Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
It produced this output:
An unexpected error occurred:
requests.exceptions.SSLError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))
My web server is (include version):
The operating system my web server runs on is (include version):
Apple iMac M1
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 2.7.2
That's not the error message for a blocked IP address.
Your system is not validating the Let's Encrypt ACME APIs certificate properly. This may be due to outdated Python packages (e.g. request) or perhaps an outdated OpenSSL. Or someone is doing a Man-in-the-Middle attack on the API and providing a fake certificate, hard to tell.
You could check what happens when you try openssl s_client -connect acme-v02.api.letsencrypt.org:443 -servername acme-v02.api.letsencrypt.org, assuming this is available on a Mac.
It seems like your MAC OS is a bit outdated.
If it can be updated, that would be my first choice.
If not, you could try obtaining a cert from another free CA.
The macos was recently updated to Sonoma 14.1. The system is upto date. I also did the brew update to bring all applications inline with the OS upgrade.
OpenSSL will continu even with warning/errors. You can see the same warning:
So your Mac doesn't have the ISRG Root X1 certificate in its root store. It's included since macOS >= 10.12.1. What version are you running on your Apple iMac M1?
I have downloaded the ISRG Root X1 certificate and added it to the keychain. Certbot still returns the SSL error. I downloaded the Cross signed certs for X1 and X2. Are these the right ones to download?
Openssl appears to be fine. All applications using openssl seem to be working fine too, except certbot of course.
I downloaded the root self signed certs and imported them into the keychain. But the result is the same when l run certbot.
$ nmap -Pn -p80,443 praten.tplinkdns.com
Starting Nmap 7.80 ( https://nmap.org ) at 2023-11-01 16:51 UTC
Nmap scan report for praten.tplinkdns.com (82.26.204.145)
Host is up.
rDNS record for 82.26.204.145: cpc89010-gill18-2-0-cust3216.20-1.cable.virginm.net
PORT STATE SERVICE
80/tcp filtered http
443/tcp filtered https
Nmap done: 1 IP address (1 host up) scanned in 3.52 seconds
There seem to be no open ports for the FQDN praten.tplinkdns.com
The error message concerns outbound call to lets encrypt. It has worked before with the current configuration. Or am l missing something? Do l need to open ports now Lets encrypt has moved their hosting?
