Failed to generate ssl on all my domains on this server why?

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: dg.xxxxxxxxx.com

I ran this command: acme.sh --issue -d dg.xxxxxxxxx.com --webroot /home/xxxx/xxxx

It produced this output:

[Sat Mar  5 16:44:55 IST 2022] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Sat Mar  5 16:44:56 IST 2022] HEAD
[Sat Mar  5 16:44:56 IST 2022] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
[Sat Mar  5 16:44:56 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  -g  -I  '
[Sat Mar  5 16:45:25 IST 2022] _ret='0'
[Sat Mar  5 16:45:25 IST 2022] POST
[Sat Mar  5 16:45:25 IST 2022] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Sat Mar  5 16:45:25 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  -g '
[Sat Mar  5 16:47:04 IST 2022] _ret='0'
[Sat Mar  5 16:47:04 IST 2022] POST
[Sat Mar  5 16:47:04 IST 2022] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Sat Mar  5 16:47:04 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  -g '
[Sat Mar  5 16:47:33 IST 2022] _ret='0'
[Sat Mar  5 16:47:33 IST 2022] code='400'
[Sat Mar  5 16:47:33 IST 2022] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Sat Mar  5 16:47:34 IST 2022] HEAD
[Sat Mar  5 16:47:34 IST 2022] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
[Sat Mar  5 16:47:34 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  -g  -I  '
[Sat Mar  5 16:49:12 IST 2022] _ret='0'
[Sat Mar  5 16:49:12 IST 2022] code='400'
[Sat Mar  5 16:49:12 IST 2022] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Sat Mar  5 16:49:13 IST 2022] HEAD
[Sat Mar  5 16:49:13 IST 2022] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
[Sat Mar  5 16:49:13 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  -g  -I  '
[Sat Mar  5 16:49:42 IST 2022] _ret='0'
[Sat Mar  5 16:49:42 IST 2022] POST
[Sat Mar  5 16:49:42 IST 2022] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Sat Mar  5 16:49:42 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  -g '
[Sat Mar  5 16:51:21 IST 2022] _ret='0'
[Sat Mar  5 16:51:21 IST 2022] POST
[Sat Mar  5 16:51:21 IST 2022] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Sat Mar  5 16:51:21 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  -g '
[Sat Mar  5 16:51:50 IST 2022] _ret='0'
[Sat Mar  5 16:51:50 IST 2022] code='400'

My web server is (include version): CentOS Linux release 7.9.2009 (Core)

The operating system my web server runs on is (include version): linux

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): centos web panel v0.9.8.1131

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot --version

certbot 1.11.0

2

Why both?

I'm going to assume certbot isn't relevant.

Give me the output of

curl -iL https://acme-v02.api.letsencrypt.org/directory
3 
~]# curl -iL https://acme-v02.api.letsencrypt.org/directory
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Mar 2022 11:38:34 GMT
Content-Type: application/json
Content-Length: 658
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
 "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
 "meta": {
   "caaIdentities": [
     "letsencrypt.org"
   ],
   "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",
   "website": "https://letsencrypt.org"
 },
 "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
 "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
 "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
 "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert",
 "w6gCx5ZFRyU": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417"
}
4

So you can connect to the acme server. Good.

Please use three backticks before and after the code you paste, like this:

```
code
goes
here
```
1 Like
5

Http error 400 means there's an issue with your request, can you run your command again but telling acme.sh to be more verbose?

