HTTP-01 secondary validation timeout for labs.takwene.com despite reachable from all external checks

Domain: labs.takwene.com

I'm getting a persistent "Timeout during connect" error during secondary
validation when trying to issue a certificate via win-acme (WACS 2.1.18.1119)
using http-01 validation, both with the SelfHosting and FileSystem plugins.

Error:
{
"type": "urn:ietf:params:acme:error:connection",
"detail": "During secondary validation: 34.72.42.51: Fetching
Takwene Lab: Timeout during
connect (likely firewall problem)",
"status": 400
}

What I've already verified:

  • DNS resolves consistently and correctly to 34.72.42.51 from ~45 global
    locations (check-host.net) and locally.
  • No AAAA record exists.
  • Port 80 is reachable from nearly every global location tested (check-host.net
    TCP + HTTP checks), only failing from Iran (national filtering, expected)
    and a couple of isolated node blips.
  • A direct HTTP GET to the exact challenge path
    (Takwene Lab) returns 200 OK
    from ~45 global locations while the challenge file is live.
  • win-acme's own "preliminary validation" (local check) passes every time —
    only the remote/secondary ACME validation step fails.
  • letsdebug.net reports "All OK" for labs.takwene.com using http-01.
  • This has failed identically on multiple separate attempts, both with
    SelfHosting and FileSystem validation plugins in win-acme.

The domain is hosted on Google Cloud (Compute Engine / IIS on Windows),
DNS is on Google Cloud DNS.

Given every external diagnostic I can run shows the domain and challenge
path are reachable, I'd appreciate help understanding what secondary
validation might be seeing that these external checks aren't catching.

Happy to provide the win-acme log file or run further diagnostics as needed.

Thanks for the great report @MohamedAbdoTakwene and welcome

There are currently 4 secondary validation centers around the world. You already did some of the usual checks.

Is there some kind of firewall that might block multiple simultaneous HTTP queries from different global points?

Are you able to check your IIS access log and show any of the challenge requests that arrive. You will see at least one 200 status from the primary center. You may see other 200 (or other) responses from your server for the 4 other secondary. Knowing these would be helpful. We know at least one secondary is missing because of the "timeout" error but some of the others may have come through.

Unrelated to your current problem... but worth the mention.

Your IP appears to have been infected.
Below are failed AUTH SMTP requests from that IP with multiple EHLO/HELO strings:

34.72.42.51 - [210.112.227.218] [03/Aug/2026:06:36:31 -0500] "EHLO -? [210.112.227.218] SMTP" 250 220
34.72.42.51 - [210.112.227.218] [03/Aug/2026:06:36:32 -0500] "STARTTLS - SMTP" 220 0
34.72.42.51 - [210.112.227.218] [03/Aug/2026:06:36:32 -0500] "STARTTLS - SMTP" 220 29
34.72.42.51 - [210.112.227.218] [03/Aug/2026:06:36:34 -0500] "EHLO -? [210.112.227.218] SMTP" 250 258
34.72.42.51 - [210.112.227.218] [03/Aug/2026:06:36:36 -0500] "AUTH -?[210.112.227.218] SMTP" 334 47
34.72.42.51 - [210.112.227.218] [03/Aug/2026:06:36:37 -0500] "AUTH -?[210.112.227.218] SMTP" 535 94
34.72.42.51 - [210.112.227.218] [03/Aug/2026:06:36:38 -0500] "QUIT -?[210.112.227.218] SMTP" 240 162
34.72.42.51 - 94-29-38-71.dynamic.spd-mgts.ru [03/Aug/2026:07:44:14 -0500] "EHLO -? 94-29-38-71.dynamic.spd-mgts.ru SMTP" 250 220
34.72.42.51 - 94-29-38-71.dynamic.spd-mgts.ru [03/Aug/2026:07:44:14 -0500] "STARTTLS - SMTP" 220 0
34.72.42.51 - 94-29-38-71.dynamic.spd-mgts.ru [03/Aug/2026:07:44:14 -0500] "STARTTLS - SMTP" 220 29
34.72.42.51 - 94-29-38-71.dynamic.spd-mgts.ru [03/Aug/2026:07:44:17 -0500] "EHLO -? 94-29-38-71.dynamic.spd-mgts.ru SMTP" 250 258
34.72.42.51 - 94-29-38-71.dynamic.spd-mgts.ru [03/Aug/2026:07:44:19 -0500] "AUTH -?94-29-38-71.dynamic.spd-mgts.ru SMTP" 334 47
34.72.42.51 - 94-29-38-71.dynamic.spd-mgts.ru [03/Aug/2026:07:44:20 -0500] "AUTH -?94-29-38-71.dynamic.spd-mgts.ru SMTP" 535 94
34.72.42.51 - 94-29-38-71.dynamic.spd-mgts.ru [03/Aug/2026:07:44:21 -0500] "QUIT -?94-29-38-71.dynamic.spd-mgts.ru SMTP" 240 162
34.72.42.51 - [179.255.244.206] [03/Aug/2026:09:00:47 -0500] "EHLO -? [179.255.244.206] SMTP" 250 220
34.72.42.51 - [179.255.244.206] [03/Aug/2026:09:00:48 -0500] "STARTTLS - SMTP" 220 0
34.72.42.51 - [179.255.244.206] [03/Aug/2026:09:00:48 -0500] "STARTTLS - SMTP" 220 29
34.72.42.51 - [179.255.244.206] [03/Aug/2026:09:00:50 -0500] "EHLO -? [179.255.244.206] SMTP" 250 258
34.72.42.51 - [179.255.244.206] [03/Aug/2026:09:00:52 -0500] "AUTH -?[179.255.244.206] SMTP" 334 47
34.72.42.51 - [179.255.244.206] [03/Aug/2026:09:00:53 -0500] "AUTH -?[179.255.244.206] SMTP" 535 94
34.72.42.51 - [179.255.244.206] [03/Aug/2026:09:00:54 -0500] "QUIT -?[179.255.244.206] SMTP" 240 162
34.72.42.51 - [61.178.82.215] [03/Aug/2026:15:33:29 -0500] "EHLO -? [61.178.82.215] SMTP" 250 220
34.72.42.51 - [61.178.82.215] [03/Aug/2026:15:33:29 -0500] "STARTTLS - SMTP" 220 0
34.72.42.51 - [61.178.82.215] [03/Aug/2026:15:33:29 -0500] "STARTTLS - SMTP" 220 29
34.72.42.51 - [61.178.82.215] [03/Aug/2026:15:33:32 -0500] "EHLO -? [61.178.82.215] SMTP" 250 258
34.72.42.51 - [61.178.82.215] [03/Aug/2026:15:33:33 -0500] "AUTH -?[61.178.82.215] SMTP" 334 47
34.72.42.51 - [61.178.82.215] [03/Aug/2026:15:33:34 -0500] "AUTH -?[61.178.82.215] SMTP" 535 94
34.72.42.51 - [61.178.82.215] [03/Aug/2026:15:33:35 -0500] "QUIT -?[61.178.82.215] SMTP" 240 162

Also worth mentioning: This was not a onetime thing.
That IP has been seen doing similar failed AUTH SMTP requests as far back as "2023-03-15".