I'm getting a persistent "Timeout during connect" error during secondary
validation when trying to issue a certificate via win-acme (WACS 2.1.18.1119)
using http-01 validation, both with the SelfHosting and FileSystem plugins.
DNS resolves consistently and correctly to 34.72.42.51 from ~45 global
locations (check-host.net) and locally.
No AAAA record exists.
Port 80 is reachable from nearly every global location tested (check-host.net
TCP + HTTP checks), only failing from Iran (national filtering, expected)
and a couple of isolated node blips.
A direct HTTP GET to the exact challenge path
(Takwene Lab) returns 200 OK
from ~45 global locations while the challenge file is live.
win-acme's own "preliminary validation" (local check) passes every time ā
only the remote/secondary ACME validation step fails.
This has failed identically on multiple separate attempts, both with
SelfHosting and FileSystem validation plugins in win-acme.
The domain is hosted on Google Cloud (Compute Engine / IIS on Windows),
DNS is on Google Cloud DNS.
Given every external diagnostic I can run shows the domain and challenge
path are reachable, I'd appreciate help understanding what secondary
validation might be seeing that these external checks aren't catching.
Happy to provide the win-acme log file or run further diagnostics as needed.
There are currently 4 secondary validation centers around the world. You already did some of the usual checks.
Is there some kind of firewall that might block multiple simultaneous HTTP queries from different global points?
Are you able to check your IIS access log and show any of the challenge requests that arrive. You will see at least one 200 status from the primary center. You may see other 200 (or other) responses from your server for the 4 other secondary. Knowing these would be helpful. We know at least one secondary is missing because of the "timeout" error but some of the others may have come through.