1 Like
6 
 ~]# acme.sh --issue -d dg.xxxxxxxxx.com --webroot /home/xxxx/public_html/dg --debug 2
[Sat Mar  5 17:18:32 IST 2022] Lets find script dir.
[Sat Mar  5 17:18:32 IST 2022] _SCRIPT_='/root/.acme.sh/acme.sh'
[Sat Mar  5 17:18:32 IST 2022] _script='/root/.acme.sh/acme.sh'
[Sat Mar  5 17:18:32 IST 2022] _script_home='/root/.acme.sh'
[Sat Mar  5 17:18:32 IST 2022] Using config home:/root/.acme.sh
[Sat Mar  5 17:18:32 IST 2022] LE_WORKING_DIR='/root/.acme.sh'
https://github.com/acmesh-official/acme.sh
v3.0.2
[Sat Mar  5 17:18:32 IST 2022] Running cmd: issue
[Sat Mar  5 17:18:32 IST 2022] _main_domain='dg.xxxxxxxxx.com'
[Sat Mar  5 17:18:32 IST 2022] _alt_domains='no'
[Sat Mar  5 17:18:32 IST 2022] Using config home:/root/.acme.sh
[Sat Mar  5 17:18:32 IST 2022] default_acme_server='https://acme-v02.api.letsencrypt.org/directory'
[Sat Mar  5 17:18:32 IST 2022] ACME_DIRECTORY='https://acme-v02.api.letsencrypt.org/directory'
[Sat Mar  5 17:18:32 IST 2022] _ACME_SERVER_HOST='acme-v02.api.letsencrypt.org'
[Sat Mar  5 17:18:32 IST 2022] _ACME_SERVER_PATH='directory'
[Sat Mar  5 17:18:32 IST 2022] DOMAIN_PATH='/root/.acme.sh/dg.xxxxxxxxx.com'
[Sat Mar  5 17:18:32 IST 2022] '/home/xxxx/public_html/dg' does not contain 'dns'
[Sat Mar  5 17:18:32 IST 2022] Using ACME_DIRECTORY: https://acme-v02.api.letsencrypt.org/directory
[Sat Mar  5 17:18:32 IST 2022] _init api for server: https://acme-v02.api.letsencrypt.org/directory
[Sat Mar  5 17:18:32 IST 2022] GET
[Sat Mar  5 17:18:32 IST 2022] url='https://acme-v02.api.letsencrypt.org/directory'
[Sat Mar  5 17:18:32 IST 2022] timeout=
[Sat Mar  5 17:18:32 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  --trace-ascii /tmp/tmp.dIufQFi8Bt  -g '
[Sat Mar  5 17:20:40 IST 2022] ret='0'
[Sat Mar  5 17:20:40 IST 2022] response='{
  "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
  "ktKbj7TP9qU": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "meta": {
    "caaIdentities": [
      "letsencrypt.org"
    ],
    "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",
    "website": "https://letsencrypt.org"
  },
  "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
  "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
  "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
  "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
}'
[Sat Mar  5 17:20:40 IST 2022] ACME_KEY_CHANGE='https://acme-v02.api.letsencrypt.org/acme/key-change'
[Sat Mar  5 17:20:40 IST 2022] ACME_NEW_AUTHZ
[Sat Mar  5 17:20:40 IST 2022] ACME_NEW_ORDER='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Sat Mar  5 17:20:40 IST 2022] ACME_NEW_ACCOUNT='https://acme-v02.api.letsencrypt.org/acme/new-acct'
[Sat Mar  5 17:20:40 IST 2022] ACME_REVOKE_CERT='https://acme-v02.api.letsencrypt.org/acme/revoke-cert'
[Sat Mar  5 17:20:40 IST 2022] ACME_AGREEMENT='https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf'
[Sat Mar  5 17:20:40 IST 2022] ACME_NEW_NONCE='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
[Sat Mar  5 17:20:40 IST 2022] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Sat Mar  5 17:20:40 IST 2022] _on_before_issue
[Sat Mar  5 17:20:40 IST 2022] _chk_main_domain='dg.xxxxxxxxx.com'
[Sat Mar  5 17:20:40 IST 2022] _chk_alt_domains
[Sat Mar  5 17:20:40 IST 2022] '/home/xxxx/public_html/dg' does not contain 'no'
[Sat Mar  5 17:20:40 IST 2022] Le_LocalAddress
[Sat Mar  5 17:20:40 IST 2022] d='dg.xxxxxxxxx.com'
[Sat Mar  5 17:20:40 IST 2022] Check for domain='dg.xxxxxxxxx.com'
[Sat Mar  5 17:20:40 IST 2022] _currentRoot='/home/xxxx/public_html/dg'
[Sat Mar  5 17:20:40 IST 2022] d
[Sat Mar  5 17:20:40 IST 2022] '/home/xxxx/public_html/dg' does not contain 'apache'
[Sat Mar  5 17:20:40 IST 2022] _saved_account_key_hash='PYVdvHKWEQadd3RdzhO7LBJwjt/psXtcNleZG09mGPA='
[Sat Mar  5 17:20:40 IST 2022] _saved_account_key_hash is not changed, skip register account.
[Sat Mar  5 17:20:40 IST 2022] Read key length:
[Sat Mar  5 17:20:40 IST 2022] Creating domain key
[Sat Mar  5 17:20:40 IST 2022] Use DEFAULT_DOMAIN_KEY_LENGTH=2048
[Sat Mar  5 17:20:40 IST 2022] Using config home:/root/.acme.sh
[Sat Mar  5 17:20:40 IST 2022] ACME_DIRECTORY='https://acme-v02.api.letsencrypt.org/directory'
[Sat Mar  5 17:20:40 IST 2022] _ACME_SERVER_HOST='acme-v02.api.letsencrypt.org'
[Sat Mar  5 17:20:40 IST 2022] _ACME_SERVER_PATH='directory'
[Sat Mar  5 17:20:40 IST 2022] _createkey for file:/root/.acme.sh/dg.xxxxxxxxx.com/dg.xxxxxxxxx.com.key
[Sat Mar  5 17:20:40 IST 2022] Use length 2048
[Sat Mar  5 17:20:40 IST 2022] Using RSA: 2048
[Sat Mar  5 17:20:41 IST 2022] The domain key is here: /root/.acme.sh/dg.xxxxxxxxx.com/dg.xxxxxxxxx.com.key
