Sudden renewal failures

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: ankenyschools.org, server is helpdesk.ankenyschools.org

I ran this command: certbot renew --dry-run

It produced this output: Failed to renew, During secondary validation fetching .....acme-challenge Connection refused

My web server is (include version): Apache 2.4.52-lubuntu4.6

The operating system my web server runs on is (include version): Ubuntu 22.04.4 LTS

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.21.0

Hello, I am running apache 2.4.52 on Ubuntu 22.04 LTS. I succesfully set up and having been using certbot since April 2023. However, today I received an auto-renewal failure. It appears my certs successfully updated in February.

In between February and now, nothing has changed on my server configuration, other than regular Operating system updates. That said, I am not an Apache person at all, so it is possible the my configs need cleaning up either way.
I did see the post about increased failures during April, and I'm checking with our network person about geoblocking. Outside of that, I'm not sure what to do.

Thanks for any help, and I'll happily post any files requested.

2

Based on my reading, we temporarily disabled geoblocking at our firewall level and I was able to renew my certificate. While I don't believe this is an elegant solution, it works, so our future solution will be rather than auto-renewing, I'll wait for the failure notification, we'll disable geoblocking temporarily and renew the certs.

Consider this case closed.

3 Likes
3

Hopefully this isn't the Let's Encrypt warning email. Those are sent on a "best efforts" basis and is not recommended as an essential warning.

You could setup your own monitoring of course and if that's what you meant then nevermind :slight_smile:

See if you network firewall can allow just URIs from /.well-known/acme-challenge from anywhere. Another option is to use the DNS Challenge. Although your authoritive DNS Servers must also accept requests world-wide but most do.

4 Likes
4

Consider reputation blocking. Geo Blocking is useful but also harmful for your ultimate goal.

2 Likes
5

Consider geoblocking on ports other than HTTP.
HTTP can be used for ACME renewals and all other connections can be redirected to HTTPS.

4 Likes
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.