# Obtain first certificate: timeout

**URL:** <https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593>\
**Category:** Help\
**Created:** [July 10, 2019, 3:16pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593 "2019-07-10T15:16:38Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 10, 2019, 3:16pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/1 "2019-07-10T15:16:38Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: [campo-randale.de](http://campo-randale.de)

I ran this command: certbot --apache

It produced this output:  
Domain: [crbox.campo-randale.de](http://crbox.campo-randale.de)  
Type: connection  
Detail: Fetching  
[http://crbox.campo-randale.de/.well-known/acme-challenge/d2C02-4MXN8jysq6y5WTnMxkghw8fpkGjU8GPK2AC5Y:](http://crbox.campo-randale.de/.well-known/acme-challenge/d2C02-4MXN8jysq6y5WTnMxkghw8fpkGjU8GPK2AC5Y:)  
Timeout during connect (likely firewall problem)

(the challenge is faked)

My web server is (include version): Apache2.4

The operating system my web server runs on is (include version): Linux

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): 0.30.2

But the Web-Service is reachable from the internet via port 80. (At least when I try to get the cert 😉 I do not see any FW problems. What can I check next?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 10, 2019, 3:23pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/2 "2019-07-10T15:23:00Z")

</div>

Hi @hjfh

> [@hjfh](#):
>
> My domain is: [campo-randale.de](http://campo-randale.de)

is this your domain? If yes, that domain is parked, so you can't create a certificate.

If no, please share your domain name.

---

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 10, 2019, 3:28pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/3 "2019-07-10T15:28:02Z")

</div>

> [@JuergenAuer](#):
>
> Hi @hjfh
> 
> > My domain is: [campo-randale.de](http://campo-randale.de)
> 
> is this your domain? If yes, that domain is parked, so you can’t create a certificate.
> 
> If no, please share your domain name.

? Yes, this is my domain. Why you think it is parked? I can access the host [crbox.campo-randale.de](http://crbox.campo-randale.de) via http. But the FW permit https, too. (just in the moment the FW drops the connections)

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 10, 2019, 3:41pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/4 "2019-07-10T15:41:13Z")

</div>

Checked the main domain, the result is curious ( [https://check-your-website.server-daten.de/?q=campo-randale.de](https://check-your-website.server-daten.de/?q=campo-randale.de) ):

| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://campo-randale.de/](http://campo-randale.de/) | | | | |
| 217.160.157.99 | 403 | | 0.057 | M |
| Forbidden | | | | |
| | | | | |
| • [http://www.campo-randale.de/](http://www.campo-randale.de/) | | | | |
| 217.160.157.99 | 403 | | 0.053 | M |
| Forbidden | | | | |
| | | | | |
| • [https://campo-randale.de/](https://campo-randale.de/) | | | | |
| 217.160.157.99 | -4 | | 0.080 | W |
| SendFailure - The underlying connection was closed: An unexpected error occurred on a send. The handshake failed due to an unexpected packet format. | | | | |
| | | | | |
| • [https://www.campo-randale.de/](https://www.campo-randale.de/) | | | | |
| 217.160.157.99 | -4 | | 0.080 | W |
| SendFailure - The underlying connection was closed: An unexpected error occurred on a send. The handshake failed due to an unexpected packet format. | | | | |
| | | | | |
| • [http://campo-randale.de:443/](http://campo-randale.de:443/) | | | | |
| 217.160.157.99 | 403 | | 0.053 | Q |
| Forbidden | | | | |
| Visible Content: | | | | |
| | | | | |
| • [http://www.campo-randale.de:443/](http://www.campo-randale.de:443/) | | | | |
| 217.160.157.99 | 403 | | 0.050 | Q |
| Forbidden | | | | |
| Visible Content: | | | | |
| | | | | |
| • [http://campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 217.160.157.99 | 300 | | 0.047 | |
| Visible Content: Multiple Choices The document name you requested ( /.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de ) could not be found on this server. However, we found documents with names similar to the one you requested. Available documents: /./acme-challenge/check-your-website-dot-server-daten-dot-de (common basename) /…/acme-challenge/check-your-website-dot-server-daten-dot-de (common basename) | | | | |
| | | | | |
| • [http://www.campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://www.campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 217.160.157.99 | 300 | | 0.044 | |
| Visible Content: Multiple Choices The document name you requested ( /.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de ) could not be found on this server. However, we found documents with names similar to the one you requested. Available documents: /./acme-challenge/check-your-website-dot-server-daten-dot-de (common basename) /…/acme-challenge/check-your-website-dot-server-daten-dot-de (common basename) | | | | |

https has a typical error, so the tool checks http over port 443.

