Failed to Renew

Help
1

Greetings all,

I am hoping someone can point me in the right direction, renewing a certificate. the machine have been up for years without any hiccups and today the certificate expired and I cannot renew. I have neglected this machines and my Ubuntu skills have not been utilized for quite some time - time ti get back in the grind.

Thank you advance for the support and guidance and please let me know what further information can be provided.

  • Ping test are successful to dns name
  • Firewall is inactive
  • Log File Attached

certbot --version
certbot 1.21.0

Web Server Version - apache2 -v
Server version: Apache/2.4.52 (Ubuntu)
Server built: 2026-03-05T18:04:29

Ubuntu Version - lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04.3 LTS
Release: 22.04
Codename: jammy

sudo apachectl configtest
Syntax OK

certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Found the following certs:
Certificate Name: nextcloud.eclipsephoto.net
Serial Number: 5e5130c96ea847f1e75fd277768d2b40716
Key Type: RSA
Domains: nextcloud.eclipsephoto.net
Expiry Date: 2026-03-24 03:07:58+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/nextcloud.eclipsephoto.net/fullchain.pem
Private Key Path: /etc/letsencrypt/live/nextcloud.eclipsephoto.net/privkey.pem

**
letsencrypt.txt (380.4 KB)
**
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/nextcloud.eclipsephoto.net.conf

Certificate is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Simulating renewal of an existing certificate for nextcloud.eclipsephoto.net
Performing the following challenges:
http-01 challenge for nextcloud.eclipsephoto.net
Waiting for verification...
Challenge failed for domain nextcloud.eclipsephoto.net
http-01 challenge for nextcloud.eclipsephoto.net

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: nextcloud.eclipsephoto.net
Type: connection
Detail: 207.237.25.23: Fetching http://nextcloud.eclipsephoto.net/.well-known/acme-challenge/Sz5W9bac9NyMi1VkO5_n877-nDCZA_WxVJKMqYaRLXg: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Cleaning up challenges
Failed to renew certificate nextcloud.eclipsephoto.net with error: Some challenges have failed.

All simulated renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/nextcloud.eclipsephoto.net/fullchain.pem (failure)

1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

1 Like
2

Welcome @ylafont thanks for all the great info. The key part is this:

HTTPS requests using port 443 are reaching your server just fine. They see an expired cert but the connection at least works.

But, HTTP requests using port 80 are failing. Have you recently gotten a new router or some other network related change? Because that is most likely where the problem lies. The --apache option you use with Certbot uses an HTTP Challenge that requires port 80 connections to work.

Focus on any changes since you last got a cert on Dec24 last year

We can reproduce the problem using the Let's Debug test site. It is a good one to use as you make changes trying to correct this before you try to get a cert.

4 Likes