# Impossible to renew certs if DNS used **URL:** \ **Category:** Help\ **Created:** [October 29, 2019, 8:02am UTC](https://community.letsencrypt.org/t/impossible-to-renew-certs-if-dns-used/105050 "2019-10-29T08:02:16Z")\ **Posts on this page:** 4\ **Page:** 2
**Author:** ![BonBonSlick](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@BonBonSlick](https://community.letsencrypt.org/u/BonBonSlick)\ **Post date:** [October 29, 2019, 10:02am UTC](https://community.letsencrypt.org/t/impossible-to-renew-certs-if-dns-used/105050/21 "2019-10-29T10:02:24Z")
Anything above does not help to resolve this issue and it took too much time. As expected, I had to disable firewalls and SSL everywhere, reissue certificates, reconfigure firewalls, SSL back every where. Now it works. But issue still requires answer, because it will occur in next 3 month when these certs will expire. How to make it auto renew? DNS as you can see CloudFlare. Maybe edit cron to run before certs expire? As it tries to challenge site with HTTP when there is only HTTPS. Or just install plugin? I do not want disable SSL for specific links eg for acme challenge. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 29, 2019, 10:15am UTC](https://community.letsencrypt.org/t/impossible-to-renew-certs-if-dns-used/105050/22 "2019-10-29T10:15:17Z")
DNS is a valid option for renewal authentication. Also ALPN should work through Cloud Flare. Can you run tests on staging environment? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [October 29, 2019, 7:52pm UTC](https://community.letsencrypt.org/t/impossible-to-renew-certs-if-dns-used/105050/23 "2019-10-29T19:52:44Z")
> [@BonBonSlick](#): > > As expected, I had to disable firewalls and SSL everywhere, reissue certificates, reconfigure firewalls, SSL back every where. Now it works It doesn't, though. Cloudflare _still_ reports a 520 Origin Error for the insecure version of your website, which is where visitors are going to land by default, unless they manually type in `https://`. They won't get autoredirected to the secure version, as your browser probably does due to your HSTS setup. This is also the same cause underlying your renewal failure, since Let's Encrypt also connects insecurely to do validation. I don't think you have re-issued your certificates either - nothing has been logged in CT logs for your real domain. > [@rg305](#): > > Also ALPN should work through Cloud Flare. Maybe with Cloudflare Argo Tunnel? But normal Cloudflare won't proxy ALPNs other than HTTP/2. > [@BonBonSlick](#): > > As it tries to challenge site with HTTP when there is only HTTPS. You need port 80: [Best Practice - Keep Port 80 Open - Let's Encrypt](https://letsencrypt.org/docs/allow-port-80/) . Especially if you want your `preload` HSTS directive to work - they require a redirect to be established to be included on the list. If you've intentionally not responding on port 80, then have Cloudflare establish a page rule to do an automatic redirect to HTTPS. Easier still, make a simple port 80 virtualhost which performs the required redirect to HTTPS. You will still need to use the webroot approach - none of this will fix the Certbot/nginx bug preventing `--nginx` from succeeding. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 28, 2019, 7:52pm UTC](https://community.letsencrypt.org/t/impossible-to-renew-certs-if-dns-used/105050/24 "2019-11-28T19:52:44Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed. [Previous page](https://community.letsencrypt.org/t/impossible-to-renew-certs-if-dns-used/105050.md?page=1)