Checked that url manual, there is

```auto
<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8">
        <style type="text/css">
            html, body, #partner, iframe {
                height:100%;
                width:100%;
                margin:0;
                padding:0;
                border:0;
                outline:0;
                font-size:100%;
                vertical-align:baseline;
                background:transparent;
            }
            body {
                overflow:hidden;
            }
        </style>
        <meta content="NOW" name="expires">
        <meta content="index, follow, all" name="GOOGLEBOT">
        <meta content="index, follow, all" name="robots">
        <!-- Following Meta-Tag fixes scaling-issues on mobile devices -->
        <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport">
    </head>
    <body>
        <div id="partner"></div>
        <script type="text/javascript">
            document.write(
                    '<script type="text/javascript" language="JavaScript"'
                            + 'src="//sedoparking.com/frmpark/'
                            + window.location.host + '/'
                            + 'IONOSParkingDE'
                            + '/park.js">'
                    + '<\/script>'
            );
        </script>
    </body>
</html>

```

a sedoparking included.

And critical: /.well-known/acme-challenge sends a multiple choice, so it looks that you can’t use http-01 validation.

Now checking the subdomain - crbox

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 10, 2019, 3:45pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/5 "2019-07-10T15:45:46Z")

</div>

Ah, your main domain is hosted via 1&1 ( [https://check-your-website.server-daten.de/?q=campo-randale.de](https://check-your-website.server-daten.de/?q=campo-randale.de) ):

| Host | T | IP-Address | is auth. | ∑ Queries | ∑ Timeout |
| --- | --- | --- | --- | --- | --- |
| [campo-randale.de](http://campo-randale.de) | A | 217.160.157.99 Karlsruhe/Baden-Württemberg/Germany (DE) - 1&1 Internet SE Hostname: [campo-randale.net](http://campo-randale.net) | yes | 1 | 0 |
| | AAAA | | yes | | |
| [www.campo-randale.de](http://www.campo-randale.de) | A | 217.160.157.99 Karlsruhe/Baden-Württemberg/Germany (DE) - 1&1 Internet SE Hostname: [campo-randale.net](http://campo-randale.net) | yes | 1 | 0 |
| | AAAA | | yes | | |

Your subdomain - looks like a home server ( [https://check-your-website.server-daten.de/?q=crbox.campo-randale.de](https://check-your-website.server-daten.de/?q=crbox.campo-randale.de) ):

| Host | T | IP-Address | is auth. | ∑ Queries | ∑ Timeout |
| --- | --- | --- | --- | --- | --- |
| [crbox.campo-randale.de](http://crbox.campo-randale.de) | A | 195.145.32.219 Gelnhausen/Hesse/Germany (DE) - Deutsche Telekom AG No Hostname found | yes | 1 | 0 |
| | AAAA | | yes | | |
| [www.crbox.campo-randale.de](http://www.crbox.campo-randale.de) | | Name Error | yes | 1 | 0 |

And there are only timeouts:

| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://crbox.campo-randale.de/](http://crbox.campo-randale.de/) | | | | |
| 195.145.32.219 | -14 | | 10.026 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [https://crbox.campo-randale.de/](https://crbox.campo-randale.de/) | | | | |
| 195.145.32.219 | -14 | | 10.026 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [http://crbox.campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://crbox.campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 195.145.32.219 | -14 | | 10.030 | T |
| Timeout - The operation has timed out | | | | |
| Visible Content: | | | | |

If you see the subdomain internal, your http works.

Port forwarding correct? Extern port 80 -\> intern port 80.

Firewall?

A working port 80 is required to use http-01 validation.

---

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 10, 2019, 3:52pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/6 "2019-07-10T15:52:07Z")

</div>

> [@JuergenAuer](#):
>
> If you see the subdomain internal, your http works.
> 
> Port forwarding correct? Extern port 80 -\> intern port 80.
> 
> Firewall?
> 
> A working port 80 is required to use http-01 validation.

Yes, when I enable the redirection I can access the website from the internet. I is enabled now.

Are there special hints to do when the site is hosted as a vhost in apache?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 10, 2019, 4:23pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/7 "2019-07-10T16:23:13Z")

</div>

> [@hjfh](#):
>
> Yes, when I enable the redirection I can access the website from the internet. I is enabled now.

