IIS Setup Issue and hit validation limit

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
shop.yikbee.com

I ran this command:
certbot certonly --standalone

It produced this output:
Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
Domain: shop.yikbee.com
Type: connection
Detail: 103.215.139.26: Fetching http://shop.yikbee.com/.well-known/acme-challenge/TM8J7TV_ieoyfyiiB94PTGvD77EFxpr8e2m08ESzEBU: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet.

An unexpected error occurred:
Error creating new order :: too many failed authorizations recently: see Failed Validation Limit - Let's Encrypt
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile C:\Certbot\log\letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):
IIS 10.0.17763.1

The operating system my web server runs on is (include version):
Microsoft Windows Server 2019 Standard

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 2.6.0

2

Your website is not reachable using HTTP on port 80 nor using HTTPS on port 443. An open HTTP port 80 is required for the http-01 challenge and if a HTTP to HTTPS redirect is in place, also port 443.

3 Likes
3

I've stop the site to setup the ssl.
The issue maybe cause by this but I'm now unable to test it out cause my server ip is ban.

4

If you are now getting an error about too many failed requests you just have to wait an hour. But I think you would find a Windows based Acme client easier to use with IIS server. Certbot is not well integrated for IIS but something like Certify the Web would be the easiest or win-acme

Even if you get certbot to work there will be manual steps to convert the certs for use by IIS

5 Likes
5

There's a timeout error above the failed requests rate limit :slight_smile:

An IP ban would result in a different error than the "timeout during connect (likely firewall problem)" error you got, as an IP ban would result your ACME client not connecting to the ACME service to begin with. The error you've gotten now means your ACME client successfully connected to the ACME service and could negotiate all of the usual stuff. But the validation didn't succeed and that has nothing to do with IP bans.

As the error message already says, it's probably due to a firewall issue on your side.

5 Likes
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.