Failed authentication/connection reset on renewal

Help
1

Hi, at some point in the past I used certbot to set up a ssl site, and it worked fine. I've just noticed it's stopped renewing, and am trying to work out why.

My domain is: AdZ.cf.ac.uk
I ran these commands:
sudo certbot renew --standalone (I stopped apache2 first).
sudo certbot renew --webroot -w /var/www/new_html/web/ (after restarting apache2)

First command gave:
Processing /etc/letsencrypt/renewal/adz.cf.ac.uk.conf

Renewing an existing certificate for adz.cf.ac.uk

Exception occurred during processing of request from ('::ffff:23.178.112.107', 53863, 0, 0)
Traceback (most recent call last):
  File "/snap/certbot/4412/usr/lib/python3.12/socketserver.py", line 318, in _handle_request_noblock
    self.process_request(request, client_address)
  File "/snap/certbot/4412/usr/lib/python3.12/socketserver.py", line 349, in process_request
    self.finish_request(request, client_address)
  File "/snap/certbot/4412/usr/lib/python3.12/socketserver.py", line 362, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/snap/certbot/4412/lib/python3.12/site-packages/acme/standalone.py", line 235, in __init__
    super().__init__(*args, **kwargs)
  File "/snap/certbot/4412/usr/lib/python3.12/socketserver.py", line 761, in __init__
    self.handle()
  File "/snap/certbot/4412/lib/python3.12/site-packages/acme/standalone.py", line 260, in handle
    BaseHTTPServer.BaseHTTPRequestHandler.handle(self)
  File "/snap/certbot/4412/usr/lib/python3.12/http/server.py", line 436, in handle
    self.handle_one_request()
  File "/snap/certbot/4412/usr/lib/python3.12/http/server.py", line 404, in handle_one_request
    self.raw_requestline = self.rfile.readline(65537)
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/snap/certbot/4412/usr/lib/python3.12/socket.py", line 707, in readinto
    return self._sock.recv_into(b)
           ^^^^^^^^^^^^^^^^^^^^^^^
ConnectionResetError: [Errno 104] Connection reset by peer
----------------------------------------

Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
  Domain: adz.cf.ac.uk
  Type:   unauthorized
  Detail: 131.251.14.15: Invalid response from http://adz.cf.ac.uk/.well-known/acme-challenge/_xTJdXNK-GkxUA5m5cSSDM3SEJAfzj6_OcjBFqpKaPc: 503

Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet.

Second gave:
Processing /etc/letsencrypt/renewal/adz.cf.ac.uk.conf

Renewing an existing certificate for adz.cf.ac.uk

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: adz.cf.ac.uk
  Type:   unauthorized
  Detail: 131.251.14.15: Invalid response from http://adz.cf.ac.uk/.well-known/acme-challenge/i9wm5NB1oUX-puIrMQSO9FvMye5sucuhd1ixE57hEdE: 503

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

My web server is (include version): Apache 2.4.52

The operating system my web server runs on is (include version): Ubuntu 22.04

My hosting provider, if applicable, is: My University

I can login to a root shell on my machine: Yes

I'm using a control panel to manage my site: No

The version of my client is: 3.2.0

2

Welcome @RichStant

Looks like your university has a firewall interfering with the HTTP Challenge request sent to your domain.

I think the "Reset by peer" is caused by the same firewall as the friendlier message shown by the test site below. Which has a title of Cardiff University :: Application Blocked

Without digging too deep I'd guess you have a Palo Alto brand firewall. And, these have an "Application" setting that can block the ACME Challenge. This is something to ask of your network admin group.

1 Like
3

Ah, OK. Thanks for the info.

2 Likes