# TLS-SNI Challenge Not Passing - LetsEncrypt Unable to Connect **URL:** \ **Category:** Help\ **Created:** [March 29, 2017, 2:18pm UTC](https://community.letsencrypt.org/t/tls-sni-challenge-not-passing-letsencrypt-unable-to-connect/30908 "2017-03-29T14:18:15Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![wizard](https://avatars.discourse-cdn.com/v4/letter/w/a87d85/32.png) [@wizard](https://community.letsencrypt.org/u/wizard)\ **Post date:** [March 29, 2017, 2:18pm UTC](https://community.letsencrypt.org/t/tls-sni-challenge-not-passing-letsencrypt-unable-to-connect/30908/1 "2017-03-29T14:18:15Z")
Please fill out the fields below so we can help you better. My domain is: [w3i3.org](http://w3i3.org) I ran this command: root@apostle:~# letsencrypt --apache -d [w3i3.org](http://w3i3.org) It produced this output:root@tle:~# letsencrypt --apache -d [test.org](http://test.org) Saving debug log to /var/log/letsencrypt/letsencrypt.log Starting new HTTPS connection (1): [acme-v01.api.letsencrypt.org](http://acme-v01.api.letsencrypt.org) Obtaining a new certificate Performing the following challenges: tls-sni-01 challenge for [test.org](http://test.org) Waiting for verification…test Cleaning up challenges Failed authorization procedure. [test.org](http://test.org) (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to 1.1.1.1:443 for TLS-SNI-01 challenge IMPORTANT NOTES: - The following errors were reported by the server: My operating system is (include version): Ubuntu 16.04 My web server is (include version): Apache 2.4.18 root@tle:~# letsencrypt --apache -d [test.org](http://test.org) Saving debug log to /var/log/letsencrypt/letsencrypt.log Starting new HTTPS connection (1): [acme-v01.api.letsencrypt.org](http://acme-v01.api.letsencrypt.org) Obtaining a new certificate Performing the following challenges: tls-sni-01 challenge for [test.org](http://test.org) Waiting for verification…test Cleaning up challenges Failed authorization procedure. [test.org](http://test.org) (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to 1.1.1.1:443 for TLS-SNI-01 challenge IMPORTANT NOTES: - The following errors were reported by the server: IMPORTANT NOTES: - The following errors were reported by the server: My hosting provider, if applicable, is: Self I can login to a root shell on my machine (yes or no, or I don’t know): Yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): Webmin 1.831 ---
**Author:** ![tialaramex](https://avatars.discourse-cdn.com/v4/letter/t/f08c70/32.png) [@tialaramex](https://community.letsencrypt.org/u/tialaramex)\ **Post date:** [March 29, 2017, 3:14pm UTC](https://community.letsencrypt.org/t/tls-sni-challenge-not-passing-letsencrypt-unable-to-connect/30908/2 "2017-03-29T15:14:26Z")
Your existing certificates won’t matter. Self-signed, from a different CA, expired, whatever it doesn’t matter for the ACME challenge code. Normally a certificate is proof of your identity, but the challenge is there to validate your identity anyway, so that’s why it ignores certificates you already have. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 29, 2017, 5:54pm UTC](https://community.letsencrypt.org/t/tls-sni-challenge-not-passing-letsencrypt-unable-to-connect/30908/3 "2017-03-29T17:54:14Z")
This is usually caused by a firewall blocking inbound connections, or by not running Certbot on the same machine as the Apache server. (It could also be caused by Certbot having trouble changing your Apache server’s configuration, perhaps, for example, if you have multiple virtual hosts defined within the same Apache configuration file.) ---
**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\ **Post date:** [April 1, 2017, 10:53am UTC](https://community.letsencrypt.org/t/tls-sni-challenge-not-passing-letsencrypt-unable-to-connect/30908/4 "2017-04-01T10:53:47Z")
hi @wizard I can resolve your domain ![](https://global.discourse-cdn.com/letsencrypt/original/2X/c/c8a2168ff77d266267ecf10de5d7bc32e27bc98d.png) But I can’t connect to it. ![](https://global.discourse-cdn.com/letsencrypt/original/2X/d/dd4d4e64f46f6335d4e9a4c8bb325d62ec8b7f6c.png) If you are fire-walling incoming connections then review this article: Note: certbot works on port 80 and 443 for HTTP and TLS-SNI challenges. LetsEncrypt also does not publish public IPs. Review this conversation: [Letsencrypt-win-simple unable to complete challenges - Firewall Blocking Incoming Requests](https://community.letsencrypt.org/t/letsencrypt-win-simple-unable-to-complete-challenges-firewall-blocking-incoming-requests/30955/2) Andrei ---
**Author:** ![wizard](https://avatars.discourse-cdn.com/v4/letter/w/a87d85/32.png) [@wizard](https://community.letsencrypt.org/u/wizard)\ **Post date:** [April 2, 2017, 3:35am UTC](https://community.letsencrypt.org/t/tls-sni-challenge-not-passing-letsencrypt-unable-to-connect/30908/5 "2017-04-02T03:35:38Z")
I have Apache stopped at the moment, I am transferring several domains to this server and their virtual domains were originally set up under an earlier version of Apache on an earlier version of Ubuntu. A couple of the domains have full certificates, not [w3i3.org](http://w3i3.org). That is the easy part, I am working on it and believe it will all come together. Thanks ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [April 2, 2017, 4:55am UTC](https://community.letsencrypt.org/t/tls-sni-challenge-not-passing-letsencrypt-unable-to-connect/30908/6 "2017-04-02T04:55:20Z")
I can also point out that `--apache` requires that Apache is already running (or at least that it can successfully restart it with `apachectl`). ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 2, 2017, 4:55am UTC](https://community.letsencrypt.org/t/tls-sni-challenge-not-passing-letsencrypt-unable-to-connect/30908/7 "2017-05-02T04:55:54Z")
Closed on May 2, 2017, 4:55am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.