Suddenly can't renew ANY of domains on our server

After 6 months without ANY issues with any of the domain on our dedicated server, suddenly ALL the domain renewals give an error like:

** ‘appbuzzinga.com’*
Invalid response from https://acme-v02.api.letsencrypt.org/acme/new-order.
Details:
Type: urn:ietf:params:acme:error:serverInternal
Status: 500
Detail: Error retrieving account “https://acme-v02.api.letsencrypt.org/acme/acct/75858xxxx {edit}

Our server specs are:
Quad Xeon 32 core with 128Gig RAM running

** OS: ‪CentOS Linux 7.8.2003 (Core)‬*

Can not find a reason for this suddenly happening. NOTE: Cert renewal is run - usually via a cron job - via Plesk (which has letsencrypt extension AND SSLit! extensions installed.) Has renewed every 3 months since December 2019 without problems.

Joe C.

1 Like

This one is probably a database issue on Let’s Encrypt’s side, but you could probably work around it by abandoning your existing Let’s Encrypt account(s) and creating new ones. The accounts in Plesk are stored in /usr/local/psa/var/modules/letsencrypt/registrations/, maybe try temporarily moving them into another location.

2 Likes

Thanks for your input :slight_smile:

I agree that it does look like the error is actually on their side, not our server.

Your suggestion has problems, as the certs involved include the one for the server itself,
and all the sites are production sites.

And to further complicate things, we route all traffic through Cloudflare, and there are acme check entries
in every site DNS. And the Plesk extensions work differently than the CLI - they don’t even use certbot.

All in all, a pain in the arse to ‘work around’ the issue.

If it is a letsencrypt database issue, I suspect a LOT of sites could be affected out there when they
try to renew their certs.

Thanks again. :smiley:
Joe

1 Like

It’s not unheard of for specific Let’s Encrypt accounts to be affected.

The reason I suggest moving your ACME accounts in the Plesk ACME registrations directory is that it has been an effective workaround in the past for this exact error. That is irrespective of what client is being used (Certbot, Plesk, whatever).

If there was a widespread outage affecting Let’s Encrypt, there would be a lot more threads right now.

Anyway, @lestaff might be able to check in their logs why GetRegistration call is failing on their side for your account ID (the unredacted account ID is in edit history), but they might not be available to, so if you can, give the workaround a shot.

3 Likes

This was caused by some database issues we had for a few minutes yesterday, and wasn’t account-specific: https://letsencrypt.status.io/pages/incident/55957a99e800baa4470002da/5ef44c66590ed004bcde051e

Things should be fine now if you try again.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.