# Timeout errors creating new certificate **URL:** \ **Category:** Help\ **Created:** [August 16, 2023, 12:30am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594 "2023-08-16T00:30:50Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![biscotty666](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/biscotty666/32/72764_2.png) [@biscotty666](https://community.letsencrypt.org/u/biscotty666)\ **Post date:** [August 16, 2023, 12:30am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/1 "2023-08-16T00:30:51Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [https://biscotty.online](https://biscotty.online) I ran this command:sudo certbot certonly --dry-run It produced this output: ```plaintext Saving debug log to /var/log/letsencrypt/letsencrypt.log How would you like to authenticate with the ACME CA? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: Runs an HTTP server locally which serves the necessary validation files under the /.well-known/acme-challenge/ request path. Suitable if there is no HTTP server already running. HTTP challenge only (wildcards not supported). (standalone) 2: Saves the necessary validation files to a .well-known/acme-challenge/ directory within the nominated webroot path. A seperate HTTP server must be running and serving files from the webroot path. HTTP challenge only (wildcards not supported). (webroot) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Account registered. Please enter the domain name(s) you would like on your certificate (comma and/or space separated) (Enter 'c' to cancel): biscotty.online, www.biscotty.online Simulating a certificate request for biscotty.online and www.biscotty.online Input the webroot for biscotty.online: (Enter 'c' to cancel): /var/lib/www/biscotty.online Select the webroot for www.biscotty.online: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: Enter a new webroot 2: /var/lib/www/biscotty.online - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems: Domain: biscotty.online Type: connection Detail: 76.127.10.154: Fetching http://biscotty.online/.well-known/acme-challenge/RS88CWc7BhBeBHkmeQNOOc7ocSTkbl_1kCTrJRN5Ipo: Timeout after connect (your server may be slow or overloaded) Domain: www.biscotty.online Type: connection Detail: 76.127.10.154: Fetching http://www.biscotty.online/.well-known/acme-challenge/E8IuezyVN0OkVL1JPIvt1vy9k8dpieNjYpO4AXtS9kM: Timeout after connect (your server may be slow or overloaded) Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet. Some challenges have failed. Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. ``` My web server is (include version): nginx 1.24 The operating system my web server runs on is (include version): NixOS 23.05.2664.9034b46dc4c7 My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 2.4.0 ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 16, 2023, 12:37am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/2 "2023-08-16T00:37:43Z")
Hi @biscotty666, and welcome to the LE community forum 🙂 HTTP [TCP port 80] is required to use HTTP-01 authentication. There appears to be _something_ that _seems_ like it is listening on that port. But there is no web server being heard. ---
**Author:** ![biscotty666](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/biscotty666/32/72764_2.png) [@biscotty666](https://community.letsencrypt.org/u/biscotty666)\ **Post date:** [August 16, 2023, 12:55am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/3 "2023-08-16T00:55:35Z")
Hi, Thanks for the quick reply. The site is live and accessible, which you can verify with `curl -I http://biscotty.online`. So I'm confused. ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [August 16, 2023, 1:00am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/4 "2023-08-16T01:00:35Z")
> [@biscotty666](#): > > Thanks for the quick reply. The site is live and accessible, which you can verify with `curl -I http://biscotty.online`. So I'm confused. If I try curl it opens the connection and hangs. If I try telnet 80 it doesn't respond to `GET`. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 16, 2023, 1:00am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/5 "2023-08-16T01:00:48Z")
> [@biscotty666](#): > > which you can verify with `curl -I http://biscotty.online` But I can't verify that - as I stated: _something seems_ like it is listening on that port. But there is no web server being heard/seen. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 16, 2023, 1:06am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/7 "2023-08-16T01:06:25Z")
Even VirusTotal is unable to complete its' scans in a timely manner: [VirusTotal - Analysing URL](https://www.virustotal.com/gui/url-analysis/u-bb4e6cad0105c5241f3d30edcceb73fcbe36514acccd47981f7b9f4b7c2e52fa-1692147780) click the button [and wait]: ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/5/a/5aceff09b85115e460f52317ef2489d6215ca04f.png) ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [August 16, 2023, 1:07am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/8 "2023-08-16T01:07:40Z")
> [@biscotty666](#): > > `curl -I http://biscotty.online` As always with these things, try it externally because your local network may be working fine. So for instance try access the site over http from your phones mobile data rather than your own wifi. I suspect you have a home or office router and you are supposed to be forwarding port 80 to an internal server IP? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 16, 2023, 1:10am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/9 "2023-08-16T01:10:21Z")
> [@webprofusion](#): > > home or office router Looks like: Comcast [Home Internet] There might also be some sort of "bug-trap" or IPS that isn't doing what you expected. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 16, 2023, 1:14am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/10 "2023-08-16T01:14:12Z")
