My ip is apparently blocked 86.111.12.92
root@ucs:~# curl -v https://acme-v02.api.letsencrypt.org/directory
Trying 172.65.32.248...
TCP_NODELAY set
Trying 2606:4700:60:0:f53d:5624:85c7:3a2c...
TCP_NODELAY set
Immediate connect fail for 2606:4700:60:0:f53d:5624:85c7:3a2c: Network is unreachable
Trying 2606:4700:60:0:f53d:5624:85c7:3a2c...
TCP_NODELAY set
Immediate connect fail for 2606:4700:60:0:f53d:5624:85c7:3a2c: Network is unreachable
Trying 2606:4700:60:0:f53d:5624:85c7:3a2c...
TCP_NODELAY set
Immediate connect fail for 2606:4700:60:0:f53d:5624:85c7:3a2c: Network is unreachable
connect to 172.65.32.248 port 443 failed: No route to host
Trying 2606:4700:60:0:f53d:5624:85c7:3a2c...
TCP_NODELAY set
Immediate connect fail for 2606:4700:60:0:f53d:5624:85c7:3a2c: Network is unreachable
Trying 2606:4700:60:0:f53d:5624:85c7:3a2c...
TCP_NODELAY set
Immediate connect fail for 2606:4700:60:0:f53d:5624:85c7:3a2c: Network is unreachable
Failed to connect to acme-v02.api.letsencrypt.org port 443: No route to host
Closing connection 0acme-v02.api.letsencrypt.org port 443: No route to hosthttps://google.com/
Trying 173.194.220.102...
TCP_NODELAY set
Connected to google.com (173.194.220.102) port 443 (#0 )
ALPN, offering h2
ALPN, offering http/1.1
Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
successfully set certificate verify locations:
CAfile: /etc/ssl/certs/ca-certificates.crt
TLSv1.2 (OUT), TLS header, Certificate Status (22):
TLSv1.2 (OUT), TLS handshake, Client hello (1):
TLSv1.2 (IN), TLS handshake, Server hello (2):
TLSv1.2 (IN), TLS handshake, Certificate (11):
TLSv1.2 (IN), TLS handshake, Server key exchange (12):
TLSv1.2 (IN), TLS handshake, Server finished (14):
TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
TLSv1.2 (OUT), TLS change cipher, Client hello (1):
TLSv1.2 (OUT), TLS handshake, Finished (20):
TLSv1.2 (IN), TLS change cipher, Client hello (1):
TLSv1.2 (IN), TLS handshake, Finished (20):
SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
ALPN, server accepted to use h2
Server certificate:
subject: CN=*.google.com
start date: Mar 10 08:36:06 2025 GMT
expire date: Jun 2 08:36:05 2025 GMT
subjectAltName: host "google.com " matched cert's "google.com "
issuer: C=US; O=Google Trust Services; CN=WE2
SSL certificate verify ok.
Using HTTP2, server supports multi-use
Connection state changed (HTTP/2 confirmed)
Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
Using Stream ID: 1 (easy handle 0x5564b14b1e00)
HEAD / HTTP/1.1google.com /
Connection state changed (MAX_CONCURRENT_STREAMS updated)!https://www.google.com/ https://www.google.com/ https://csp.withgoogle.com/csp/gws/other-hp https://csp.withgoogle.com/csp/gws/other-hp
<
Curl_http_done: called premature == 0
Connection #0 to host google.com left intact
Osiris
March 30, 2025, 7:03am
2
86.111.12.92 is an IPv4 address. The address above your host is trying to connect to is an IPv6 address.
Apparently your host thinks it's able to use the IPv6 protocol, but clearly it can't.
Not sure why your curl suddenly tries IPv4 for google.com though. But you either need to fix your IPv6 or disable it.
6 Likes
dmitriykapiton:
Trying 172.65.32.248...
TCP_NODELAY set
Trying 2606:4700:60:0:f53d:5624:85c7:3a2c...
TCP_NODELAY set
Immediate connect fail for 2606:4700:60:0:f53d:5624:85c7:3a2c: Network is unreachable
You may want to add the -4 flag to the curl command to make the failure more visible.
2 Likes
root@ucs:~# curl -v -4 https://acme-v02.api.letsencrypt.org/directory
Trying 172.65.32.248...