Yep, now your port 80 works:

| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://crbox.campo-randale.de/](http://crbox.campo-randale.de/) | | | | |
| 195.145.32.219 | 200 | | 0.054 | H |
| | | | | |
| • [https://crbox.campo-randale.de/](https://crbox.campo-randale.de/) | | | | |
| 195.145.32.219 | -4 | | 0.094 | W |
| SendFailure - The underlying connection was closed: An unexpected error occurred on a send. The handshake failed due to an unexpected packet format. | | | | |
| | | | | |
| • [http://crbox.campo-randale.de:443/](http://crbox.campo-randale.de:443/) | | | | |
| 195.145.32.219 | 403 | | 0.054 | Q |
| Forbidden | | | | |
| Visible Content: Access forbidden! You don't have permission to access the requested directory. There is either no index document or the directory is read-protected. If you think this is a server error, please contact the webmaster . Error 403 [crbox.campo-randale.de](http://crbox.campo-randale.de) Apache | | | | |
| | | | | |
| • [http://crbox.campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://crbox.campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 195.145.32.219 | 404 | | 0.053 | A |
| Not Found | | | | |

That's the expected result: Port 80 is open and answers with the http status 404 - Not Found checking a file in /.well-known/acme-challenge.

So http-validation should work.

Certbot creates a file in /.well-known/acme-challenge, Letsencrypt checks that file.

---

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 10, 2019, 4:29pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/8 "2019-07-10T16:29:34Z")

</div>

> [@JuergenAuer](#):
>
> | • [http://crbox.campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://crbox.campo-randale.de/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
> | --- | --- | --- | --- | --- |
> | 195.145.32.219 | 404 | | 0.053 | A |
> | Not Found | | | | |
> 
> That’s the expected result: Port 80 is open and answers with the http status 404 - Not Found checking a file in /.well-known/acme-challenge.
> 
> So http-validation should work.
> 
> Certbot creates a file in /.well-known/acme-challenge, Letsencrypt checks that file.

Fine ... now you found what I try to described: Web-service ist running but cerbot failed ...

Should the file in acme-challenge stay if the certbot throws the reported error message? There is no .well-known directory at my host ...

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 10, 2019, 4:30pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/9 "2019-07-10T16:30:42Z")

</div>

Then your configuration may be buggy.

What says

```auto
apachectl -S

```

---

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 10, 2019, 4:43pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/10 "2019-07-10T16:43:40Z")

</div>

VirtualHost configuration:  
192.168.252.148:80 [crbox.campo-randale.de](http://crbox.campo-randale.de) (/etc/apache2/vhosts.d/crbox\_campo-randale\_de.conf:13)  
ServerRoot: “/srv/www”  
Main DocumentRoot: “/srv/www/htdocs”  
Main ErrorLog: “/var/log/apache2/error\_log”  
Mutex ssl-stapling: using\_defaults  
Mutex ssl-cache: using\_defaults  
Mutex default: dir="/run/" mechanism=default  
Mutex mpm-accept: using\_defaults  
Mutex ssl-stapling-refresh: using\_defaults  
Mutex rewrite-map: using\_defaults  
PidFile: “/var/run/httpd.pid”  
Define: SYSCONFIG  
Define: SSL  
Define: DUMP\_VHOSTS  
Define: DUMP\_RUN\_CFG  
User: name=“wwwrun” id=473  
Group: name=“www” id=476

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 10, 2019, 4:54pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/11 "2019-07-10T16:54:42Z")

</div>

What's the content of

> [@hjfh](#):
>
> /etc/apache2/vhosts.d/crbox\_campo-randale\_de.conf

Is there a DocumentRoot (without any additional location definitions)? If yes, use --webroot instead of --apache.

```nohighlight
certbot run -a webroot -i apache -w yourDocumentRoot -d crbox.campo-randale.de

```

---

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 10, 2019, 5:01pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/12 "2019-07-10T17:01:21Z")

</div>

> [@JuergenAuer](#):
>
> Is there a DocumentRoot (without any additional location definitions)? If yes, use --webroot instead of --apache.

Indeed there is a DocumentRoot for this vhost. But the comment line:  
certbot -i apache -w /srv/www/htdocs/vhosts/crbox\_campo-randale\_de/nextcloud -d [crbox.campo-randale.de](http://crbox.campo-randale.de) give the same result...

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 10, 2019, 5:11pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/13 "2019-07-10T17:11:49Z")

</div>

> [@hjfh](#):
>
> certbot -i apache -w /srv/www/htdocs/vhosts/crbox\_campo-randale\_de/nextcloud

There is no -a webroot parameter, so it's the same command as `--apache`.