[Sat Mar  5 17:20:41 IST 2022] _createcsr
[Sat Mar  5 17:20:41 IST 2022] domain='dg.xxxxxxxxx.com'
[Sat Mar  5 17:20:41 IST 2022] domainlist
[Sat Mar  5 17:20:41 IST 2022] csrkey='/root/.acme.sh/dg.xxxxxxxxx.com/dg.xxxxxxxxx.com.key'
[Sat Mar  5 17:20:41 IST 2022] csr='/root/.acme.sh/dg.xxxxxxxxx.com/dg.xxxxxxxxx.com.csr'
[Sat Mar  5 17:20:41 IST 2022] csrconf='/root/.acme.sh/dg.xxxxxxxxx.com/dg.xxxxxxxxx.com.csr.conf'
[Sat Mar  5 17:20:41 IST 2022] Single domain='dg.xxxxxxxxx.com'
[Sat Mar  5 17:20:41 IST 2022] seg='dg'
[Sat Mar  5 17:20:41 IST 2022] _is_idn_d='dg.xxxxxxxxx.com'
[Sat Mar  5 17:20:41 IST 2022] _idn_temp
[Sat Mar  5 17:20:41 IST 2022] _is_idn_d='dg.xxxxxxxxx.com'
[Sat Mar  5 17:20:41 IST 2022] _idn_temp
[Sat Mar  5 17:20:41 IST 2022] _csr_cn='dg.xxxxxxxxx.com'
[Sat Mar  5 17:20:41 IST 2022] seg='dg'
[Sat Mar  5 17:20:41 IST 2022] Getting domain auth token for each domain
[Sat Mar  5 17:20:41 IST 2022] seg='dg'
[Sat Mar  5 17:20:41 IST 2022] _is_idn_d='dg.xxxxxxxxx.com'
[Sat Mar  5 17:20:41 IST 2022] _idn_temp
[Sat Mar  5 17:20:41 IST 2022] d
[Sat Mar  5 17:20:41 IST 2022] _identifiers='{"type":"dns","value":"dg.xxxxxxxxx.com"}'
[Sat Mar  5 17:20:41 IST 2022] url='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Sat Mar  5 17:20:41 IST 2022] payload='{"identifiers": [{"type":"dns","value":"dg.xxxxxxxxx.com"}]}'
[Sat Mar  5 17:20:41 IST 2022] RSA key
[Sat Mar  5 17:20:41 IST 2022] _URGLY_PRINTF
[Sat Mar  5 17:20:41 IST 2022] xargs
[Sat Mar  5 17:20:41 IST 2022] _URGLY_PRINTF
[Sat Mar  5 17:20:41 IST 2022] xargs
[Sat Mar  5 17:20:41 IST 2022] Get nonce with HEAD. ACME_NEW_NONCE='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
[Sat Mar  5 17:20:41 IST 2022] HEAD
[Sat Mar  5 17:20:41 IST 2022] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
[Sat Mar  5 17:20:41 IST 2022] body
[Sat Mar  5 17:20:41 IST 2022] _postContentType='application/jose+json'
[Sat Mar  5 17:20:41 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  --trace-ascii /tmp/tmp.9atZwCeQIj  -g  -I  '
[Sat Mar  5 17:22:49 IST 2022] _ret='0'
[Sat Mar  5 17:22:49 IST 2022] _headers='HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Mar 2022 11:52:49 GMT
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0002iASNsdcp9p9jAWEL5xNsA9dqunCmZZlaLQOR3EO6ttM
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
'
[Sat Mar  5 17:22:49 IST 2022] _CACHED_NONCE='0002iASNsdcp9p9jAWEL5xNsA9dqunCmZZlaLQOR3EO6ttM'
[Sat Mar  5 17:22:49 IST 2022] nonce='0002iASNsdcp9p9jAWEL5xNsA9dqunCmZZlaLQOR3EO6ttM'
[Sat Mar  5 17:22:49 IST 2022] POST
[Sat Mar  5 17:22:49 IST 2022] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Sat Mar  5 17:22:49 IST 2022] body='{"protected": "eyJub25jZSI6ICIwMDAyaUFTTnNkY3A5cDlqQVdFTDV4TnNBOWRxdW5DbVpabGFMUU9SM0VPNnR0TSIsICJ1cmwiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvbmV3LW9yZGVyIiwgImFsZyI6ICJSUzI1NiIsICJraWQiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYWNjdC84OTMwMjQxMCJ9", "payload": "eyJpZGVudGlmaWVycyI6IFt7InR5cGUiOiJkbnMiLCJ2YWx1ZSI6ImRnLmRyb3BnYWxheHkuY29tIn1dfQ", "signature": "MhX69uZj-lcYq3Ci8fbAZ9kGMKWaJeLuGlRQK1pMzBLpoHRZJtdLixR2HzThiTDl2IAc2MkmYuC9vcbYsiKv-GLtRAIHXXwt9hl9dxbNCUihYKfSB24I_ltZTKMdaJd7vRZaUlW3ABXxdcNdejcx4_lF4eKlQxROu8vgm_GOhEtH8iMGMNKdnyFfZ7L2NTiMbSWH0VYQmAaGRnEodyuO0SFzrNwe7pMydtd9oQP8WuTT-m058tEax4mTGdzOVXpVRlD_q9eV_89QssCaWmg5_NfANzplVc2fSgEUx6gt2N6VTH-lFpJTBM5Eyzwfy21Jll4_uaS29PJ-qUhskmfGvw"}'
[Sat Mar  5 17:22:49 IST 2022] _postContentType='application/jose+json'
[Sat Mar  5 17:22:49 IST 2022] Http already initialized.
[Sat Mar  5 17:22:49 IST 2022] _CURL='curl --silent --dump-header /root/.acme.sh/http.header  -L  --trace-ascii /tmp/tmp.9atZwCeQIj  -g '
[Sat Mar  5 17:24:57 IST 2022] _ret='0'
[Sat Mar  5 17:24:57 IST 2022] responseHeaders='HTTP/1.1 400 Bad Request
Server: nginx
Date: Sat, 05 Mar 2022 11:54:56 GMT
Content-Type: application/problem+json
Content-Length: 173
Connection: keep-alive
Boulder-Requester: 89302410
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0101LDPSXUoKs4PgrMyZUnK_LKbLNEp8e151EjTMeOPSQuU
'
[Sat Mar  5 17:24:57 IST 2022] code='400'
[Sat Mar  5 17:24:57 IST 2022] original='{
  "type": "urn:ietf:params:acme:error:badNonce",
  "detail": "JWS has an invalid anti-replay nonce: \"0002iASNsdcp9p9jAWEL5xNsA9dqunCmZZlaLQOR3EO6ttM\"",
  "status": 400
}'
[Sat Mar  5 17:24:57 IST 2022] response='{
  "type": "urn:ietf:params:acme:error:badNonce",
  "detail": "JWS has an invalid anti-replay nonce: \"0002iASNsdcp9p9jAWEL5xNsA9dqunCmZZlaLQOR3EO6ttM\"",
  "status": 400
}'
[Sat Mar  5 17:24:57 IST 2022] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
7

