Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: mikrocosmos.in
I ran this command:sudo certbot certonly -d mikrocosmos.in --nginx --dry-run --debug-challenge -v
It produced this output:Fetching http://mikrocosmos.in/.well-known/acme-challenge/aPSTVAvx3ZzZwnn6NF-szjqpfX0ZVGsUvzwqCL8EaEg: Timeout during connect (likely firewall problem)
My web server is (include version): Nginx 1.30.3
The operating system my web server runs on is (include version): Ubuntu 26.04 LTS
My hosting provider, if applicable, is: GoDaddy
I can login to a root shell on my machine (yes or no, or I don't know): Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 5.6.0
My ufw is set to allow all requests on port 80 and 443, i ran certbot with --debug challenge -v, and before pressing enter i visited
http://mikrocosmos.in/.well-known/acme-challenge/aPSTVAvx3ZzZwnn6NF-szjqpfX0ZVGsUvzwqCL8EaEg
and found the expected value, but certbot still returned with Fetching http://mikrocosmos.in/.well-known/acme-challenge/aPSTVAvx3ZzZwnn6NF-szjqpfX0ZVGsUvzwqCL8EaEg: Timeout during connect (likely firewall problem)
Can someone help?
Thank you!
Hello @tron989,
Using the online tool Let's Debug yields these results https://letsdebug.net/mikrocosmos.in/3028567
And from around the world I see "Connection timed out" here Permanent link to this check report.
Please check your firewalls and routers to make sure connectivity to Port 80 is available from the Internet, not just from your local network.
Thank you for the tools.
I don't know what is blocking the TCP port 80 on my server, while the UDP port 80 is open.
I've finally used the manual DNS validation to get the certificate.
You may need to speak with your ISP. I don't see UDP requests working either. Perhaps they block port 80 or are using CGNAT for that.
Looks like GoDaddy is your DNS provider. They allow API calls (link here) which can support automated DNS Challenges. Certbot only supports that with a 3rd party DNS plugin which doesn't seem to support a snap install (just pip). But, other ACME Clients support it directly like lego: Go Daddy :: ACME client and library written in Go.
# TCP to port 443 works fine
sudo traceroute -T -p443 mikrocosmos.in
traceroute to mikrocosmos.in (122.179.31.92), 30 hops max, 60 byte packets
1 242.5.235.5 (242.5.235.5) 5.939 ms 242.5.234.1 (242.5.234.1) 18.310 ms 242.5.234.129 (242.5.234.129) 18.301 ms
2 151.148.10.176 (151.148.10.176) 6.874 ms 6.384 ms 7.391 ms
3 151.148.10.177 (151.148.10.177) 6.159 ms 6.150 ms 6.140 ms
4 116.119.112.73 (116.119.112.73) 269.435 ms 268.801 ms 281.156 ms
5 125.23.102.74 (125.23.102.74) 249.732 ms 248.302 ms 249.714 ms
6 abts-kk-dynamic-092.31.179.122.airtelbroadband.in (122.179.31.92) 285.337 ms 253.276 ms 285.237 ms
7 abts-kk-dynamic-092.31.179.122.airtelbroadband.in (122.179.31.92) 264.134 ms 268.975 ms 284.962 ms
# TCP fails to port 80
sudo traceroute -T -p80 mikrocosmos.in
traceroute to mikrocosmos.in (122.179.31.92), 30 hops max, 60 byte packets
1 242.5.234.3 (242.5.234.3) 6.328 ms 242.5.234.1 (242.5.234.1) 8.292 ms 242.5.234.7 (242.5.234.7) 5.929 ms
2 151.148.10.176 (151.148.10.176) 7.557 ms 6.458 ms 7.005 ms
3 151.148.10.177 (151.148.10.177) 5.741 ms 5.784 ms 5.850 ms
4 116.119.112.73 (116.119.112.73) 270.375 ms 270.484 ms 269.697 ms
(nothing further)
# UDP fails to port 80
sudo traceroute -U -p80 mikrocosmos.in
traceroute to mikrocosmos.in (122.179.31.92), 30 hops max, 60 byte packets
1 242.5.235.133 (242.5.235.133) 5.851 ms 242.5.234.1 (242.5.234.1) 5.763 ms 242.5.235.1 (242.5.235.1) 6.807 ms
2 151.148.10.176 (151.148.10.176) 6.911 ms 7.374 ms 6.383 ms
3 151.148.10.177 (151.148.10.177) 5.834 ms 5.820 ms 5.751 ms
4 116.119.112.73 (116.119.112.73) 250.595 ms 283.577 ms 270.204 ms
5 125.23.102.74 (125.23.102.74) 249.630 ms 265.604 ms 265.620 ms
(nothing further)
Hi @tron989,
I also found this a bit unusual SSL Server Test: mikrocosmos.in (Powered by Qualys SSL Labs)
One certificate for mikrocosmos.in and a separate certificate for the wildcard *.mikrocosmos.in
