Issue creating/renewing timeout

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: trucklecheese.co.uk

I ran this command: New certificate

It produced this output:
[www.trucklecheese.co.uk] Authorizing...
[www.trucklecheese.co.uk] Authorizing using http-01 validation (SelfHosting)
[www.trucklecheese.co.uk] Authorization result: invalid
[www.trucklecheese.co.uk] {
"type": "urn:ietf:params:acme:error:unauthorized",
"detail": "2001:41d0:800:1fb9::: Invalid response from http://www.trucklecheese.co.uk/.well-known/acme-challenge/Mg2AYv2lq1zk1E5X5JcCcRSJaj2oqnc3eNSeC2OF4RY: 404",
"status": 403
}
[www.trucklecheese.co.uk] Deactivating pending authorization

My web server is (include version): Windows Server 2016

The operating system my web server runs on is (include version): Windows 64-bit

My hosting provider, if applicable, is: advanceditservices.co.uk

I can login to a root shell on my machine (yes or no, or I don't know): I don't know

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Not sure - the file is wacs.exe - I think certbot is a Linux thing?

Hello @PeterC1 welcome to the community

Certbot is not just a linux thing but it is not the best for IIS on Windows (which is you). So, wacs or another ACME client designed for Windows is best then.

What is your version of wacs? (run wacs --version)

I see the 404 failure but I also see you got a cert yesterday for that domain. What is different about your request today compared to yesterday?

2 Likes

Software version 2.1.22.1289 (release, trimmed, standalone, 64-bit)

I assume this is right as it comes at the top of the window when running

I think your observation may have highlighted an issue which may mean this is embarrassingly all our fault. I will discuss this with my colleague when he is free and come back to you if the problem continues Thanks so much for your reply

2 Likes

OK - so that domain turned out to have been moved to another server. However, here is the result if I work manually with this domain which is due to renew tomorrow, and I assume won't

Source generated using plugin IIS: hub.quickbydesign.co.uk

Existing renewal: [IIS] QuickHub, (any host) - renewed 13 times, due now,
30 errors like "{
"type": "urn:ietf:params:acme:error:connection",
"detail": "46.18.52.126: Fetching
http://hub.quickbydesign.co.uk/.well-known/acme-challenge/LqtE8AUCFgrqOW35cRVTtDzd5BUpFNbVl9EGBRBTa20:
Timeout during connect (likely firewall problem)",
"status": 400
}"

Overwrite settings? (y*/n) - yes

Overwriting previously created renewal

Renewal [IIS] QuickHub, (any host) running prematurely due to source change in order Main
Renewing [IIS] QuickHub, (any host)
[hub.quickbydesign.co.uk] Authorizing...
[hub.quickbydesign.co.uk] Authorizing using http-01 validation (SelfHosting)
[hub.quickbydesign.co.uk] Authorization result: invalid
[hub.quickbydesign.co.uk] {
"type": "urn:ietf:params:acme:error:connection",
"detail": "46.18.52.126: Fetching http://hub.quickbydesign.co.uk/.well-known/acme-challenge/zWfN8u14V6TtoMa-xtLuiBlcOCByEzacs9u1K3gKIgo: Timeout during connect (likely firewall problem)",
"status": 400
}
[hub.quickbydesign.co.uk] Deactivating pending authorization

Whatever we try to do on this server we hit the timeout problem, and I assume that tomorrow's auto-renew on this domain will have the same problem. If you have any ideas, I would be delighted to hear them!

My best guess is you have a firewall that is blocking IP addresses used by the Let's Encrypt servers. And, no, these are not published. See here.

I can reach your server just fine from my own test server. I also probed for problems related to Palo Alto Networks brand firewalls and did not see those problems. But, the most telling clue comes from the Let's Debug test site.

Look at this test result and you'll see an initial test to your server got a 404. The 404 is expected since you don't have that file on your server but it proves connectivity.

Yet, the test request using the Let's Encrypt staging servers right after failed with a timeout. This is almost certainly a firewall blocking certain IP's.

2 Likes

Thanks so much. I am going to pass this information to the hosting company. It looks like it is their end.

2 Likes

For the record, this is now fixed. It wasn't us at all! Despite our hosting people saying that no firewall rules had been changed. Still don't know what they actually did but clearly something as it is now working fine again. Thank you so much @MikeMcQ for your input, which helped us toward the right solution.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.