# Issue creating certificate **URL:** \ **Category:** Help\ **Created:** [February 13, 2023, 7:23am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712 "2023-02-13T07:23:27Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![pnrdk](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pnrdk/32/65486_2.png) [@pnrdk](https://community.letsencrypt.org/u/pnrdk)\ **Post date:** [February 13, 2023, 7:23am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/1 "2023-02-13T07:23:27Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: **[astra.scada-international.com](http://astra.scada-international.com)** I ran this command: **Create certificate (default settings)** It produced this output : **Cached order has status invalid, discarding** \*\* [[astra.scada-international.com](http://astra.scada-international.com)] Authorizing...\*\* \*\* [[astra.scada-international.com](http://astra.scada-international.com)] Authorizing using http-01 validation (SelfHosting)\*\* \*\* [[astra.scada-international.com](http://astra.scada-international.com)] Authorization result: invalid\*\* \*\* [[astra.scada-international.com](http://astra.scada-international.com)] {\*\* \*\* "type": "urn:ietf:params:acme:error:connection",\*\* \*\* "detail": "77.233.231.67: Fetching [http://astra.scada-international.com/.well-known/acme-challenge/qQ\_TdmOOx47vwYsvHwC6UV37lWwT41USTesF00rF79o:](http://astra.scada-international.com/.well-known/acme-challenge/qQ_TdmOOx47vwYsvHwC6UV37lWwT41USTesF00rF79o:) Connection reset by peer",\*\* \*\* "status": 400\*\* **}** \*\* [[astra.scada-international.com](http://astra.scada-international.com)] Deactivating pending authorization\*\* My web server is (include version): **IIS 10** The operating system my web server runs on is (include version): **Windows server 2022 Standard (20348.1487)** My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): **Yes** I'm using a control panel to manage my site (no, or provide the name and version of the control panel): **No** The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): **win-acme.v2.1.23.1315.x64.pluggable** **I have installed a new server and is trying to create and install a new certificate, but it keeps failing. I have used the same procedures on other servers (not Widows server 2022) without any issues.** ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 13, 2023, 9:38am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/2 "2023-02-13T09:38:04Z")
I'd begin (the troubleshooting) at the beginning. Is this the IP of that server?: > [@pnrdk](#): > > 77.233.231.67 ---
**Author:** ![pnrdk](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pnrdk/32/65486_2.png) [@pnrdk](https://community.letsencrypt.org/u/pnrdk)\ **Post date:** [February 13, 2023, 9:52am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/3 "2023-02-13T09:52:33Z")
yes that is the IP ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 13, 2023, 9:58am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/4 "2023-02-13T09:58:51Z")
OK. Can you create the expected challenge path and place a test text file there? [so that we can see if it can be reached from the Internet] [please ensure not to use any file extension in the test file - (NOT `.htm*`)] Like: `http://astra.scada-international.com/.well-known/acme-challenge/Test_File-1234` ---
**Author:** ![pnrdk](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pnrdk/32/65486_2.png) [@pnrdk](https://community.letsencrypt.org/u/pnrdk)\ **Post date:** [February 13, 2023, 10:06am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/5 "2023-02-13T10:06:40Z")
I have created the file in the folder, but is getting a 404 if I don't add an extension. If adding .txt as extension it is accessible. ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/e/a/ea75cddc35922d7cbe471bd0ded865581d74aa43.png) ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [February 13, 2023, 3:32pm UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/6 "2023-02-13T15:32:59Z")
You are showing a size of 0KB for the file `Test_File-1234`, might the file need a small amount of text content to be served? I have no clue what Microsoft-IIS/10.0 will do if the file size is 0. Supplemental information ```plaintext $ curl -Ii http://astra.scada-international.com/.well-known/acme-challenge/Test_File-1234 HTTP/1.1 404 Not Found Content-Length: 1245 Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Mon, 13 Feb 2023 15:29:16 GMT ``` ```plaintext $ nmap astra.scada-international.com Starting Nmap 7.80 ( https://nmap.org ) at 2023-02-13 15:30 UTC Nmap scan report for astra.scada-international.com (77.233.231.67) Host is up (0.18s latency). Not shown: 999 filtered ports PORT STATE SERVICE 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 13.49 seconds ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [February 13, 2023, 4:26pm UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/7 "2023-02-13T16:26:02Z")
> [@pnrdk](#): > > \*\* "detail": "77.233.231.67: Fetching [http://astra.scada-international.com/.well-known/acme-challenge/qQ\_TdmOOx47vwYsvHwC6UV37lWwT41USTesF00rF79o:](http://astra.scada-international.com/.well-known/acme-challenge/qQ_TdmOOx47vwYsvHwC6UV37lWwT41USTesF00rF79o:) Connection reset by peer",\*\* > \*\* "status": 400\*\* You are almost certainly affected by a Palo Alto Networks brand firewall. When trying to access your domain with a User-Agent string like the Let's Encrypt servers it fails. But, other requests succeed. This is a well-known problem. Have your network admins change the Application Rule for "ACME protocol". Show them these two curl requests (especially the -A setting). Both should return a 404 once they fix the setting ```nohighlight curl -I astra.scada-international.com/.well-known/acme-challenge/TestMike123 HTTP/1.1 404 Not Found Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET curl -I astra.scada-international.com/.well-known/acme-challenge/TestMike123 -A "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)" curl: (56) Recv failure: Connection reset by peer ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 13, 2023, 5:38pm UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/8 "2023-02-13T17:38:23Z")
