# Renewal of certs fail **URL:** \ **Category:** Help\ **Created:** [August 7, 2024, 1:51pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122 "2024-08-07T13:51:03Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![tinohendricks](https://avatars.discourse-cdn.com/v4/letter/t/c37758/32.png) [@tinohendricks](https://community.letsencrypt.org/u/tinohendricks)\ **Post date:** [August 7, 2024, 1:51pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/1 "2024-08-07T13:51:03Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [burg.tinohendricks.de](http://burg.tinohendricks.de) I ran this command: certbot renew I also tried: certbot certonly --webroot -w /var/www/html -d [burg.tinohendricks.de](http://burg.tinohendricks.de) It produced this output: Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems: Domain: [burg.tinohendricks.de](http://burg.tinohendricks.de) Type: connection Detail: During secondary validation: 217.235.241.94: Fetching [http://burg.tinohendricks.de/.well-known/acme-challenge/It4R67m8FsnYresA3BqEr7Wx7nz27ZpYqNTl7EmxXR0:](http://burg.tinohendricks.de/.well-known/acme-challenge/It4R67m8FsnYresA3BqEr7Wx7nz27ZpYqNTl7EmxXR0:) Connection refused My web server is (include version): Apache/2.4.61 (Debian) OpenSSL/3.0.13 The operating system my web server runs on is (include version): Debian bookworm My hosting provider, if applicable, is: My Home, Deutsche Telekom DSL I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no, plain console The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 2.1.0 First I tried the standalone version, now I tried the apache web root challenge several times. Certbot: ```nohighlight Create a file containing just this data: 7ku_mwKFX_be64V87KzzTLasstoBfEramGoJoeBn874.PI6fNo98OdvGmgT2lsQX54ItpGAfpZ6AE9s63o0M-0M And make it available on your web server at this URL: http://burg.tinohendricks.de/.well-known/acme-challenge/7ku_mwKFX_be64V87KzzTLasstoBfEramGoJoeBn874 ``` Did as requested, checked from a server sitting in a hosting company: ```nohighlight wget http://burg.tinohendricks.de/.well-known/acme-challenge/7ku_mwKFX_be64V87KzzTLasstoBfEramGoJoeBn874 --2024-08-07 14:41:26-- http://burg.tinohendricks.de/.well-known/acme-challenge/7ku_mwKFX_be64V87KzzTLasstoBfEramGoJoeBn874 Auflösen des Hostnamens burg.tinohendricks.de (burg.tinohendricks.de)… 217.235.241.94 Verbindungsaufbau zu burg.tinohendricks.de (burg.tinohendricks.de)|217.235.241.94|:80 … verbunden. HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK Länge: 88 Wird in »7ku_mwKFX_be64V87KzzTLasstoBfEramGoJoeBn874« gespeichert. 7ku_mwKFX_be64V87KzzTLasstoBfEramGoJoeBn874 100% ``` Certbot: ```nohighlight Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems: Domain: burg.tinohendricks.de Type: connection Detail: 217.235.241.94: Fetching http://burg.tinohendricks.de/.well-known/acme-challenge/7ku_mwKFX_be64V87KzzTLasstoBfEramGoJoeBn874: Connection refused ``` I' seeing traffic: ```nohighlight 15:43:31.841568 IP6 p200300dc6f1cb900d25099fffeac96b6.dip0.t-ipconnect.de.35070 > g2a02-26f0-e600-0000-0000-0000-48f7-9aa9.deploy.static.akamaitechnologies.com.http: Flags [S], seq 2002761696, win 64440, options [mss 1432,sackOK,TS val 2005076391 ecr 0,nop,wscale 7], length 0 15:43:31.851782 IP6 g2a02-26f0-e600-0000-0000-0000-48f7-9aa9.deploy.static.akamaitechnologies.com.http > p200300dc6f1cb900d25099fffeac96b6.dip0.t-ipconnect.de.35070: Flags [S.], seq 3229599432, ack 2002761697, win 64260, options [mss 1432,sackOK,TS val 3656390914 ecr 2005076391,nop,wscale 7], length 0 15:43:31.851927 IP6 p200300dc6f1cb900d25099fffeac96b6.dip0.t-ipconnect.de.35070 > g2a02-26f0-e600-0000-0000-0000-48f7-9aa9.deploy.static.akamaitechnologies.com.http: Flags [.], ack 1, win 504, options [nop,nop,TS val 2005076401 ecr 3656390914], length 0 ``` and so on. I'm out of ideas. Can I switch to DNS challenge, desperate as I am? Why is it IPv6 traffic but certbot complaining about a IPv4 address? Currently I closed the ports but as you can see they were open when I tried. Thanks for any ideas! ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 7, 2024, 2:11pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/2 "2024-08-07T14:11:53Z")
> [@tinohendricks](#): > > Can I switch to DNS challenge, desperate as I am? Sure. But the problem is that connections to your domain are failing. It would be best to fix that so people will be able to connect to your site. > [@tinohendricks](#): > > Why is it IPv6 traffic but certbot complaining about a IPv4 address? Because Let's Encrypt will retry a failed IPv6 connection with IPv4. But, it only retries the first failed request and not if you redirect the HTTP challenge to HTTPS. I agree it is not clear. [IPv6 Support - Let's Encrypt](https://letsencrypt.org/docs/ipv6-support/#ipv6-to-ipv4-retry-details) > [@tinohendricks](#): > > Currently I closed the ports but as you can see they were open when I tried. Can you leave them open so we can test connections? Does your ISP allow inbound connections on port 80? Is there anything blocking requests from other parts of the world (like outside Germany?) ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [August 7, 2024, 2:18pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/3 "2024-08-07T14:18:40Z")
> [@tinohendricks](#): > > seeing traffic You should be seeing [at least 5](https://community.letsencrypt.org/t/lets-encrypt-is-adding-two-new-remote-perspectives-for-domain-validation/214123) connections. The "secondary validation" in the message you're getting indicates that only some of the checks aren't arriving. So there is some kind of firewall or other networking equipment which is blocking connections from some places. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 7, 2024, 2:27pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/4 "2024-08-07T14:27:02Z")
