# Suddenly getting 'Unable to connect to ACME server' today **URL:** \ **Category:** Help\ **Created:** [May 29, 2025, 2:37pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936 "2025-05-29T14:37:58Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Damo](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Damo](https://community.letsencrypt.org/u/Damo)\ **Post date:** [May 29, 2025, 2:37pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/1 "2025-05-29T14:37:58Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [northardenpcn.co.uk](http://northardenpcn.co.uk) I ran this command: wacs --emailaddress [support@REMOVEDTOAVOIDSPAM.co.uk](mailto:support@REMOVEDTOAVOIDSPAM.co.uk) --accepttos --target manual --host [www.northardenpcn.co.uk](http://www.northardenpcn.co.uk),[northardenpcn.co.uk](http://northardenpcn.co.uk) --manualtargetisiis --validation filesystem --validationmode http-01 --webroot PATHREMOVED\Public --keepexisting --installation iis --siteid 18 --installationsiteid 18 It produced this output: ACME server [https://acme-v02.api.letsencrypt.org/](https://acme-v02.api.letsencrypt.org/) No luck yet, attempting to force TLS 1.2... Unable to connect to ACME server IIS version 10.0 Running with administrator credentials Scheduled task looks healthy Please report issues at [GitHub - win-acme/win-acme: A simple ACME client for Windows (for use with Let's Encrypt et al.)](https://github.com/win-acme/win-acme) Running in mode: Unattended Target generated using plugin Manual: [www.northardenpcn.co.uk](http://www.northardenpcn.co.uk) and 1 alternatives (Win32Exception): The message received was unexpected or badly formatted. Wrapped in AuthenticationException: Authentication failed, see inner exception. Wrapped in HttpRequestException: The SSL connection could not be established, see inner exception. The operating system my web server runs on is (include version):Windows Server 2016 I can login to a root shell on my machine (yes or no, or I don't know): I don't know I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): WACS All working fine until yesterday. One manual cert request failed with the above, then next was fine. Today all fail. Firewall is allowing the traffic out. Could [https://acme-v02.api.letsencrypt.org/](https://acme-v02.api.letsencrypt.org/) be blocking us for some reason? Thanks ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [May 29, 2025, 2:52pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/2 "2025-05-29T14:52:24Z")
Hello @Damo, What kind of error message do they get from this command? ```nohighlight curl https://acme-v02.api.letsencrypt.org/directory ``` ---
**Author:** ![MaxHearnden](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maxhearnden/32/87555_2.png) [@MaxHearnden](https://community.letsencrypt.org/u/MaxHearnden)\ **Post date:** [May 29, 2025, 2:57pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/3 "2025-05-29T14:57:59Z")
You might also need to update win-acme to a more recent version; The "No luck yet, attempting to force TLS 1.2..." message was changed in version 2.1.14 which was released in 2021. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 29, 2025, 2:59pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/4 "2025-05-29T14:59:24Z")
Have you recently had changes to your network configuration? Because HTTP requests on port 80 cannot reach you. See: [Let's Debug](https://letsdebug.net/northardenpcn.co.uk/2461675) And, HTTPS requests connect but with an invalid expired certificate for a different domain name. See: [SSL Checker](https://decoder.link/sslchecker/northardenpcn.co.uk/443) Now, these are inbound requests to you and you are showing a problem with an outbound connection to the Let's Encrypt API server. But, this looks to me like something changed in your system. ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [May 29, 2025, 3:06pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/5 "2025-05-29T15:06:28Z")
> [@MikeMcQ](#): > > Because HTTP requests on port 80 cannot reach you. Yet, interestingly I see this with `curl` ```nohighlight $ curl -Ii http://northardenpcn.co.uk/.well-known/acme-challenge/sometestfile -A "Mozilla/5.0 (compatible; Let's Encrypt v> HTTP/1.1 404 Not Found Content-Length: 1245 Content-Type: text/html Server: Permissions-Policy: accelerometer=() Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' Strict-Transport-Security: max-age=15552000; includeSubdomains Date: Thu, 29 May 2025 15:05:46 GMT ``` ---
**Author:** ![Damo](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Damo](https://community.letsencrypt.org/u/Damo)\ **Post date:** [May 29, 2025, 3:06pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/6 "2025-05-29T15:06:28Z")
> [@Bruce5051](#): > > `curl https://acme-v02.api.letsencrypt.org/directory` curl : The underlying connection was closed: An unexpected error occurred on a receive. At line:1 char:1 - curl [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory) - ```nohighlight + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], We eption + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ``` ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [May 29, 2025, 3:08pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/7 "2025-05-29T15:08:33Z")