> [@pnrdk](#): > > If adding .txt as extension it is accessible. That is an indication that IIS is NOT configured to serve extensionless files. ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [February 14, 2023, 4:24am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/9 "2023-02-14T04:24:47Z")
Using win-acme in self-hosting mode means IIS will effectively be skipped and will not really be involved in the challenge request (win-acme will temporarily use it's own http listener in front of IIS), which in turn means you don't have to configure mime-type, extensionless files etc unless you can't get the self-hosting method to work. I'd be surprised if win-acme can't also auto-configure that as fallback (like we do for Certify The Web) because it wasn't originally self-hosting. It's possible you are either affected by the Palo Alto thing @MikeMcQ mentioned or you have some other blocking software (malware protection, firewall etc), or win-acme simply got stuck somehow and a reboot might fix it. Connection reset is _very_ different to a 404 etc and it seems like you are seeing both depending on the timing. I vote reboot. ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [February 14, 2023, 4:26am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/10 "2023-02-14T04:26:20Z")
I see a test with [Let's Debug](https://letsdebug.net/astra.scada-international.com/1373259) results in connection reset as well, make sure you're not using geographic filtering at the firewall as Let's Encrypts http validation could come from more or less any country. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [February 14, 2023, 5:11am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/11 "2023-02-14T05:11:42Z")
> [@webprofusion](#): > > I see a test with [Let's Debug](https://letsdebug.net/astra.scada-international.com/1373259) results in connection reset as well, Yes, this is classic symptom of the Palo Alto Networks firewall blocking the "ACME Protocol". I have dealt with numerous cases of this. There is also a general topic on this by Seth Schoen ([link here](https://community.letsencrypt.org/t/palo-alto-firewall-users-with-failing-http-01-challenges-enable-acme-protocol/177600)) Just fyi, the initial test from Let's Debug has a similar user-agent as the actual LE servers which is why it also gets caught up in it. ---
**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\ **Post date:** [February 14, 2023, 6:00am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/12 "2023-02-14T06:00:18Z")
> [@MikeMcQ](#): > > Palo Alto Networks firewall blocking the "ACME Protocol" The ACME Protocol is used for obtaining SSL/TLS certificates from a certificate authority (Let's Encrypt in this case), and LE uses the HTTP or HTTPS protocol. If your Palo Alto Networks firewall is blocking the ACME Protocol, it may be due to a misconfiguration or a security policy that restricts ~~outbound~~ **inbound** traffic. You may need to configure your firewall to allow traffic on the ports used by the ACME Protocol (port 80 for HTTP and port 443 for HTTPS), or create an exception in your security policy to allow the necessary traffic. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 14, 2023, 6:54am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/13 "2023-02-14T06:54:25Z")
2 posts were split to a new topic: [Couldn't create https](https://community.letsencrypt.org/t/couldnt-create-https/192764) ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [February 14, 2023, 11:47am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/14 "2023-02-14T11:47:57Z")
> [@Rip](#): > > it may be due to a misconfiguration or a security policy that restricts _outbound_ traffic. Palo Alto added a feature to their firewalls to block ACME Protocol. It is an Application Rule and blocks _inbound_ HTTP Challenges. See my post #7 These are the terms that they use in their firewall to describe this feature ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [February 14, 2023, 3:50pm UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/15 "2023-02-14T15:50:01Z")
@pnrdk given that you are using Windows, and making an assumption that you do not have easy access to `curl` there is a Windows application [https://www.postman.com/](https://www.postman.com/) (there is a free use level) [Postman (software) - Wikipedia](https://en.wikipedia.org/wiki/Postman_(software)) ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [February 14, 2023, 4:01pm UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/16 "2023-02-14T16:01:11Z")
> [@Bruce5051](#): > > given that you are using Windows, and making an assumption that you do not have easy access to `curl` Just fyi, modern Windows have curl and so do Windows Servers starting 2019 I believe. ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [February 14, 2023, 4:03pm UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/17 "2023-02-14T16:03:47Z")
> [@MikeMcQ](#): > > Just fyi, modern Windows have curl Oh, that is great to know; I see it. ```nohighlight C:\Users\Bruce>ver Microsoft Windows [Version 10.0.19045.2546] C:\Users\Bruce>curl --help Usage: curl [options...] -d, --data HTTP POST data -f, --fail Fail fast with no output on HTTP errors -h, --help Get help for commands -i, --include Include protocol response headers in the output -o, --output Write to file instead of stdout -O, --remote-name Write output to a file named as the remote file -s, --silent Silent mode -T, --upload-file Transfer local FILE to destination -u, --user Server user and password -A, --user-agent Send User-Agent to server -v, --verbose Make the operation more talkative -V, --version Show version number and quit This is not the full help, this menu is stripped into categories. Use "--help category" to get an overview of all categories. For all options use the manual or "--help all". ``` ---
**Author:** ![pnrdk](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pnrdk/32/65486_2.png) [@pnrdk](https://community.letsencrypt.org/u/pnrdk)\ **Post date:** [February 16, 2023, 6:40am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/18 "2023-02-16T06:40:23Z")
Thanks very much to all contributing on this thread 🙏 🙏 It was the firewall causing issues, so now it is working fine 🙂 ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 18, 2023, 6:40am UTC](https://community.letsencrypt.org/t/issue-creating-certificate/192712/19 "2023-03-18T06:40:40Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.