Timeout error with Certbot renew

Por favor, complete los campos del siguiente formulario para que podamos ayudarle de la mejor forma posible. Nota: debe proporcionar su nombre de dominio para obtener ayuda. Los nombres de dominio de los certificados emitidos se hacen públicos en los registros de Transparencia de Certificados (por ejemplo, crt.sh | example.com), por lo que esconder aquí su nombre de dominio no sirve de nada, únicamente nos dificulta prestarle la ayuda solicitada.

Puedo leer las respuestas en Inglés (sí o no): Si

Mi dominio es: bienestar.transparencia.edomex.gob.mx

Ejecuté este comando: sudo cerbot renew

Produjo esta salida:

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: bienestar.transparencia.edomex.gob.mx
Type: connection
Detail: 187.189.134.194: Fetching http://bienestar.transparencia.edomex.gob.mx/.well-known/acme-challenge/xfktWrCSanglQzYx9kyuPqxqbOjO3LZZDmZPpMXAdZY: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Failed to renew certificate bienestar.transparencia.edomex.gob.mx with error: Some challenges have failed.


All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/bienestar.transparencia.edomex.gob.mx/fullchain.pem (failure)


1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

Mi servidor web es (incluya la versión):
● apache2.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/apache2.service; enabled; preset: enabled)
Active: active (running) since Wed 2024-10-09 19:45:25 UTC; 1h 1min ago
Docs: Apache HTTP Server Version 2.4 Documentation - Apache HTTP Server Version 2.4
Process: 2378 ExecStart=/usr/sbin/apachectl start (code=exited, status=0/SUCCESS)
Main PID: 2383 (apache2)
Tasks: 11 (limit: 19005)
Memory: 113.1M (peak: 173.0M)
CPU: 19.130s
CGroup: /system.slice/apache2.service
├─2383 /usr/sbin/apache2 -k start
├─2449 /usr/sbin/apache2 -k start
├─2451 /usr/sbin/apache2 -k start
├─2452 /usr/sbin/apache2 -k start
├─2454 /usr/sbin/apache2 -k start
├─2455 /usr/sbin/apache2 -k start
├─2491 /usr/sbin/apache2 -k start
├─2668 /usr/sbin/apache2 -k start
├─2669 /usr/sbin/apache2 -k start
├─2674 /usr/sbin/apache2 -k start
└─2675 /usr/sbin/apache2 -k start

oct 09 19:45:24 nextcloud systemd[1]: Starting apache2.service - The Apache HTTP Server...
oct 09 19:45:25 nextcloud systemd[1]: Started apache2.service - The Apache HTTP Server.

El sistema operativo en el que se ejecuta mi servidor web es (incluya la versión): Ubuntu server 24.04.1 LTS (GNU/Linux 6.8.0-45-generic x86_64)

Mi proveedor de alojamiento web (si aplica) es: n/a

Puedo iniciar una sesión en una shell root en mi servidor (sí, no o no lo sé): si

Estoy usando un panel de control para administrar mi sitio (no o proporcione el nombre y la versión del panel de control): no

La versión de mi cliente es (por ejemplo, si usa certbot, muestre la salida de certbot --version o certbot-auto --version): certbot 2.9.0

1 Like

Welcome to the community @Hims

Have you closed or blocked port 80 since you first got your certificate?

Because the "timeout" error is usually caused by a firewall or maybe a communications config problem.

That port must have been open when you got the original cert. The --apache method requires that.

This is a good site to test this connection

4 Likes

I can confirm that http://bienestar.transparencia.edomex.gob.mx/.well-known/acme-challenge does not connect for me. To use HTTP domain validation you need to allow incoming HTTP requests from around the world, or at least allow /.well-known/acme-challenge/ requests.

2 Likes

Supplemental:

I got "All OK!" Let's Debug results here https://letsdebug.net/bienestar.transparencia.edomex.gob.mx/2250742

Also this certificate was issued "Not Before: Oct 10 22:38:53 2024 GMT" crt.sh | 14881231967
and is presently being served as well https://decoder.link/sslchecker/bienestar.transparencia.edomex.gob.mx/443

I assume this issue is resolved.

3 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.