And this is what I see using `curl` from the `cmd.exe` prompt with | Edition | Windows 10 Pro | | --- | --- | | Version | 2009 | | Installed on | ‎7/‎14/‎2020 | | OS Build | 19045.5854 | ```nohighlight >curl https://acme-v02.api.letsencrypt.org/directory { "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change", "meta": { "caaIdentities": [ "letsencrypt.org" ], "profiles": { "classic": "https://letsencrypt.org/docs/profiles#classic", "shortlived": "https://letsencrypt.org/docs/profiles#shortlived (not yet generally available)", "tlsserver": "https://letsencrypt.org/docs/profiles#tlsserver" }, "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf", "website": "https://letsencrypt.org" }, "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct", "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce", "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order", "renewalInfo": "https://acme-v02.api.letsencrypt.org/draft-ietf-acme-ari-03/renewalInfo", "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert", "s5PW7zj51Sk": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417" } ``` ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [May 29, 2025, 3:12pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/8 "2025-05-29T15:12:21Z")
> [@Damo](#): > > The underlying connection was closed: I suspect a firewall, or Geo Blocking, TLS mismatch, or routing issue. ---
**Author:** ![Damo](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Damo](https://community.letsencrypt.org/u/Damo)\ **Post date:** [May 29, 2025, 3:28pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/9 "2025-05-29T15:28:33Z")
The firewall does allow http requests on port 80 but only for acme-protocol. I can see some of those being allowed through today. Not sure what Let's Debug is doing. Is there a way to see what IP address Let's Debug was using so I can see if I can find the logs? ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 29, 2025, 3:39pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/10 "2025-05-29T15:39:07Z")
> [@Damo](#): > > --validationmode http-01 Is this the first time for this domain name using HTTP Challenge? Just curious. The cert history for that domain only shows wildcard certs probably issued through Cloudflare Universal SSL. > [@Damo](#): > > Is there a way to see what IP address Let's Debug was using so I can see if I can find the logs? Does your firewall have a log of rejections? It is probably the same source IP as shown by a DNS query of `letsdebug.net` I don't know if L/D rotates its IP or similar but might be that. Do you allow inbound ACME challenges from anywhere? "Home" page requests from certain geo locations redirect 301 just fine. See: [Check website performance and response : Check host - online website monitoring](https://check-host.net/check-report/26e9fc4bk1d8) **Back to the outbound problem** What does this show ```nohighlight curl https://www.cloudflare.com/cdn-cgi/trace ``` ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [May 29, 2025, 3:52pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/11 "2025-05-29T15:52:59Z")
I concur with Mike! 🙂 I definitely believe there is Geo Blocking happening, see here [Permanent link to this check report](https://check-host.net/check-report/26ea206fk477). See this link for way to handle this issue. [Multi-Perspective Validation & Geoblocking FAQ](https://community.letsencrypt.org/t/multi-perspective-validation-geoblocking-faq/218158) ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 29, 2025, 7:25pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/12 "2025-05-29T19:25:59Z")
Split this topic on May 29, 2025, 7:25pm UTC A post was split to a new topic: [Certify the Web Cannot create secure channel error](https://community.letsencrypt.org/t/certify-the-web-cannot-create-secure-channel-error/237952) ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [May 29, 2025, 7:10pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/13 "2025-05-29T19:10:02Z")
Hello @ICND, welcome. 🙂 Please open your own new #Help topic. ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [May 29, 2025, 7:13pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/14 "2025-05-29T19:13:44Z")
while non-intuitive, 'acme-protocol' in FortiGate only means challenge traffic from LE(or other acme CA)'s validation traffic, not your connection to ACME API > **[Reddit - The heart of the internet](https://www.reddit.com/r/fortinet/comments/18hjknd/allow_acme_lets_encrypt_protocol_with_applicaiton/)** I remember this because when they added new class in firewall menu(default blocking) they errored out on challenge not connecting to acme server ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [May 29, 2025, 8:53pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/16 "2025-05-29T20:53:24Z")