---

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 10, 2019, 5:13pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/14 "2019-07-10T17:13:39Z")

</div>

Sorry typo,  
has to be:

certbot run -a webroot -i apache -w …

(No copy &Paste at this terminal 😉

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 10, 2019, 6:17pm UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/15 "2019-07-10T18:17:21Z")

</div>

Then this

> [@hjfh](#):
>
> /srv/www/htdocs/vhosts/crbox\_campo-randale\_de/nextcloud

is wrong.

Create the two subdirectories

```nohighlight
/srv/www/htdocs/vhosts/crbox_campo-randale_de/nextcloud/.well-known/acme-challenge

```

there a file (file name 1234), then try to load that file via

```nohighlight
http://crbox.campo-randale.de/.well-known/acme-challenge/1234

```

And share the content of the config file.

---

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 11, 2019, 7:08am UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/16 "2019-07-11T07:08:30Z")

</div>

The file 1234 is then readable via Browser. (Hm, I have to stop access to the file system via apache later …)

Wich config file did you point? vhost?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 11, 2019, 7:12am UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/17 "2019-07-11T07:12:20Z")

</div>

> [@hjfh](#):
>
> Wich config file did you point? vhost?

The content of that file.

> [@hjfh](#):
>
> /etc/apache2/vhosts.d/crbox\_campo-randale\_de.conf:13

Your /1234 file works, so webroot should work.

---

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 11, 2019, 7:17am UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/18 "2019-07-11T07:17:17Z")

</div>

This is the result :-\

> # certbot run -a webroot -i apache -w /srv/www/htdocs/vhosts/crbox\_campo-randale\_de/nextcloud/ -d [crbox.campo-randale.de](http://crbox.campo-randale.de)
> 
> Saving debug log to /var/log/letsencrypt/letsencrypt.log  
> Plugins selected: Authenticator webroot, Installer apache  
> Obtaining a new certificate  
> Performing the following challenges:  
> http-01 challenge for [crbox.campo-randale.de](http://crbox.campo-randale.de)  
> Using the webroot path /srv/www/htdocs/vhosts/crbox\_campo-randale\_de/nextcloud for all unmatched domains.  
> Waiting for verification...  
> Cleaning up challenges  
> Failed authorization procedure. [crbox.campo-randale.de](http://crbox.campo-randale.de) (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [http://crbox.campo-randale.de/.well-known/acme-challenge/k57egdNMux2iLORNvVLbyE1Rmq46aGD-FuOnagvCDOU:](http://crbox.campo-randale.de/.well-known/acme-challenge/k57egdNMux2iLORNvVLbyE1Rmq46aGD-FuOnagvCDOU:) Timeout during connect (likely firewall problem)
> 
> IMPORTANT NOTES:
> 
> - The following errors were reported by the server:

the vhost.conf is available at the web [http://crbox.campo-randale.de/crbox\_campo-randale\_de.conf](http://crbox.campo-randale.de/crbox_campo-randale_de.conf)

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [July 11, 2019, 8:31am UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/19 "2019-07-11T08:31:42Z")

</div>

> [@hjfh](#):
>
> Fetching [http://crbox.campo-randale.de/.well-known/acme-challenge/k57egdNMux2iLORNvVLbyE1Rmq46aGD-FuOnagvCDOU:](http://crbox.campo-randale.de/.well-known/acme-challenge/k57egdNMux2iLORNvVLbyE1Rmq46aGD-FuOnagvCDOU:) Timeout during connect (likely firewall problem)

Your server is online - [https://check-your-website.server-daten.de/?q=crbox.campo-randale.de](https://check-your-website.server-daten.de/?q=crbox.campo-randale.de) - why sees Letsencrypt a timeout?

Is there a blocking firewall with regional settings? So the online tool can see your site, Letsencrypt not?

---

<div class="post-metadata">

**Author:** ![hjfh](https://avatars.discourse-cdn.com/v4/letter/h/b487fb/32.png) [@hjfh](https://community.letsencrypt.org/u/hjfh)\
**Post date:** [July 11, 2019, 8:35am UTC](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593/20 "2019-07-11T08:35:52Z")

</div>

Oops … 😟  
Indeed, I have some filtered regions … But I have never seen a problem with it …  
OK, wich IPs are neccessary to play with letsencrypt?

[Next page](https://community.letsencrypt.org/t/obtain-first-certificate-timeout/97593.md?page=2)