It needs two minutes to tell you it failed. Something is messed up here. I smell firewall, connectivity problems?

1 Like
8

yes it is still retrying

It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
9

It could resolve itself automatically, but the problem is likely in the network infrastructure between your server and acme-v02.api.letsencrypt.org

1 Like
10

yes even i disabled firewall before command still same error dont know how to make it work.
any solutions?

11

I don't know.

If you didn't change anything and it worked before, it's probably somebody else's actions that caused this: your host? ISP? Let's Encrypt itself?

I don't know if two minutes is enough to make a nonce expire. But seeing you also have certbot installed: does it give you the same issue?

1 Like
13 
curl -6 ifconfig.co

this command output nothing just stuck , so this can be reason?
do you have solution for this?

15

nope. you just don't have IPv6 support, and you appropriately do not include an AAAA record in your dns zone

# dig aaaa dg.dropgalaxy.com

; <<>> DiG 9.16.1-Ubuntu <<>> aaaa dg.dropgalaxy.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53929
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;dg.dropgalaxy.com.             IN      AAAA

;; Query time: 11 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sat Mar 05 14:13:33 CET 2022
;; MSG SIZE  rcvd: 46
16

what i should do then to solve this?

17

You try with certbot, maybe, and you wait for some fresh eyes to see this thread.

1 Like
19

i ordered ipv6, rebooted server, rerun acme.sh and now all my ssl renewed in just 3 seconds.
it was all cause of ipv6 disabled before.
you can close this topic now.
thanks 9peppe for your help.

20

No, IPv6 is not required for certbot or Let's Encrypt.

I don't even see an AAAA record in your DNS so IPv6 is not used by Let's Encrypt server. Maybe rebooting fixed it or even having your network config reset by "ordering ipv6". @9peppe might have more ideas.

But, glad you have it working.

2 Likes
21

It looks like a temp error from the Letsencrypt server.

22

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.