TCP_NODELAY set
connect to 172.65.32.248 port 443 failed: No route to host
Failed to connect to acme-v02.api.letsencrypt.org port 443: No route to host
Closing connection 0acme-v02.api.letsencrypt.org port 443: No route to host
Osiris
March 31, 2025, 8:35am
5
What do the following commands output?
traceroute -4 acme-v02.api.letsencrypt.org
traceroute -6 acme-v02.api.letsencrypt.org
sudo traceroute -4 -T -p 443 acme-v02.api.letsencrypt.org
sudo traceroute -6 -T -p 443 acme-v02.api.letsencrypt.org
ip -4 route list
ip -6 route list
1 Like
root@ucs:~# traceroute -4 acme-v02.api.letsencrypt.org acme-v02.api.letsencrypt.org acme-v02.api.letsencrypt.org acme-v02.api.letsencrypt.org
Osiris
March 31, 2025, 9:06am
7
A Linux system without traceroute installed? That's weird..
1 Like
root@ucs:~# traceroute -4 -T -p 443 acme-v02.api.letsencrypt.org acme-v02.api.letsencrypt.org (172.65.32.248), 30 hops max, 60 byte packetsacme-v02.api.letsencrypt.org
connect: Cannot assign requested address
Osiris
March 31, 2025, 9:12am
9
You can see your own router is sending the Network is unreachable messages (by the !H notification). So it's not some Cloudflare/Let's Encrypt blockage.
You should check your router settings as to why it would block access to 172.65.32.248. This is often caused by an incorrect setting of the 172.16.0.0/12 private address space. Notice the /12. Sometimes the entire 172.0.0.0/8 ranges gets routed as 'private', which would obviously block access to IP addresses within the public IP address space within the 172.0.0.0/8 range.
5 Likes
root@ucs:~# curl -v https://acme-v02.api.letsencrypt.org/directory
Trying 172.65.32.248...
TCP_NODELAY set
Connected to acme-v02.api.letsencrypt.org (172.65.32.248) port 443 (#0 )
ALPN, offering h2
ALPN, offering http/1.1
Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
successfully set certificate verify locations:
CAfile: /etc/ssl/certs/ca-certificates.crt
TLSv1.2 (OUT), TLS header, Certificate Status (22):
TLSv1.2 (OUT), TLS handshake, Client hello (1):
TLSv1.2 (IN), TLS header, Unknown (21):
TLSv1.2 (IN), TLS alert, Server hello (2):
error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failu re
Curl_http_done: called premature == 1
stopped the pause stream!
Closing connection 0
It turns out that it is blocked, how do I unlock it? I need it from this IP.
linkp
March 31, 2025, 1:16pm
12
dmitriykapiton:
it is blocked
How have you made that determination? So far you have only shown that you (or one of your ISPs ) have a routing issue with traffic bound for 172.65.32.248.
4 Likes
danb35
March 31, 2025, 1:44pm
13
No, it turns out that your router doesn't know how to route to that address--which is what you were previously told. That's a you (or your provider) problem, not a Let's Encrypt problem. If it works with one provider and not another, it seems pretty obvious that the problem is with the one provider.
"My IP is blocked" is never the conclusion you should jump to, as it's exceedingly rare for it to happen. And "no route to host" pretty much definitively shows that that isn't what's going on..
5 Likes
Your problem is likely related to this docker routing.
As noted by my fellow volunteers your problem is with your own local network routing. Let's Encrypt doesn't have those old IP blocks anymore. And, even when they did the error was different than you see.
4 Likes
Most likely, the provider is blocked or blocked at 172.65.32.248 . I launched it on the Mikrotik entrance gateway.
How can I make sure it's a provider? It's just that the provider says that he has no locks on this site. I completely reinstalled the system, the same thing.
linkp
April 1, 2025, 2:07pm
17
Check the plank in your own eye before asking your ISP if they have a speck in their eye.
3 Likes
You should use a TCP trace not ICMP
Network routings can be very difficult to locate. A different Certificate Authority may be your best option.
What do these show
curl https://api.buypass.com/acme/directory
curl -i --connect-to ::172.253.115.139:443 https://dv.acme-v02.api.pki.goog/directory
2 Likes
I have checked access from all devices, computer server phone. As soon as I log on to the network via Wi-Fi or wire, it is immediately blocked. I even went to the neighbors, they have the same provider, it works for them.
I'll try it within an hour. From the phone, the first link doesn't work, the second one does.
