# Help Understanding Firewall Problem/Domain Check
**URL:** https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681
**Category:** Help
**Created:** [August 21, 2020, 5:07pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681 "2020-08-21T17:07:57Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@arkhos](https://community.letsencrypt.org/u/arkhos)
#### Post date: [August 21, 2020, 5:07pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681/1 "2020-08-21T17:07:57Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: [members.wellbridge.com](http://members.wellbridge.com)
I ran this command: win-acme.v1.9.11.2\letsencrypt.exe
It produced this output:
[EROR] Authorization result: invalid
[EROR] ACME server reported:
[EROR] [type] urn:acme:error:connection
[EROR] [detail] Fetching [http://members.wellbridge.com/.well-known/acme-challen](http://members.wellbridge.com/.well-known/acme-challen)
ge/hKticvR\_00NNFgIzqeV8upXeM46hOqcMU215a4w3e7k: Timeout during connect (likely f
irewall problem)
[EROR] [status] 400
[EROR] Create certificate failed
My web server is (include version): Windows 2008 R2 SP1
The operating system my web server runs on is (include version): Windows 2008 R2 SP1
My hosting provider, if applicable, is: AT&T
I can login to a root shell on my machine (yes or no, or I don’t know): cmd?
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot):
Please note, most of the IT team has been furloughed so this is not my normal area.
- We have one Windows 2008 R2 server that is hosting 3 websites.
- It has two IP addresses
- All 3 website Let’s Encrypt certificates expired last night on 8/20 - the auto schedule never worked
- I ran the letsencrypt executable and selected to: Renew _all_
- The website that has an IIS Binding to IP #1 was successful
- The websites that are assigned to IP #2 failed with the above Timeout/Firewall problem
I have tried changing the ip from IP#2 to IP#1, changed the DNS, but it still fails
I went and ran this domain check (based on other threads I found here) but I don’t know what it is telling me? Is this really a firewall problem with AT&T?
> **[Make your website better](https://check-your-website.server-daten.de/?q=members.wellbridge.com)**
>
> Check your redirects http - https, your preferred version (www vs. non-www), certificates, connections and your html-content. A ranking system shows, if your domain is A+ (no errors + preload), has errors (https - http) or loops.
> **[Make your website better](https://check-your-website.server-daten.de/?i=1c5039e5-92ca-4ff1-9cb0-d12311ce3b72)**
>
> Check your redirects http - https, your preferred version (www vs. non-www), certificates, connections and your html-content. A ranking system shows, if your domain is A+ (no errors + preload), has errors (https - http) or loops.
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [August 21, 2020, 5:11pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681/2 "2020-08-21T17:11:59Z")
Hi @arkhos
that's
> [@arkhos](#):
>
> Is this really a firewall problem with AT&T?
not a firewall problem, first, that's a wrong configuration:
| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://members.wellbridge.com/](http://members.wellbridge.com/) | | | | |
| 12.109.238.83 | -14 | | 10.033 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [https://members.wellbridge.com/](https://members.wellbridge.com/) | | | | |
| 12.109.238.83 | -4 | | 0.590 | W |
| SendFailure - The underlying connection was closed: An unexpected error occurred on a send. | | | | |
| | | | | |
| • [http://members.wellbridge.com:443/](http://members.wellbridge.com:443/) | | | | |
| 12.109.238.83 | -3 | | 0.586 | A |
| ReceiveFailure - The underlying connection was closed: An unexpected error occurred on a receive. | | | | |
| Visible Content: | | | | |
| | | | | |
| • [http://members.wellbridge.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://members.wellbridge.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 12.109.238.83 | -14 | | 10.033 | T |
| Timeout - The operation has timed out | | | | |
Port 80 doesn't answer.
But port 443 - upps, port 443 is a http port, not a https port.
Looks like a wrong port porwarding port 443 extern -\> port 80 intern.
Port 80 extern -\> port 80 intern is required, then the http check shouldn't have a timeout, instead a correct answer.
PS:
> But port 443 - upps, port 443 is a http port, not a https port.
That's a little bit wrong. There is a -3 instead of a correct http answer.
But there is an answer.
So it's a little bit unclear what answers.
PPS: May be a firewall on port 443, that allows a first connection, then the connection is terminated. But a working port 80 is required if you want to create a certificate via http validation.
---
### Author:  [@arkhos](https://community.letsencrypt.org/u/arkhos)
#### Post date: [August 21, 2020, 5:20pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681/3 "2020-08-21T17:20:06Z")
Thank you for the quick reply @JuergenAuer
So the port 80 on my windows server is not answering for IP#2, is that correct?
How do I configure that? And is there a way to check it?
---
### Author:  [@arkhos](https://community.letsencrypt.org/u/arkhos)
#### Post date: [August 21, 2020, 5:39pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681/4 "2020-08-21T17:39:05Z")
I just went into the Windows Firewall and set an Inbound rule for port 80, did another domain check and it is still failing?
Instructions I followed, but entered port 80: [https://dbatricksworld.com/how-to-open-firewall-ports-on-windows-server-2008-r2/](https://dbatricksworld.com/how-to-open-firewall-ports-on-windows-server-2008-r2/)
Domain report:
> **[Make your website better](https://check-your-website.server-daten.de/?i=dd16f68a-c04d-4f5a-b369-272e4c4221ae)**
>
> Check your redirects http - https, your preferred version (www vs. non-www), certificates, connections and your html-content. A ranking system shows, if your domain is A+ (no errors + preload), has errors (https - http) or loops.
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [August 21, 2020, 6:13pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681/5 "2020-08-21T18:13:57Z")
> [@arkhos](#):
>
> and it is still failing?
There is something that blocks or interrupts the connection.
You have to find and remove it.
Or switch to dns validation if port 80 doesn't work.
> **[Challenge Types - Let's Encrypt](https://letsencrypt.org/docs/challenge-types/)**
>
> When you get a certificate from Let’s Encrypt, our servers validate that you control the domain names in that certificate using “challenges,” as defined by the ACME standard. Most of the time, this validation is handled automatically by your ACME...
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [August 21, 2020, 7:05pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681/6 "2020-08-21T19:05:30Z")
Ah - now there is a new check.
Now port 80 answers, that looks good.
---
### Author:  [@arkhos](https://community.letsencrypt.org/u/arkhos)
#### Post date: [August 21, 2020, 7:11pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681/7 "2020-08-21T19:11:12Z")
I had someone change the port forwarding on the host network side. Port 80 was locked down.
I reran the letsencrypt.exe and got some success and errors. I went into IIS and added a Port 443 https and in the certificate drop-down was one for 8/21 so I selected it?
Not sure if these errors mean anything? If I need to clean something up or redo it?
[INFO] Authorization result: valid
[INFO] Requesting certificate [members.wellbridge.com](http://members.wellbridge.com) 2020/8/21 13:04:29 PM
[INFO] Saving certificate to C:\ProgramData\letsencrypt-win-simple\httpsacme-v0
[1.api.letsencrypt.org](http://1.api.letsencrypt.org)
[INFO] Installing certificate in the certificate store
[INFO] Adding certificate [members.wellbridge.com](http://members.wellbridge.com) 2020/8/21 13:04:29 PM to store
My
[INFO] Installing with IIS…
[INFO] Adding new https binding [members.wellbridge.com:443](http://members.wellbridge.com:443)
[INFO] Committing 1 https binding changes to IIS
[EROR] Error installing
System.IO.FileLoadException: Filename: \?\C:\Windows\system32\inetsrv\config\ap
plicationHost.config
Error: Cannot commit configuration changes because the file has changed on disk
at Microsoft.Web.Administration.Interop.IAppHostWritableAdminManager.CommitCh
anges()
at Microsoft.Web.Administration.ConfigurationManager.CommitChanges()
at Microsoft.Web.Administration.ServerManager.CommitChanges()
at PKISharp.WACS.Clients.IISClient.Commit()
at PKISharp.WACS.Clients.IISClient.AddOrUpdateBindings(Target target, SSLFlag
s flags, CertificateInfo newCertificate, CertificateInfo oldCertificate)
[EROR] Unable to install certificate
System.IO.FileLoadException: Filename: \?\C:\Windows\system32\inetsrv\config\ap
plicationHost.config
Error: Cannot commit configuration changes because the file has changed on disk
at Microsoft.Web.Administration.Interop.IAppHostWritableAdminManager.CommitCh
anges()
at Microsoft.Web.Administration.ConfigurationManager.CommitChanges()
at Microsoft.Web.Administration.ServerManager.CommitChanges()
at PKISharp.WACS.Clients.IISClient.Commit()
at PKISharp.WACS.Clients.IISClient.AddOrUpdateBindings(Target target, SSLFlag
s flags, CertificateInfo newCertificate, CertificateInfo oldCertificate)
at PKISharp.WACS.Plugins.InstallationPlugins.IISWebInstaller.PKISharp.WACS.Pl
ugins.Interfaces.IInstallationPlugin.Install(CertificateInfo newCertificate, Cer
tificateInfo oldCertificate)
at PKISharp.WACS.Program.OnRenewSuccess(ILifetimeScope renewalScope, Schedule
dRenewal renewal)
[INFO] Uninstalling certificate from the certificate store
[INFO] Removing certificate [members.wellbridge.com](http://members.wellbridge.com) 2020/5/22 3:39:11 PM from st
ore My
[EROR] Create certificate failed
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [August 21, 2020, 7:13pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681/8 "2020-08-21T19:13:26Z")
> [@arkhos](#):
>
> [EROR] Create certificate failed
I don't understand that error.
But there is a new check, now with a new Letsencrypt certificate:
```nohighlight
CN=members.wellbridge.com
21.08.2020
19.11.2020
expires in 90 days members.wellbridge.com - 1 entry
```
The Grade O - you can't fix, that' Windows 2008, that's too old.
But now you have a working certificate 👍
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [September 20, 2020, 7:13pm UTC](https://community.letsencrypt.org/t/help-understanding-firewall-problem-domain-check/131681/9 "2020-09-20T19:13:27Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.