Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:khulisa.com - server failing is proxy.khulisa.com
I ran this command:certbot renew
It produced this output:
Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator nginx, Installer nginx
Attempting to renew cert (tangerine.khulisa.com) from /etc/letsencrypt/renewal/tangerine.khulisa.com.conf produced an unexpected error: Requesting acme-v02.api.letsencrypt.org/directory: Network is unreachable. Skipping.
Processing /etc/letsencrypt/renewal/www.dfbakery.co.za.conf
Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator nginx, Installer nginx
Attempting to renew cert (www.dfbakery.co.za) from /etc/letsencrypt/renewal/www.dfbakery.co.za.conf produced an unexpected error: Requesting acme-v02.api.letsencrypt.org/directory: Network is unreachable. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/tangerine.khulisa.com/fullchain.pem (failure)
/etc/letsencrypt/live/www.dfbakery.co.za/fullchain.pem (failure)
My web server is (include version):nginx version: nginx/1.14.0 (Ubuntu)
The operating system my web server runs on is (include version): Ubuntu 18.04
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don’t know): Yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): certbot 0.31.0
Explanation
I realise this has been posted numerous times but either topic peters out with no conclusion or it is not a solution to my issue. It would appear my server is being denied access to Letsencrypt.
Setup is a Nginx reverse proxy that has 1 site being served directly and 3 servers proxied. About a week ago I got an email stating that one of the proxied sites certs were about to expire. Running a renew produces the above error.
I can’t ping acme-v02.api.letsencrypt.org from the proxy server but I can ping it from one of servers being proxied. Output of ping
root@odk:~#ping acme-v02.api.letsencrypt.org
PING ca80a1adb12a4fbdac5ffcbc944e9a61.pacloudflare.com (172.65.32.248) 56(84) bytes of data.
64 bytes from 172.65.32.248 (172.65.32.248): icmp_seq=1 ttl=58 time=1.89 ms
64 bytes from 172.65.32.248 (172.65.32.248): icmp_seq=2 ttl=58 time=2.03 ms
64 bytes from 172.65.32.248 (172.65.32.248): icmp_seq=3 ttl=58 time=1.99 ms
root@proxy:~# ping acme-v02.api.letsencrypt.org
PING ca80a1adb12a4fbdac5ffcbc944e9a61.pacloudflare.com (172.65.32.248) 56(84) bytes of data.
^C
— ca80a1adb12a4fbdac5ffcbc944e9a61.pacloudflare.com ping statistics —
39 packets transmitted, 0 received, 100% packet loss, time 38899ms
Output of curl
root@odk:~# curl https://acme-v02.api.letsencrypt.org/directory
{
“MRuS7adnlwA”: “Adding random entries to the directory”,
“keyChange”: “https://acme-v02.api.letsencrypt.org/acme/key-change”,
“meta”: {
“caaIdentities”: [
“letsencrypt.org”
],
“termsOfService”: “https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf”,
“website”: “https://letsencrypt.org”
},
“newAccount”: “https://acme-v02.api.letsencrypt.org/acme/new-acct”,
“newNonce”: “https://acme-v02.api.letsencrypt.org/acme/new-nonce”,
“newOrder”: “https://acme-v02.api.letsencrypt.org/acme/new-order”,
“revokeCert”: https://acme-v02.api.letsencrypt.org/acme/revoke-cert
root@proxy:~# curl https://acme-v02.api.letsencrypt.org/directory
curl: (7) Failed to connect to acme-v02.api.letsencrypt.org port 443: Connection timed out
I have tried changing the IP of the Proxy server but it didn’t help. Is there any other info I can provide for assistance?