@Damo: Based on our discoveries in this [possibly-related issue](https://community.letsencrypt.org/t/certify-the-web-cannot-create-secure-channel-error/237952): Might you have configured your server to limit the enabled cipher suites, either through group policy or through software like "Nartac"? The Let's Encrypt API endpoint recently changed from using RSA to ECDSA, which most systems should support but some over-zealous "hardening" might have disabled ECDSA cipher suites on your server. I'll also second the previous recommendation to make sure you're on the latest version of win-acme. Or you might want to switch to the newer [simple-acme](https://simple-acme.com/) fork. But I don't think that'll help on its own, until you sort out why you can't connect to the Let's Encrypt API. Once you can connect to it, the error message should change if port 80 connectivity inbound to your system is still a problem, as some posters above think might also be a concern. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [May 29, 2025, 9:02pm UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/17 "2025-05-29T21:02:09Z")
Just adding on to @petercooperjr comment. This powershell command should show you the TLS Cipher suites you have enabled. At least, it did on a Windows client machine of mine 🙂 `(get-tlsciphersuite).name` Post the output of that if you need help knowing what to do ---
**Author:** ![Damo](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Damo](https://community.letsencrypt.org/u/Damo)\ **Post date:** [May 30, 2025, 8:24am UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/18 "2025-05-30T08:24:30Z")
> [@MikeMcQ](#): > > (get-tlsciphersuite).name Hi Mike, This sounds like it. Output of that powershell command for us is... TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 Thanks ---
**Author:** ![Damo](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Damo](https://community.letsencrypt.org/u/Damo)\ **Post date:** [May 30, 2025, 8:31am UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/19 "2025-05-30T08:31:11Z")
@Bruce5051 @MikeMcQ Some geoblocking is in place but we've seen and resolved issues with that in the past and not being able reach [https://acme-v02.api.letsencrypt.org/](https://acme-v02.api.letsencrypt.org/) to start the process, even after I unblocked the range for that, was new. I whitelisted the IP for Let's Debug so that reports ok [Let's Debug](https://letsdebug.net/northardenpcn.co.uk/2462395) . It was still not getting a connection. The answer below and in the linked thread about Cipher suites looks the likely culprit, so I'm looking at that now. Thanks for all the quick replies here btw. Great community! ---
**Author:** ![Damo](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Damo](https://community.letsencrypt.org/u/Damo)\ **Post date:** [May 30, 2025, 8:48am UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/20 "2025-05-30T08:48:49Z")
> [@Damo](#): > > TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 > TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 > TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 > TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 The default list of ciphers before we removed anything that SSLLabs said was weak was... TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384,TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256,TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256,TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA,TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA,TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA,TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA,TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384,TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA256,TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256,TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA,TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA,TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA,TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA256,TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256,TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA,TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA,TLS\_DHE\_DSS\_WITH\_3DES\_EDE\_CBC\_SHA They all start with TLS, so none is exactly the same as those in the list in the linked post... ```nohighlight Preferred TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253 Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253 Accepted TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253 Preferred TLSv1.2 128 bits ECDHE-ECDSA-AES128-GCM-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-ECDSA-AES256-GCM-SHA384 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-ECDSA-CHACHA20-POLY1305 Curve 25519 DHE 253 Accepted TLSv1.2 128 bits ECDHE-ECDSA-AES128-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-ECDSA-AES256-SHA384 Curve 25519 DHE 253 ``` ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [May 30, 2025, 10:17am UTC](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936/21 "2025-05-30T10:17:45Z")
Also worth saying that enabling TLS1.2 needs to be done for Server Protocols and Client Protocols, if not already done, and you generally need a reboot to actually apply them after settings them. ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/3/f/3fc7539232f2f5170e045bd47f1052b6396a4ee0.jpeg) Keep in mind also you are performing an **outgoing https (tcp port 443)** call to the Let's Encrypt API. Their HTTP validation is an incoming TCP port 80 connection, and the two are for different parts of the process. [Next page](https://community.letsencrypt.org/t/suddenly-getting-unable-to-connect-to-acme-server-today/237936.md?page=2)