Renew certificate failed due to secondary validation (again)

As noted before, there will be (usually) 4 challenges. There is one primary and the others secondary. The --dry-run option for certbot will show them better. Otherwise, you may not see challenges from previously successful domains for your account as they are cached for 30 days.

sudo certbot renew --dry-run --cert-name (name of certbot cert)

As for location ID, it depends what system you use to look them up. For example, my latest --dry-run test showed 2 US locations, 1 Germany, and one marked Cloudflare using the ipstack.com site.

As noted, these IP's are often rotated by the server farms used and may change as often as hour-to-hour.

You have demonstrated some challenges are not reaching your system. That much is clear. There is either some sort of firewall, maybe even a DDoS protection style firewall, or a very odd network routing problem (maybe within Hetzner even).

The volunteers here do not have access to the LE servers (or their logs) to assist. You may want to re-read the last post in your prior thread which explained from an LE Staff member what they do in such cases.

You could try switching to a different Certificate Authority. Or, try fronting your server with a CDN like Cloudflare and use their Origin CA cert in your server.

10 Likes