# Failed to update certificate **URL:** \ **Category:** Help\ **Created:** [September 19, 2022, 11:23am UTC](https://community.letsencrypt.org/t/failed-to-update-certificate/184706 "2022-09-19T11:23:42Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![nedelcuc](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@nedelcuc](https://community.letsencrypt.org/u/nedelcuc)\ **Post date:** [September 19, 2022, 11:23am UTC](https://community.letsencrypt.org/t/failed-to-update-certificate/184706/1 "2022-09-19T11:23:42Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: app.upg-ploiesti.ro I ran this command: certbot renew It produced this output: Domain: app.upg-ploiesti.ro Type: dns Detail: DNS problem: query timed out looking up A for app.upg-ploiesti.ro; DNS problem: query timed out looking up AAAA for app.upg-ploiesti.ro ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 19, 2022, 12:24pm UTC](https://community.letsencrypt.org/t/failed-to-update-certificate/184706/2 "2022-09-19T12:24:47Z")
Welcome to the community @nedelcuc Do you have a firewall for your DNS servers? Maybe one that blocks certain IP addresses? Because it looks like the IP addresses for the Let's Encrypt servers are being blocked. I say this because I see your DNS records just fine from my own test server. And, so does the `unboundtest.com` site that looks up DNS similar to how Let's Encrypt Servers do it. The [Let's Debug test site](https://letsdebug.net/app.upg-ploiesti.ro/1195530) debug info shows this same pattern. The Debug site's own tests for your DNS are fine. But, it's test with the Let's Encrypt staging system fails to lookup your DNS. ---
**Author:** ![nedelcuc](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@nedelcuc](https://community.letsencrypt.org/u/nedelcuc)\ **Post date:** [September 19, 2022, 12:34pm UTC](https://community.letsencrypt.org/t/failed-to-update-certificate/184706/3 "2022-09-19T12:34:36Z")
Do you know for what IP I'm looking for? ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 19, 2022, 12:39pm UTC](https://community.letsencrypt.org/t/failed-to-update-certificate/184706/4 "2022-09-19T12:39:11Z")
No. The IP addresses are not published. There will be requests from multiple IP addresses. The IP addresses change even from hour to hour. See details below. Did you add or change your DNS firewall since you last got a successful cert on 2022-06-25? > **[FAQ - Let's Encrypt](https://letsencrypt.org/docs/faq/#what-ip-addresses-does-let-s-encrypt-use-to-validate-my-web-server)** > > This FAQ is divided into the following sections: > General Questions Technical Questions General Questions What services does Let’s Encrypt offer? Let’s Encrypt is a global Certificate Authority (CA). We let people and organizations... ---
**Author:** ![nedelcuc](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@nedelcuc](https://community.letsencrypt.org/u/nedelcuc)\ **Post date:** [September 19, 2022, 12:54pm UTC](https://community.letsencrypt.org/t/failed-to-update-certificate/184706/5 "2022-09-19T12:54:56Z")
No change in the network config! This log is frim DNS server : tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 16:12:40.005268 IP letsdebug.net.17974 \> 78.96.59.4.domain: 27638% [1au] A? SE.Upg-PloIESTI.RO. (47) 16:12:40.005645 IP 78.96.59.4.domain \> letsdebug.net.17974: 27638\*- 1/0/1 A 78.96.59.13 (81) As you can see my server receive the request and answer! I test with se subdomain but is the same in app. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 19, 2022, 1:31pm UTC](https://community.letsencrypt.org/t/failed-to-update-certificate/184706/6 "2022-09-19T13:31:07Z")
I see the request from let's debug but I don't see any requests from the let's encrypt servers what firewall do you have protecting your DNS servers ---
**Author:** ![nedelcuc](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@nedelcuc](https://community.letsencrypt.org/u/nedelcuc)\ **Post date:** [September 19, 2022, 3:15pm UTC](https://community.letsencrypt.org/t/failed-to-update-certificate/184706/7 "2022-09-19T15:15:08Z")
I filter the log for lets debug, the output is the same as certbot. I don't think is an firewall problem I’m on linux and not using an adaptive policy! ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 19, 2022, 3:15pm UTC](https://community.letsencrypt.org/t/failed-to-update-certificate/184706/8 "2022-10-19T15:15:14Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.