# Issues renewing certificates due to challenge/response fails **URL:** \ **Category:** Help\ **Created:** [December 6, 2022, 5:55pm UTC](https://community.letsencrypt.org/t/issues-renewing-certificates-due-to-challenge-response-fails/189054 "2022-12-06T17:55:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![MackJsy](https://avatars.discourse-cdn.com/v4/letter/m/0ea827/32.png) [@MackJsy](https://community.letsencrypt.org/u/MackJsy)\ **Post date:** [December 6, 2022, 5:55pm UTC](https://community.letsencrypt.org/t/issues-renewing-certificates-due-to-challenge-response-fails/189054/1 "2022-12-06T17:55:10Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: aquarius.je I ran this command: certbot renew --dry-run It produced this output: Fetching [http://aquarius.je/.well-known/acme-challenge/cg6W1FJsdUAa2wpfqmOcbuRtwX0-yQcKKwGkFTzBd68:](http://aquarius.je/.well-known/acme-challenge/cg6W1FJsdUAa2wpfqmOcbuRtwX0-yQcKKwGkFTzBd68:) Timeout during connect (likely firewall problem) My web server is (include version): Apache/2.4.52 (Ubuntu) The operating system my web server runs on is (include version): Ubuntu 22.04.1 LTS My hosting provider, if applicable, is: ME I can login to a root shell on my machine (yes or no, or I don't know): YES I'm using a control panel to manage my site (no, or provide the name and version of the control panel): NO The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 1.32.1 Further Info : Port 80 is disabled - I won't run a web server with it enabled - regardless of the "port 80 doesn't matter" DNS is hosted by myself on different servers using Bind. I am struggling to renew a cert without having to go onto the server and use ufw allow 80 certbot renew ufw delete .... I can add a record to DNS - just not via API - why should I have to enable port 80 for the challenge response ? TIA for any pointers, Mack ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [December 6, 2022, 6:15pm UTC](https://community.letsencrypt.org/t/issues-renewing-certificates-due-to-challenge-response-fails/189054/2 "2022-12-06T18:15:47Z")
> [@MackJsy](#): > > I can add a record to DNS - just not via API - why should I have to enable port 80 for the challenge response ? Well, you need to pick one of the [challenge types](https://letsencrypt.org/docs/challenge-types/) that Let's Encrypt supports for validating that you own the name. All of them require having _some_ system & port which is open to the world (at least while the challenge is happening), so that Let's Encrypt can validate that you actually own the name as seen by everyone in the world. For many people, it's easiest to use the port 80 HTTP-01 method. If you don't, that's fine, but that means you need to use TLS-ALPN-01 (if you have DNS & 443 available to the world) or DNS-01 (if you only have DNS available to the world). TLS-ALPN-01 requires a client that's more sophisticated than certbot, and DNS-01 requires (ideally) scripting the changes to the DNS provider. > [@MackJsy](#): > > I am struggling to renew a cert without having to go onto the server and use > ufw allow 80 > certbot renew > ufw delete .... Well, you can use the [pre-hook and post-hook](https://eff-certbot.readthedocs.io/en/stable/using.html#renewing-certificates) functionality in certbot to script these commands, so that the ports are only open when the renewal is running, if that's all you're looking for. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [December 6, 2022, 6:19pm UTC](https://community.letsencrypt.org/t/issues-renewing-certificates-due-to-challenge-response-fails/189054/3 "2022-12-06T18:19:48Z")
> [@MackJsy](#): > > Port 80 is disabled - I won't run a web server with it enabled - regardless of the "port 80 doesn't matter" Maybe you aren't willing to go into this, but I'm very curious to know why. ---
**Author:** ![MackJsy](https://avatars.discourse-cdn.com/v4/letter/m/0ea827/32.png) [@MackJsy](https://community.letsencrypt.org/u/MackJsy)\ **Post date:** [December 6, 2022, 6:22pm UTC](https://community.letsencrypt.org/t/issues-renewing-certificates-due-to-challenge-response-fails/189054/4 "2022-12-06T18:22:01Z")
> [@Osiris](#): > > Maybe you aren't willing to go into this, but I'm very curious to know why. Let's just say Infosec.... (not I fight I will win) ---
**Author:** ![MackJsy](https://avatars.discourse-cdn.com/v4/letter/m/0ea827/32.png) [@MackJsy](https://community.letsencrypt.org/u/MackJsy)\ **Post date:** [December 6, 2022, 6:22pm UTC](https://community.letsencrypt.org/t/issues-renewing-certificates-due-to-challenge-response-fails/189054/5 "2022-12-06T18:22:37Z")
> [@petercooperjr](#): > > Well, you can use the [pre-hook and post-hook](https://eff-certbot.readthedocs.io/en/stable/using.html#renewing-certificates) functionality in certbot to script these commands, so that the ports are only open when the renewal is running, if that's all you're looking for. By Jove, I think that may be exactly what I'm looking for - bit of a hack, but it will do the job ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 5, 2023, 6:23pm UTC](https://community.letsencrypt.org/t/issues-renewing-certificates-due-to-challenge-response-fails/189054/6 "2023-01-05T18:23:39Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.