No valid A records found for

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. |, so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command: /usr/bin/certbot renew -v

It produced this output:
[root@newlapserv renewal]# /usr/bin/certbot renew -v
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/

Certificate is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate for
Performing the following challenges:
http-01 challenge for
Waiting for verification...
Challenge failed for domain
http-01 challenge for

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Type: dns
Detail: no valid A records found for; no valid AAAA records found for

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Cleaning up challenges
Failed to renew certificate with error: Some challenges have failed.

All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/ (failure)

Running post-hook command: /usr/bin/systemctl restart httpd
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): apache Fedora 34 Standard

The operating system my web server runs on is (include version):
Fedora linux 5.16.5-100.fc34.x86_64

My hosting provider, if applicable, is: Primerocom / VSE Net

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Yes

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.22.0

Is this an config problem or a problem with Thx!

1 Like

It's a DNS issue.

What kind of DNS resource record have you set up? Because I'm not seeing any error, but also no answer. See for example:

Notice the "NOERROR" in the response, but also the "ANSWER: 0" part..


Hi Osiris,
Thank you for your help!
Unfortunately, I don't even know how to set up a DNS record.
I just installed letsencrypt a long time ago and it has worked great so far. Now I have to clarify whether the fault lies with me. Maybe an update changed something? Or whether generates an incorrect entry and I have to look for a new provider.
Is the problem with my installation or with
Many thanks

1 Like

Well, that was my first thought, looking at the results of above.

But if I look at | DNSViz it seems everything is working fine.

And if I do a dig +trace myself, I also see a perfectly fine A resource record with an IP address returned.

Let's Encrypt uses Unbound as their DNS library and uses an (almost?) identical configuration as the Let's Encrypt validation server. However, I don't know how to debug the difference between the NOERROR without an answer result from and the normal results I'm finding myself and on DNSViz.. Strange!


The issue at hand is that currently resolves to

;; ANSWER SECTION: 60      IN      A

an IP address within the IPv4 shared access space block (RFC 6598). These IP addresses are generally not internet-routable. Let's Encrypt automatically filters such IP addresses from DNS lookups. Because there are no other addresses available, it results in this error.

The IP address in question is commonly used CG-NAT space. @fbu: Has your ISP made recent changes to your internet connection, or have you made changes to how you connect to the internet?


Aw crap, missed that! Now I remember that Unbound as configured by Let's Encrypt (and probably also Unboundtest) filters out those private IP blocks from the result... I was too focussed on "Hm, why doesn't it result anything" and didn't remember the filtering..


Our provider charges additional fees for new contracts, so that one has a public IP address. Maybe he is annoyed about our old contract and tries to collect this outrageous additional fee from old customers. I didn't expect that, but that seems to be the reason.
Unfortunately, we have a fiber-optic connection here. Unfortunately, because there is only one provider and it shamelessly exploits its monopoly.
Then there is probably no solution to my problem. :sob:

If you require your site to be accessible through IPv4 from the world wide web, having a certificate or not wouldn't matter anyway, as your site wouldn't be reachable to begin with.

Or go IPv6 only, if that's a possibility. You'd miss a lot of potential IPv4 only visitors obviously though.

It's possible to get a cert using the dns-01 challenge, which wouldn't require a working incoming connection, but usage of that would also depend on what your DNS provider offers.


This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.