Let's Encypt on Ubuntu 24.04.4 stopped working with challenges

Help
1

my certificates renew in 7 days. Everything was working up to this renewal. Python 3 is up to date.

scsiraidguru.com, firewall.scsiraidguru.com, mc.scsiraidguru.com, and www.scsiraidguru.com

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
  Domain: firewall.scsiraidguru.com
  Type:   connection
  Detail: 2600:1700:b101:8080::48: Fetching http://firewall.scsiraidguru.com/.well-known/acme-challenge/aYE0SrvIeTtISaxVdmSaX0-LLoWsoFxvPd0sGmhnOzI: Error getting validation data

  Domain: mc.scsiraidguru.com
  Type:   connection
  Detail: 2600:1700:b101:8080::48: Fetching http://mc.scsiraidguru.com/.well-known/acme-challenge/OaXtE_aff0wN7IgBaJDD9efjwLFIjNlJ0MNWzWnus8o: Error getting validation data

  Domain: scsiraidguru.com
  Type:   connection
  Detail: 2600:1700:b101:8080::48: Fetching http://scsiraidguru.com/.well-known/acme-challenge/YR8zyzfeOHXVwPDrC9-VL8eghjGQr6Oohnx7sxBaeik: Error getting validation data

  Domain: www.scsiraidguru.com
  Type:   connection
  Detail: 2600:1700:b101:8080::48: Fetching http://www.scsiraidguru.com/.well-known/acme-challenge/Ouafo0Kwe7mthEssgfwPqC5w2FuSFCNu9jsK6dSxHWY: Error getting validation data

I tested on ssllabs.com my IPV4 and IPv6 entries for each web site get A+ on tests. So they are fully available.

Fortinet 61F firewall has virtual IPs that point to the web server on IPv6 and IPv4.

I checked /etc/apache2/sites-available and sites-enabled have www-data:www-data permissions.

All Ubuntu 24.04.4 LAMP components are up to date.

michael@webserver2404:/etc/apache2/sites-enabled$ sudo certbot renew --dry-run --preferred-challenges http-01 -v
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/scsiraidguru.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cannot extract OCSP URI from /etc/letsencrypt/archive/scsiraidguru.com/cert1.pem
Certificate is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Simulating renewal of an existing certificate for scsiraidguru.com and 3 more domains
Performing the following challenges:
http-01 challenge for firewall.scsiraidguru.com
http-01 challenge for mc.scsiraidguru.com
http-01 challenge for scsiraidguru.com
http-01 challenge for www.scsiraidguru.com
Waiting for verification...
Challenge failed for domain firewall.scsiraidguru.com
Challenge failed for domain mc.scsiraidguru.com
Challenge failed for domain scsiraidguru.com
Challenge failed for domain www.scsiraidguru.com
http-01 challenge for firewall.scsiraidguru.com
http-01 challenge for mc.scsiraidguru.com
http-01 challenge for scsiraidguru.com
http-01 challenge for www.scsiraidguru.com

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
  Domain: firewall.scsiraidguru.com
  Type:   connection
  Detail: 2600:1700:b101:8080::48: Fetching http://firewall.scsiraidguru.com/.well-known/acme-challenge/14gCHinl3RPhLjY68MMH8RgOpuCiHPYHYs-LA2YdBkY: Error getting validation data

  Domain: mc.scsiraidguru.com
  Type:   connection
  Detail: 2600:1700:b101:8080::48: Fetching http://mc.scsiraidguru.com/.well-known/acme-challenge/Ka5N4MgHu750gaiL5CA5TtcMRBQirWrXqK56vtMm0z0: Error getting validation data

  Domain: scsiraidguru.com
  Type:   connection
  Detail: 2600:1700:b101:8080::48: Fetching http://scsiraidguru.com/.well-known/acme-challenge/bmsgIj_20VDg_QwqugbKJum18-Oa02zaRIh64Ajnyo4: Error getting validation data

  Domain: www.scsiraidguru.com
  Type:   connection
  Detail: 2600:1700:b101:8080::48: Fetching http://www.scsiraidguru.com/.well-known/acme-challenge/LcI0ew2iIFFt5krTLnyTx4gb8YK117_tB_v05XkUdfM: Error getting validation data

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Cleaning up challenges
Failed to renew certificate scsiraidguru.com with error: Some challenges have failed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All simulated renewals failed. The following certificates could not be renewed:
  /etc/letsencrypt/live/scsiraidguru.com/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
michael@webserver2404:/etc/apache2/sites-enabled$

2026-07-15 16:16:07,378:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 108, in handle_authorizations
self._poll_authorizations(authzrs, max_retries, max_time_mins, best_effort)
File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 212, in _poll_authorizations
raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.

2026-07-15 16:16:07,378:DEBUG:certbot._internal.error_handler:Calling registered functions
2026-07-15 16:16:07,378:INFO:certbot._internal.auth_handler:Cleaning up challenges
2026-07-15 16:16:07,608:ERROR:certbot._internal.renewal:Failed to renew certificate scsiraidguru.com with error: Some challenges have failed.
2026-07-15 16:16:07,611:DEBUG:certbot._internal.renewal:Traceback was:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 540, in handle_renewal_request
main.renew_cert(lineage_config, plugins, renewal_candidate)
File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1550, in renew_cert
renewed_lineage = _get_and_save_cert(le_client, config, lineage=lineage)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 131, in _get_and_save_cert
renewal.renew_cert(config, domains, le_client, lineage)
File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 399, in renew_cert
new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 428, in obtain_certificate
orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 496, in _get_order_and_authorizations
authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 108, in handle_authorizations
self._poll_authorizations(authzrs, max_retries, max_time_mins, best_effort)
File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 212, in _poll_authorizations
raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.