> [@tinohendricks](#): > > During secondary validation: 217.235.241.94: And yet the name resolves to: ```nohighlight Name: burg.tinohendricks.de Addresses: 2003:dc:6f1c:b900:d250:99ff:feac:96b6 217.235.241.94 ``` As such, LE would prefer the IPv6 address. So, it seems that IPv6 is completely blocked and IPv4 is only partially accessible. ---
**Author:** ![tinohendricks](https://avatars.discourse-cdn.com/v4/letter/t/c37758/32.png) [@tinohendricks](https://community.letsencrypt.org/u/tinohendricks)\ **Post date:** [August 7, 2024, 2:31pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/5 "2024-08-07T14:31:17Z")
Hi Mike, thank you so much for taking your time! The main purpose of the server is local network so the ports are normally closed. I opened them now, please check again. (Looks ok to me). When I started certbot standalone I watched the output of `netstat` seeing that there was only one process listening to tcp6 :::80. No one listening on IPv4. I tried ` certbot renew --dry-run --http-01-address `. Then there was a listening socket on the IPv4 address – but none on IPv6. How do I switch to DNS challenge? There is no firewall involved on my end. If Deutsche Telekom ( **the** national Telcom in Germany) blocks traffic from Let's Encrypt servers there would be many more people having the same problem. ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [August 7, 2024, 2:34pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/6 "2024-08-07T14:34:17Z")
Well, it looks like it's only accessible from some places around the world. > **[Check website performance and response : Check host - online website monitoring](https://check-host.net/check-report/1ce4e463k3dd)** > > Website checking for speed and availability with servers around the world: > website monitoring with useful tools, Check IP, Check website ---
**Author:** ![tinohendricks](https://avatars.discourse-cdn.com/v4/letter/t/c37758/32.png) [@tinohendricks](https://community.letsencrypt.org/u/tinohendricks)\ **Post date:** [August 7, 2024, 2:36pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/7 "2024-08-07T14:36:12Z")
Wow, so I need to yell at the Deutsche Telekom... Unbelievable... I'm sure they'll come up with "... uuuh, consumer product... not meant for..." 🤨 ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 7, 2024, 2:46pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/8 "2024-08-07T14:46:16Z")
Interestingly I can connect from an Amazon AWS region on the US East Coast but only using IPv6. Many of Let's Encrypt's auth servers are also in AWS but not all and not all are in the USA It is not unusual for a residential ISP to block IPv4 for port 80. Could they be using CGNAT? ```nohighlight curl -i6 -m6 http://burg.tinohendricks.de/.well-known/acme-challenge/TEst404 HTTP/1.1 404 Not Found Server: Apache/2.4.61 (Debian) Content-Length: 283 (other data omitted) curl -i4 -m6 http://burg.tinohendricks.de/.well-known/acme-challenge/TEst404 curl: (7) Failed to connect to burg.tinohendricks.de port 80 after 180 ms: Connection refused ``` ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [August 7, 2024, 2:47pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/9 "2024-08-07T14:47:54Z")
> [@tinohendricks](#): > > How do I switch to DNS challenge? So assuming that your DNS is publicly available and not similarly limited in global access, you would need a plugin for certbot (or use some other client) for your DNS server that has credentials to automatically update a TXT record for your domain. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 7, 2024, 2:53pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/10 "2024-08-07T14:53:11Z")
I don't see a plugin for afraid DNS with Certbot, lego, or acme.sh which are all popular ACME Clients You may have to use the `--manual --preferred-challenges dns` method in Certbot and be stuck with manual renewals. You said this was for internal server so maybe not important that world-wide HTTP(s) traffic won't work ---
**Author:** ![tinohendricks](https://avatars.discourse-cdn.com/v4/letter/t/c37758/32.png) [@tinohendricks](https://community.letsencrypt.org/u/tinohendricks)\ **Post date:** [August 7, 2024, 2:56pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/11 "2024-08-07T14:56:32Z")
Yes, I can do it manually every 3 months, no problem. Keeps my fingers fit! 😉 Thank you all so much for your incredibly fast and competent help! I'm glad my company donated to LE already. 🫶 ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 7, 2024, 2:59pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/12 "2024-08-07T14:59:07Z")
> [@tinohendricks](#): > > Yes, I can do it manually every 3 months Let's Encrypt recommend every 2 months but 2.5 probably fine in your case. Waiting until last day doesn't give any time to deal with problems (LE might even be down) ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [August 7, 2024, 3:00pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/13 "2024-08-07T15:00:15Z")
> [@MikeMcQ](#): > > I don't see a plugin for afraid DNS with Certbot, lego, or acme.sh which are all popular ACME Clients The afraid dns website links to a plugin for acme.sh for it. > **[FreeDNS FAQ](https://freedns.afraid.org/faq/#17)** > > Free DNS hosting, lets you fully manage your own domain. Dynamic DNS and Static DNS services available. You may also create hosts off other domains that we host upon the domain owners consent, we have several domains to choose from! ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 7, 2024, 3:01pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/14 "2024-08-07T15:01:50Z")
Ah, I was looking for something named afraid not freedns - good catch ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 6, 2024, 3:02pm UTC](https://community.letsencrypt.org/t/renewal-of-certs-fail/223122/15 "2024-09-06T15:02:23Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.