My domain is: https://generalgrains.com/ I ran this command: v-add-letsencrypt-domain admin generalgrains.com It produced this output: Error: Let's Encrypt finalize bad status 403 --- Sending CSR to finalize order / STEP 6 --- [Mon Oct 13 09:10:43 MDT 2025] : answer=HTTP/2 403 server: nginx da…

[image] Sysa-Cotton: My web server is (include version): nginx version: nginx/1.18.0 & Server version: Apache/2.4.25 (Debian) Would you explain how these two web servers are used? I see nginx responding to HTTP (port 80) requests. Is that what I should see? [image] Sysa-Cotton: it seem…

Yes nginx is what should be used. Sure, here's the full output from the logs [Mon Oct 13 09:10:37 MDT 2025] : v-add-letsencrypt-domain generalgrains.com [Mon Oct 13 09:10:37 MDT 2025] : v-add-letsencrypt-user admin [Mon Oct 13 09:10:37 MDT 2025] : result: 0 [Mon Oct 13 09:10:37 MDT 2025] : ---…

Well, that program's log doesn't make it easy, but the challenge link here gives a reason [image] Sysa-Cotton: { "type": "http-01", "url": " https://acme-v02.api.letsencrypt.org/acme/chall/1450010146/597228055291/tiSPwA ", "status": "pending", "token": "2OygqlRMI_pQbmP0cu73me9H05dKIP7U2CFHNQt…

Yeah, the challenge failure "connection refused" is why the order is not ready for finalize. It is a little strange in that a test from Let's Debug ( https://letsdebug.net ) works. And, none of the countries failing in check-host test host any Let's Encrypt data centers. Is there some other firewal…

Would that cause issues with the renewal process? I would need to check with our security team about our blocking rules. If the address is from the US I believe there should be no issue.

I did not see any traffic in the access or error logs for nginx to the /.well-known/acme-challenge besides some malicious spam, and these logs go back over a year. Which is well before the last renew. I can verify that there are no fw rules on the iptables blocking any traffic, I'll check with my s…

[image] Sysa-Cotton: I did not see any traffic in the access or error logs for nginx to the /.well-known/acme-challenge besides some malicious spam, and these logs go back over a year. Which is well before the last renew. Then I would say that nginx isn't handling the Let's Encrypt challenges…

So after talking with Security, it seems we're Geo-Location blocking Russia, Iran, N. Korea, & China as this is where we receive the most malicious traffic/attacks from. Is letsencrypt currently validating through one of these Geo-Locations?

Failing to renew certificates on step 6

Help

petercooperjr October 13, 2025, 5:17pm 7

Let's Encrypt checks from multiple places around the world, to validate that the requester actually controls the name throughout the world.

Topic		Replies	Views
Certificate Renewal Failed Help	23	1761	October 23, 2021
Challenges failed for renewal Help	27	3423	July 30, 2022
Letsencrypt fails to get the response (solved, it was nginx not restarting properly) Help	37	1206	November 20, 2022
Renewal fails when 200 is returned on 2 letsencrypt requests Help	3	1590	May 9, 2020
Can not renew let's encrypt cert Help	14	1362	June 18, 2019

Failing to renew certificates on step 6

Related topics