2026-07-15 16:16:07,613:DEBUG:certbot._internal.display.obj:Notifying user:

2026-07-15 16:16:07,614:ERROR:certbot._internal.renewal:All simulated renewals failed. The following certificates could not be renewed:
2026-07-15 16:16:07,614:ERROR:certbot._internal.renewal: /etc/letsencrypt/live/scsiraidguru.com/fullchain.pem (failure)
2026-07-15 16:16:07,614:DEBUG:certbot._internal.display.obj:Notifying user: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2026-07-15 16:16:07,615:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
File "/usr/bin/certbot", line 33, in
sys.exit(load_entry_point('certbot==2.9.0', 'console_scripts', 'certbot')())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/certbot/main.py", line 19, in main
return internal_main.main(cli_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1894, in main
return config.func(config, plugins)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1642, in renew
renewed_domains, failed_domains = renewal.handle_renewal_request(config)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 568, in handle_renewal_request
raise errors.Error(
certbot.errors.Error: 1 renew failure(s), 0 parse failure(s)
2026-07-15 16:16:07,616:ERROR:certbot._internal.log:1 renew failure(s), 0 parse failure(s)
root@webserver2404:/var/log/letsencrypt#

2

http://firewall.scsiraidguru.com/.well-known/acme-challenge/aYE0SrvIeTtISaxVdmSaX0-LLoWsoFxvPd0sGmhnOzI redirects to https://firewall.scsiraidguru.com/.well-known/acme-challenge/aYE0SrvIeTtISaxVdmSaX0-LLoWsoFxvPd0sGmhnOzI which redirects to itself.

3

LE prefers IPv6 over IPv4.
Ensure that your sites work for both.

4

I tested with SSLLabs and got A+ on IPv6 and IPv4.

I removed scsiraidguru.com-0001 and sudo certbot certonly --standalone -d scsiraidguru.com
It generated a new certificate for scsiraidguru.com only. It created scsiraidguru.com-0002.

I expanded the certificate:

sudo certbot --expand  -d scsiraidguru.com -d firewall.scsiraidguru.com -d mc.scsiraidguru.com -d www.scsiraidguru.com

It moved everything back to scsiraidguru.com in /etc/letsencrypt/live.
It had errors upgrading /etc/apache2/sites-available that I usually have to go in and fix manually. No issues.

I moved the new certs to /home/michael/certificate and gave them permissions to move for my Fortinet.

Installed on Fortinet in every location needed.

Back working. Thanks for the help.

5

I think that's the crux of the problem(s):

What shows?:
sudo apachectl -t -D DUMP_VHOSTS

6 
sudo apachectl -t -D DUMP_VHOSTS
VirtualHost configuration:
*:9443                 www.scsiraidguru.com (/etc/apache2/sites-enabled/phpmyadmin.conf:10)
*:80                   is a NameVirtualHost
         default server mc.scsiraidguru.com (/etc/apache2/sites-enabled/mc.scsiraidguru.com.conf:13)
         port 80 namevhost mc.scsiraidguru.com (/etc/apache2/sites-enabled/mc.scsiraidguru.com.conf:13)
         port 80 namevhost scsiraidguru.com (/etc/apache2/sites-enabled/wp.scsiraidguru.com.conf:12)
         port 80 namevhost firewall.scsiraidguru.com (/etc/apache2/sites-enabled/wp.scsiraidguru.com.conf:20)
         port 80 namevhost www.scsiraidguru.com (/etc/apache2/sites-enabled/wp.scsiraidguru.com.conf:28)
*:443                  is a NameVirtualHost
         default server mc.scsiraidguru.com (/etc/apache2/sites-enabled/mc.scsiraidguru.com.conf:21)
         port 443 namevhost mc.scsiraidguru.com (/etc/apache2/sites-enabled/mc.scsiraidguru.com.conf:21)
         port 443 namevhost firewall.scsiraidguru.com (/etc/apache2/sites-enabled/wp.scsiraidguru.com-le-ssl.conf:2)
         port 443 namevhost scsiraidguru.com (/etc/apache2/sites-enabled/wp.scsiraidguru.com.conf:36)
         port 443 namevhost www.scsiraidguru.com (/etc/apache2/sites-enabled/wp.scsiraidguru.com.conf:45)
                 alias scsiraidguru.com

It created -0001, -0002, etc. I killed them and got them working.

You can test at SSLLabs.com . You put in your different domains and it will check IPv6 and IPv4 along with TLS, and other crypto stuff.

7

This seems incorrect:

      scsiraidguru.com
alias scsiraidguru.com

Let's have a look at:
/etc/apache2/sites-enabled/wp.scsiraidguru.com.conf

8

We use IPv4, it works fine.

9

I'm not sure what the relevance of your remark is, but @rg305's comment was admittedly incomplete. A more complete statement would be that if you have both A and AAAA DNS records--that is, if you publish both IPv4 and IPv6 addresses for your domain--Let's Encrypt will prefer the IPv6 address. If they get an invalid response there, they won't fall back to IPV4. So, if you're publishing both kinds of addresses, make sure they both respond in the same way. If you don't intend to use IPV6, don't publish AAAA records.

10

Just in case it's still not clear, your domain has an IPv6 Address if you type it into Dig (DNS lookup)

Let's Encyrpt checks that first. it doesn't matter if you only use IPv4, you are declaring support for IPv6 via DNS. This often happens because the DNS provider automatically creates a record AAAA that points to their own domain parking, so you have to delete that if you are not using it.

11

The comment you replied to was not the OP. As @danb35 noted this new person's comment wasn't pertinent to the OP's setup which had an IPv6 address and still does. And, which they got working.

Your info was fine we just don't know anything about this new poster apart from they like IPv4 :slight_smile: