Please help - Unable to renew certificate - fails with error

Help
1

Please help- certificate expiring tomorrow.

CentOS - running nginx

Last week updated the centos using yum update. The certificates are set to renew automatically with crontab and was happily working before the update. Now my crontab has switched back to its default content and when I try the command it fails with error

[root@api ~]# /opt/letsencrypt/letsencrypt-auto renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/api.mydomain.com.conf

Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for api.mydomain.com
Waiting for verification…
Cleaning up challenges
Unable to clean up challenge directory /usr/share/nginx/html/.well-known/acme-challenge
Attempting to renew cert from /etc/letsencrypt/renewal/api.mydomain.com.conf produced an unexpected error: Failed authorization procedure. api.mydomain.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://api.mydomain.com/.well-known/acme-challenge/Eyot1ulsp2IjkJ3kyjUGkUJ5328Fp0mr1oS3AKOVd5w: Timeout. Skipping.

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/api.mydomain.com/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: api.mydomain.com
    Type: connection
    Detail: Fetching
    http://api.mydomain.com/.well-known/acme-challenge/Eyot1ulsp2IjkJ3kyjUGkUJ5328Fp0mr1oS3AKOVd5w:
    Timeout

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you’re using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.
    [root@api ~]#

I can telnet on port 80 to this server.

Couple of other things I have noticed after the update is

  1. Status: Connection attempt failed with “ECONNREFUSED - Connection refused by server”.
  2. The crontab is not the same before the update, it lost all the configs I have made.

Please help

2

Do you have an AAAA record for your domain?

3

Especially since expedience is critical here, posting your actual domain will greatly assist the rest of the community in helping you get this resolved sooner.

4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.