# Help regarding timeout issues

**URL:** <https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817>\
**Category:** Help\
**Created:** [July 7, 2022, 9:56am UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817 "2022-07-07T09:56:50Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sarangcttc](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sarangcttc](https://community.letsencrypt.org/u/Sarangcttc)\
**Post date:** [July 7, 2022, 9:56am UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/1 "2022-07-07T09:56:50Z")

</div>

Hi Dears,  
I am sticking with one issue for almost two weeks, I am trying to have cert in Kubernetes and i followed exactly like the example but always get issues as Waiting for HTTP-01 challenge propagation: failed to perform self-check GET request. Can somebody help me, please?

---

<div class="post-metadata">

**Author:** ![Sarangcttc](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sarangcttc](https://community.letsencrypt.org/u/Sarangcttc)\
**Post date:** [July 7, 2022, 10:02am UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/2 "2022-07-07T10:02:45Z")

</div>

I would really appreciate any help

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [July 7, 2022, 11:49am UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/3 "2022-07-07T11:49:43Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [July 7, 2022, 12:27pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/4 "2022-07-07T12:27:39Z")

</div>

> [@Sarangcttc](#):
>
> I would really appreciate any help

As Osiris already pointed out, we would need more info. Especially more of the error message. That looks like it was from cert-manager and should have displayed more info.

Also look at this cert-manager troubleshooting page. Search page for 'self-check'

> **[Troubleshooting Problems with ACME / Let's Encrypt Certificates](https://cert-manager.io/docs/troubleshooting/acme/)**
>
> Learn how to diagnose problems if cert-manager fails to renew ACME / Let's Encrypt Certificates.

If that is not enough, please fill out the form and provide more details of error. Thanks

---

<div class="post-metadata">

**Author:** ![Sarangcttc](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sarangcttc](https://community.letsencrypt.org/u/Sarangcttc)\
**Post date:** [July 7, 2022, 12:55pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/5 "2022-07-07T12:55:00Z")

</div>

Hi Thanks for the answer:  
Let me explain to you the setup: we have bare-metal Kubernetes (Kubespray) where we have metallb loadbalancer assign ip address and NGINX ingress controller with a grabbed IP address from metallb. As IP address is not public, we mapped to an public IP address therefore our x.x.x.x nginx controller ip mapped to y.y.y.y with opened 80 and 443 ports.  
Then i created cert-manager-v1.8.2 already checked all pods up and running. Then create two staging and production as following:  
apiVersion: [cert-manager.io/v1](http://cert-manager.io/v1)  
kind: ClusterIssuer  
metadata:  
name: letsencrypt-staging  
spec:  
acme:  
# You must replace this email address with your own.  
# Let's Encrypt will use this to contact you about expiring  
# certificates, and issues related to your account.  
email: [sarang.kahva@gmail.com](mailto:sarang.kahva@gmail.com)  
server: [https://acme-staging-v02.api.letsencrypt.org/directory](https://acme-staging-v02.api.letsencrypt.org/directory)  
privateKeySecretRef:  
# Secret resource that will be used to store the account's private key.  
name: letsencrypt-staging-private-key  
# Add a single challenge solver, HTTP01 using nginx  
solvers:  
- http01:  
ingress:  
class: nginx

apiVersion: [cert-manager.io/v1](http://cert-manager.io/v1)  
kind: ClusterIssuer  
metadata:  
name: letsencrypt-production  
spec:  
acme:  
# You must replace this email address with your own.  
# Let's Encrypt will use this to contact you about expiring  
# certificates, and issues related to your account.  
email: [sarang.kahva@gmail.com](mailto:sarang.kahva@gmail.com)  
server: [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)  
privateKeySecretRef:  
# Secret resource that will be used to store the account's private key.  
name: mediahub-issuer-account-key  
# Add a single challenge solver, HTTP01 using nginx  
solvers:  
- http01:  
ingress:  
class: nginx

both checked and status are TRUE then i create and deployment in namespace test then create an ingress as following:  
apiVersion: [networking.k8s.io/v1](http://networking.k8s.io/v1)  
kind: Ingress  
metadata:  
name: vsp-ingress-nginx  
namespace: test  
annotations:

# [kubernetes.io/ingress.class:](http://kubernetes.io/ingress.class:) "nginx"

```
ingress.kubernetes.io/ssl-redirect: "false"
nginx.org/redirect-to-https: "false"
cert-manager.k8s.io/cluster-issuer: letsencrypt-staging
acme.cert-manager.io/http01-edit-in-place: "true"

```

spec:  
ingressClassName: nginx  
tls:

- hosts:
  - cttc.netapps-5gmediahub.eu  
secretName: lets-encrypt-staging-tls  
rules:

- host: cttc.netapps-5gmediahub.eu  
http:  
paths:
  - path: /  
pathType: Prefix  
backend:  
service:  
name: vsp  
port:  
number: 8080  
It will issue temporarily cert but as following you see the challenge remain as pending even for staging with error: Waiting for HTTP-01 challenge propagation: failed to perform self check GET request '[http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI\_LeEVB75dOTAqxXEF9dM9Y](http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI_LeEVB75dOTAqxXEF9dM9Y)': Get "[http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI\_LeEVB75dOTAqxXEF9dM9Y](http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI_LeEVB75dOTAqxXEF9dM9Y)": dial tcp 84.88.63.181:80: i/o timeout (Client.Timeout exceeded while awaiting headers)  
Please i appreciate any guidance as i need to make it run this asap Thanks alot in advance

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [July 7, 2022, 2:41pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/7 "2022-07-07T14:41:07Z")

</div>

> [@Sarangcttc](#):
>
> port:  
> number: 8080  
> It will issue temporarily cert but as following you see the challenge remain as pending even for staging with error: Waiting for HTTP-01 challenge propagation: failed to perform self check GET request '[http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI\_LeEVB75dOTAqxXEF9dM9Y](http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI_LeEVB75dOTAqxXEF9dM9Y)': Get "[http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI\_LeEVB75dOTAqxXEF9dM9Y](http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI_LeEVB75dOTAqxXEF9dM9Y)": dial tcp 84.88.63.181:80: i/o timeout (Client.Timeout exceeded while awaiting headers)

This looks like a comms problem on your end. You are better off asking about this on a Kubernetes or cert-manager forum. People there are more experienced at its configuration than we are. We can't be experts in every possible program that requests certificates.

The only thing I see your config uses port 8080 but I don't see a port 8080 open for your domain. So, maybe it can't connect outbound on that port? I am just guessing.

I can connect to your domain just fine on both http and https so inbound connections from the public internet are fine. It looks like just this self-check is failing. Example of working request to port 443:

```nohighlight
openssl s_client -connect cttc.netapps-5gmediahub.eu:443 

Certificate chain
 0 s:/serialNumber=1234567890
   i:/CN=cert-manager.local

subject= /serialNumber=1234567890
issuer= /CN=cert-manager.local
notBefore=Jul 7 12:53:10 2022 GMT
notAfter=Oct 5 12:53:10 2022 GMT
serial=7F45E334AEACAF040D2C2296CF0E87AE
SHA1 Fingerprint=DC:5F:0D:D3:B8:65:7C:72:7B:B2:86:B0:D1:F5:34:E9:CD:5D:48:13

SANs:
cttc.netapps-5gmediahub.eu

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 7, 2022, 6:14pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/8 "2022-07-07T18:14:45Z")

</div>

To add to the "information", I see this cert on port 443:

```nohighlight
subject=/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate
issuer=/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate

```

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [July 7, 2022, 6:29pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/9 "2022-07-07T18:29:08Z")

</div>

I see that fake cert now too. I guess that's some sort of progress 🙂

---

<div class="post-metadata">

**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\
**Post date:** [July 7, 2022, 7:13pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/10 "2022-07-07T19:13:11Z")

</div>

> [@Sarangcttc](#):
>
> Waiting for HTTP-01 challenge propagation: failed to perform self-check GET request.

Most clients implement a "Self Check", in which they try to query the HTTP or DNS server to ensure the expected challenge is live. If it passes, they'll trigger the ACME Server endpoint - if it fails, they won't and will abort the validation/order.

Your self check failed. This could be because:

- Container routing is broken or misconfigured (inbound ports to the service/container are not working)
- The expected service/container is not running
- There is a bug in the service/container
- There is an issue on the challenge setup
- other issues

The line "Client.Timeout exceeded while awaiting headers" suggests you have not correctly configured your port80 service or routing.

It is impossible to debug these situations without detailed logs. As others said, the Kubernetes or Cert-Manager are your best option for support.

---

<div class="post-metadata">

**Author:** ![Sarangcttc](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sarangcttc](https://community.letsencrypt.org/u/Sarangcttc)\
**Post date:** [July 11, 2022, 3:40pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/11 "2022-07-11T15:40:32Z")

</div>

Hi Dears,  
Hi Dears,  
I really appreciate it if somebody gives me a solution to this. I am sticking with one issue for almost two weeks, I am trying to have cert in Kubernetes and i followed exactly like the example but always get issues as Waiting for HTTP-01 challenge propagation: failed to perform self-check GET request. Can somebody help me, please?  
here is some info:  
Let me explain to you the setup: we have bare-metal Kubernetes (Kubespray) where we have metallb loadbalancer assign ip address and NGINX ingress controller with a grabbed IP address from metallb. As IP address is not public, we mapped to an public IP address therefore our x.x.x.x nginx controller ip mapped to y.y.y.y with opened 80 and 443 ports.  
Then i created cert-manager-v1.8.2 already checked all pods up and running. Then create two staging and production as following:  
apiVersion: [cert-manager.io/v1](http://cert-manager.io/v1)  
kind: ClusterIssuer  
metadata:  
name: letsencrypt-staging  
spec:  
acme:  
email: [sarang.kahva@gmail.com](mailto:sarang.kahva@gmail.com)  
server: [https://acme-staging-v02.api.letsencrypt.org/directory](https://acme-staging-v02.api.letsencrypt.org/directory)  
privateKeySecretRef:  
name: letsencrypt-staging-private-key  
solvers:

- http01:  
ingress:  
class: nginxapiVersion: [cert-manager.io/v1](http://cert-manager.io/v1)  
kind: ClusterIssuer  
metadata:  
name: letsencrypt-production  
spec:  
acme:  
email: [sarang.kahva@gmail.com](mailto:sarang.kahva@gmail.com)  
server: [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)  
privateKeySecretRef:  
name: mediahub-issuer-account-key  
solvers:
- http01:  
ingress:  
class: nginxboth checked and status are TRUE then i create and deployment in namespace test then create an ingress as following:  
apiVersion: [networking.k8s.io/v1](http://networking.k8s.io/v1)  
kind: Ingress  
metadata:  
name: vsp-ingress-nginx  
namespace: test  
annotations:[kubernetes.io/ingress.class](http://kubernetes.io/ingress.class): "nginx"  
[ingress.kubernetes.io/ssl-redirect](http://ingress.kubernetes.io/ssl-redirect): "false"  
[nginx.org/redirect-to-https](http://nginx.org/redirect-to-https): "false"  
[cert-manager.k8s.io/cluster-issuer](http://cert-manager.k8s.io/cluster-issuer): letsencrypt-staging  
[acme.cert-manager.io/http01-edit-in-place](http://acme.cert-manager.io/http01-edit-in-place): "true"  
spec:  
ingressClassName: nginx  
tls:hosts:  
[cttc.netapps-5gmediahub.eu](http://cttc.netapps-5gmediahub.eu/)  
secretName: lets-encrypt-staging-tls  
rules:  
host: [cttc.netapps-5gmediahub.eu](http://cttc.netapps-5gmediahub.eu/)  
http:  
paths:  
path: /  
pathType: Prefix  
backend:  
service:  
name: vsp  
port:  
number: 8080  
It will issue temporarily cert but as following you see the challenge remain as pending even for staging with error: Waiting for HTTP-01 challenge propagation: failed to perform self check GET request '[http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI\_LeEVB75dOTAqxXEF9dM9Y](http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI_LeEVB75dOTAqxXEF9dM9Y)': Get "[http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI\_LeEVB75dOTAqxXEF9dM9Y](http://cttc.netapps-5gmediahub.eu/.well-known/acme-challenge/GWDAfzthwry22tWA7RKiI_LeEVB75dOTAqxXEF9dM9Y)": dial tcp 84.88.63.181:80: i/o timeout (Client.Timeout exceeded while awaiting headers)  
Please i appreciate any guidance as i need to make it run this asap Thanks alot in advance

---

<div class="post-metadata">

**Author:** ![Sarangcttc](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sarangcttc](https://community.letsencrypt.org/u/Sarangcttc)\
**Post date:** [July 11, 2022, 3:41pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/12 "2022-07-11T15:41:14Z")

</div>

I already check with slack cermanager community no help comes from them

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 11, 2022, 3:50pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/13 "2022-07-11T15:50:10Z")

</div>

I don't know that I have a solution for you, but I do see some things that are _curious_ and might not _add up_:

> [@Sarangcttc](#):
>
> port:  
> number: 8080

> [@Sarangcttc](#):
>
> failed to perform **self check** GET request

> [@Sarangcttc](#):
>
> dial tcp 84.88.63.181:80

> [@Sarangcttc](#):
>
> Timeout exceeded

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [July 11, 2022, 3:57pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/14 "2022-07-11T15:57:26Z")

</div>

This is the same problem you posted about previously - isn't it?

> [@Help regarding timeout issues](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817):
>
> H…

I don't see any new info in this post.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 11, 2022, 4:02pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/15 "2022-07-11T16:02:01Z")

</div>

[merged both topics]

---

<div class="post-metadata">

**Author:** ![Sarangcttc](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sarangcttc](https://community.letsencrypt.org/u/Sarangcttc)\
**Post date:** [July 11, 2022, 4:03pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/16 "2022-07-11T16:03:37Z")

</div>

Hi Dears,  
Yes its same as i am struggling with it almost three weeks 🙂 i hope and appreciate that you can help me to figure out, if you need any logs or input let me know

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 11, 2022, 4:05pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/17 "2022-07-11T16:05:45Z")

</div>

Begin at the beginning.  
You must have a working HTTP site before you can get a cert via HTTP authentication:

