My domain is: https://generalgrains.com/ I ran this command: v-add-letsencrypt-domain admin generalgrains.com It produced this output: Error: Let's Encrypt finalize bad status 403 --- Sending CSR to finalize order / STEP 6 --- [Mon Oct 13 09:10:43 MDT 2025] : answer=HTTP/2 403 server: nginx da…

[image] Sysa-Cotton: My web server is (include version): nginx version: nginx/1.18.0 & Server version: Apache/2.4.25 (Debian) Would you explain how these two web servers are used? I see nginx responding to HTTP (port 80) requests. Is that what I should see? [image] Sysa-Cotton: it seem…

Yes nginx is what should be used. Sure, here's the full output from the logs [Mon Oct 13 09:10:37 MDT 2025] : v-add-letsencrypt-domain generalgrains.com [Mon Oct 13 09:10:37 MDT 2025] : v-add-letsencrypt-user admin [Mon Oct 13 09:10:37 MDT 2025] : result: 0 [Mon Oct 13 09:10:37 MDT 2025] : ---…

Well, that program's log doesn't make it easy, but the challenge link here gives a reason [image] Sysa-Cotton: { "type": "http-01", "url": " https://acme-v02.api.letsencrypt.org/acme/chall/1450010146/597228055291/tiSPwA ", "status": "pending", "token": "2OygqlRMI_pQbmP0cu73me9H05dKIP7U2CFHNQt…

Yeah, the challenge failure "connection refused" is why the order is not ready for finalize. It is a little strange in that a test from Let's Debug ( https://letsdebug.net ) works. And, none of the countries failing in check-host test host any Let's Encrypt data centers. Is there some other firewal…

Would that cause issues with the renewal process? I would need to check with our security team about our blocking rules. If the address is from the US I believe there should be no issue.

Let's Encrypt checks from multiple places around the world, to validate that the requester actually controls the name throughout the world. [image] Multi-Perspective Validation & Geoblocking FAQ Issuance Tech (…

I did not see any traffic in the access or error logs for nginx to the /.well-known/acme-challenge besides some malicious spam, and these logs go back over a year. Which is well before the last renew. I can verify that there are no fw rules on the iptables blocking any traffic, I'll check with my s…

[image] Sysa-Cotton: I did not see any traffic in the access or error logs for nginx to the /.well-known/acme-challenge besides some malicious spam, and these logs go back over a year. Which is well before the last renew. Then I would say that nginx isn't handling the Let's Encrypt challenges…

So after talking with Security, it seems we're Geo-Location blocking Russia, Iran, N. Korea, & China as this is where we receive the most malicious traffic/attacks from. Is letsencrypt currently validating through one of these Geo-Locations?

Failing to renew certificates on step 6

Help

Sysa-Cotton October 14, 2025, 3:20pm 13

I believe it's because of multiple log locations on the machine, still investigating as this vesta control panel is unknown to me, and was deployed by a former employee

Topic		Replies	Views
Certificate Renewal Failed Help	22	1860	September 23, 2021
Challenges failed for renewal Help	26	3525	June 30, 2022
Letsencrypt fails to get the response (solved, it was nginx not restarting properly) Help	36	1281	October 21, 2022
Renewal fails when 200 is returned on 2 letsencrypt requests Help	2	1611	April 9, 2020
Can not renew let's encrypt cert Help	13	1407	May 19, 2019

Failing to renew certificates on step 6

Related topics