# My Server is Geoblocked and I don't have DNS or Firewall privileges **URL:** \ **Category:** Help\ **Created:** [April 24, 2024, 8:54pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128 "2024-04-24T20:54:22Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 25, 2024, 6:18pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/21 "2024-04-25T18:18:01Z")
> [@miqrogroove](#): > > Problem solved. For now 😉 ---
**Author:** ![miqrogroove](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/miqrogroove/32/29414_2.png) [@miqrogroove](https://community.letsencrypt.org/u/miqrogroove)\ **Post date:** [May 16, 2024, 1:09pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/23 "2024-05-16T13:09:55Z")
Follow-up configuration question. Although the new certificate from ZeroSSL is working fine, I can't validate a dry run. I've confirmed under `/etc/letsencrypt/renewal/.conf` that the value pair `server = https://acme.zerossl.com/v2/DV90` is still set correctly. When I call `certbot renew --dry-run` it seems to throw the LetsEncrypt geoblock error message: `During secondary validation: ... Timeout during connect (likely firewall problem)` Is there a way to verify certbot is connecting to the specified server? ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [May 16, 2024, 1:12pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/24 "2024-05-16T13:12:41Z")
zerossl doesn't run own staging server ---
**Author:** ![miqrogroove](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/miqrogroove/32/29414_2.png) [@miqrogroove](https://community.letsencrypt.org/u/miqrogroove)\ **Post date:** [May 16, 2024, 1:13pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/25 "2024-05-16T13:13:42Z")
In other words the `--dry-run` option overrides the `server` setting? I was able to confirm `--force-renewal` pulls a new ZeroSSL cert, where as `--dry-run` pulls a Let'sEncrypt geoblock error. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 16, 2024, 1:27pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/26 "2024-05-16T13:27:31Z")
> [@miqrogroove](#): > > In other words the `--dry-run` option overrides the `server` setting? Yes. To use a different test server you could do: ```nohighlight certbot renew --dry-run --server URL ``` Where the URL value is the test server. The --server value must appear after the `--dry-run`. The default for --dry-run is: ```nohighlight --server https://acme-staging-v02.api.letsencrypt.org/directory ``` But, ZeroSSL does not have their own test system (google does I think and there may be others) > **[ACME CA Comparison - Posh-ACME](https://poshac.me/docs/v4/Guides/ACME-CA-Comparison/)** > > Documentation for the Posh-ACME PowerShell module ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [May 16, 2024, 1:31pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/27 "2024-05-16T13:31:34Z")
> [@miqrogroove](#): > > Is there a way to verify certbot is connecting to the specified server? The Certbot log contains the URL for the ACME server it's using to connect to. ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [May 16, 2024, 4:41pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/28 "2024-05-16T16:41:45Z")
Also be aware other CAs validation requests could come from an entirely different set of geo locations. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [June 15, 2024, 4:42pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/29 "2024-06-15T16:42:39Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed. [Previous page](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128.md?page=1)