall should not matter. Here's the cron script: #!/bin/sh ## # certbot_renew # 1.3.2 # 2024-10-24 ## service ipfw stop tar czf /usr/local/etc/letsencrypt/bu/$(date "+%Y-…

I am stepping away for a bit. But, as an aside requests to your domain get a faulty cert chain. You only send the leaf and not the leaf with the intermediate. The --nginx authenticator is usually used also as "installer" which sets up the right file to use. So, something is amiss. Could some ot…

That may be it: ssl_certificate /usr/local/etc/letsencrypt/live/wx.schamschula.com/cert.pem; ssl_certificate_key /usr/local/etc/letsencrypt/live/wx.schamschula.com/privkey.pem; include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhpara…

Definitely use fullchain.pem rather than cert.pem But, that isn't affecting the renewal failure. That is happening on port 80 (HTTP) anyway and even if you redirected Let's Encrypt does not validate certs for a cert request.

I've updated to use fullchain.pem, but as you mentioned that doesn't make a difference in terms of port 80.

Further testing using the certbot --dry-run and --debug-challenges allowed me to fetch the file from Dreamhost and verify the contents. However, the dry run itself still errors out.

I just noticed that the version of certbot provided by FreeBSD ports is rather old: 4.2.0. MacPorts is at version 5.2.2.

Connectivity seems to be flaky from several places around the world. Check website performance and response : Check host - online website monitoring Website checking for speed and availability with servers around the world: website monitoring with useful tools, Check IP, Check website…

Still no luck. I can remotely grab the challenge data from both campus and Dreamhost, but The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. The log file gives me 2026-01-12 14:18:09,895:DEBUG:certbot._internal.error_handler:Encountered exceptio…

You omitted the "reason" part of the error message. And, the tail of the log also omits it. We need to see the command you tried and all the output from that command. The specific details matter. That said, earlier you said this should work: http://wx.schamschula.com/.well-known/acme-challenge/…

Error getting validation data

Help

Bruce5051 January 12, 2026, 9:22pm 20

I agree with Mike.
I believe there is to much geo blocking see here Check Website Availability

Please see Multi-Perspective Validation & Geoblocking FAQ

Topic		Replies	Views
Challenges failed for renewal Help	27	3423	July 30, 2022
Cert Renew Fail Help	19	1407	February 22, 2021
Certbot Renewal Fails Unauthorized Help	9	6725	December 5, 2021
Certbot renewal fails with "The client lacks sufficient authorization" error Help	2	4715	July 30, 2017
Unable to renew cert using nginx plugin, fresh cert creation succeeds Help	9	6029	November 8, 2019

Error getting validation data

Related topics