If `HTTP-01` authentication turns out to be no longer an option for you, you could try using an ACME client that supports `TLS-ALPN-01` authentication. OR Switch to `DNS-01` authentication. [much more "complicated" - but a valid option (if you can get automated)] ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 16, 2023, 1:34am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/11 "2023-08-16T01:34:19Z")
At some point [well beyond 15 minutes connected], this happened: ```plaintext curl -I http://biscotty.online/ curl: (52) Empty reply from server ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 16, 2023, 1:49am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/12 "2023-08-16T01:49:20Z")
I can't reach your domain using HTTP either and neither can the Let's Debug test site But, I do get a response on HTTPS and a self-signed cert. At least that proves some connectivity using port 443 if this is in fact your system > **[Test result for biscotty.online: Error](https://letsdebug.net/biscotty.online/1582370)** > > 2 unique issue(s) detected (ANotWorking, IssueFromLetsEncrypt) ```plaintext openssl s_client -connect biscotty.online:443 subject=O = mkcert development certificate, OU = root@rpi (System administrator) issuer=O = mkcert development CA, OU = root@rpi (System administrator), CN = mkcert root@rpi (System administrator) notBefore=Aug 16 00:02:37 2023 GMT notAfter=Nov 16 00:02:37 2025 GMT serial=A0A07615275814F32EDB81C60036119B SANs: biscotty.online ``` ---
**Author:** ![biscotty666](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/biscotty666/32/72764_2.png) [@biscotty666](https://community.letsencrypt.org/u/biscotty666)\ **Post date:** [August 16, 2023, 2:17am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/13 "2023-08-16T02:17:25Z")
Just tested from off-site and I can access it normally as well. ---
**Author:** ![biscotty666](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/biscotty666/32/72764_2.png) [@biscotty666](https://community.letsencrypt.org/u/biscotty666)\ **Post date:** [August 16, 2023, 2:18am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/14 "2023-08-16T02:18:15Z")
Thank you. ---
**Author:** ![biscotty666](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/biscotty666/32/72764_2.png) [@biscotty666](https://community.letsencrypt.org/u/biscotty666)\ **Post date:** [August 16, 2023, 2:18am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/15 "2023-08-16T02:18:50Z")
This seems most likely. I've never had success with letsencrypt from this location. ---
**Author:** ![biscotty666](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/biscotty666/32/72764_2.png) [@biscotty666](https://community.letsencrypt.org/u/biscotty666)\ **Post date:** [August 16, 2023, 2:20am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/16 "2023-08-16T02:20:10Z")
The site works fine with the self-signed cert. And http works fine. I guess I'll just give up on letsencrypt. Thanks ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 16, 2023, 2:31am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/17 "2023-08-16T02:31:44Z")
> [@biscotty666](#): > > I've never had success with letsencrypt from this location. Do you have a geographic based firewall? We have tried connecting from various sites in the US and, probably Australia with no luck. ---
**Author:** ![biscotty666](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/biscotty666/32/72764_2.png) [@biscotty666](https://community.letsencrypt.org/u/biscotty666)\ **Post date:** [August 16, 2023, 2:39am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/18 "2023-08-16T02:39:56Z")
I'm not aware of having a geographic-based firewall. Perhaps comcast is doing some filtering. ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [August 16, 2023, 2:43am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/19 "2023-08-16T02:43:47Z")
Here is a site you can use to test how others see your site. > **[Geo Browse | Free Country Screenshot Tool](https://geotargetly.com/geo-browse)** > > Free geolocation based screenshot tool to see how your website looks from 80+ countries. Easily capture a screenshot of your website from a selected country! I would suggest trying DNS validation (proving domain control via DNS TXT record) or tls-alpn-01 (validation of TLS on port 443). For standard HTTP validation to work you need your system to be accessible over port 80 from multiple geographic regions. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 16, 2023, 2:57am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/20 "2023-08-16T02:57:22Z")
Could the connectivity problems we have be related to your Sveltekit at all? I am pretty sure we have all been trying things like curl or similar and not actual browsers. A quick read on Sveltekit looks like if not setup right could cause what we are seeing I see these response headers when ignoring the faulty cert on HTTPS ```plaintext curl -Ik https://biscotty.online HTTP/2 200 server: nginx date: Wed, 16 Aug 2023 02:50:02 GMT content-type: text/html content-length: 112607 access-control-allow-origin: * etag: "g11a8o" set-cookie: pb_auth=%7B%22token%22%3A%22%22%2C%22model%22%3Anull%7D; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Strict x-sveltekit-page: true ``` ---
**Author:** ![biscotty666](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/biscotty666/32/72764_2.png) [@biscotty666](https://community.letsencrypt.org/u/biscotty666)\ **Post date:** [August 16, 2023, 3:31am UTC](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594/21 "2023-08-16T03:31:13Z")
Feel free to try it in an actual browser lol. It automatically upgrades to https (where currently you have to accept the self-signed cert to proceed). What you are seeing is expected for the headers. Could the automatic upgrade to https be interfering somehow? [Next page](https://community.letsencrypt.org/t/timeout-errors-creating-new-certificate/203594.md?page=2)