```nohighlight
curl -Ii http://cttc.netapps-5gmediahub.eu/
HTTP/1.1 404 Not Found
Date: Mon, 11 Jul 2022 16:04:56 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive

```

---

<div class="post-metadata">

**Author:** ![Sarangcttc](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sarangcttc](https://community.letsencrypt.org/u/Sarangcttc)\
**Post date:** [July 11, 2022, 4:06pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/18 "2022-07-11T16:06:40Z")

</div>

i change domain now is mediahub.cttc.es  
try to curl this one:  
HTTP/1.1 308 Permanent Redirect  
Date: Mon, 11 Jul 2022 16:07:24 GMT  
Content-Type: text/html  
Content-Length: 164  
Connection: keep-alive  
Location: [https://mediahub.cttc.es](https://mediahub.cttc.es)

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 11, 2022, 4:07pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/19 "2022-07-11T16:07:52Z")

</div>

```nohighlight
curl -Ii mediahub.cttc.es
HTTP/1.1 308 Permanent Redirect
Date: Mon, 11 Jul 2022 16:07:24 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Location: https://mediahub.cttc.es

curl -Iik https://mediahub.cttc.es/
HTTP/2 405
date: Mon, 11 Jul 2022 16:07:29 GMT
content-type: application/json
content-length: 31
strict-transport-security: max-age=15724800; includeSubDomains

```

---

<div class="post-metadata">

**Author:** ![Sarangcttc](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sarangcttc](https://community.letsencrypt.org/u/Sarangcttc)\
**Post date:** [July 11, 2022, 4:09pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/20 "2022-07-11T16:09:11Z")

</div>

Does it mean it's regarding security policies from DNS provider ? Whats your suggestion for this 308 and 405 ?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [July 11, 2022, 4:10pm UTC](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817/21 "2022-07-11T16:10:30Z")

</div>

No.

I do see:

```nohighlight
WARNING: cannot verify mediahub.cttc.es's certificate, issued by ‘CN=cert-manager.local’

```

I don't know `cert-manager`, but the challenge requests are always better handled in HTTP than redirecting them to HTTPS.

[Next page](https://community.letsencrypt.org/t/help-regarding-timeout-issues/180817.md?page=2)