# Unable to create new certificate for web page in Synology **URL:** \ **Category:** Help\ **Created:** [August 18, 2023, 5:39am UTC](https://community.letsencrypt.org/t/unable-to-create-new-certificate-for-web-page-in-synology/203745 "2023-08-18T05:39:57Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ajaimes](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@ajaimes](https://community.letsencrypt.org/u/ajaimes)\ **Post date:** [August 18, 2023, 5:39am UTC](https://community.letsencrypt.org/t/unable-to-create-new-certificate-for-web-page-in-synology/203745/1 "2023-08-18T05:39:57Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: `cerebral.cua.uam.mx` I ran this command: `syno-letsencrypt new-cert -d cerebral.cua.uam.mx -vv` It produced this output: ```plaintext DNS problem: query timed out looking up A for cerebral.cua.uam.mx; DNS problem: query timed out looking up AAAA for cerebral.cua.uam.mx" DEBUG: Failed to do challenge for cerebral.cua.uam.mx with type http-01. DEBUG: close port 80. ``` My web server is (include version): `nginx/1.20.1` The operating system my web server runs on is (include version): `DSM 7.1.1-42962` My hosting provider, if applicable, is: -- I can login to a root shell on my machine (yes or no, or I don't know): `yes` I'm using a control panel to manage my site (no, or provide the name and version of the control panel): `no` The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): -- Hello everyone, I am not an expert in web page configuration. However, some years ago I was able to get a certificate for my web page hosted in my Synology NAS. Recently I tried to get a new certificate for a NEW domain (cerebral.cua.uam.mx) in the same Synology NAS and the same IP. First, I tried the Synology GUI Tool to obtain a LetsEncrypt certificate, but this time I got a message with this error: "`Invalid domain. Please make sure this domain can be resolved into a public IP address`". Also, I tried the following command line from my NAS to get more information: `syno-letsencrypt new-cert -d cerebral.cua.uam.mx -vv` The final lines of the output were: ```plaintext -------- DEBUG: Curl Reply: [200] Header: [HTTP/2 200 server: nginx date: Fri, 18 Aug 2023 04:43:02 GMT content-type: application/json content-length: 672 boulder-requester: 1253688086 cache-control: public, max-age=0, no-cache link: ;rel="index" replay-nonce: v8C-B80Y-_RAhVSObDs_bq28yZqQ9DZJ61K-7uhEFkrhSbbdkD8 x-frame-options: DENY strict-transport-security: max-age=604800 ] Body: [{ "identifier": { "type": "dns", "value": "cerebral.cua.uam.mx" }, "status": "invalid", "expires": "2023-08-25T04:41:39Z", "challenges": [ { "type": "http-01", "status": "invalid", "error": { "type": "urn:ietf:params:acme:error:dns", "detail": "DNS problem: query timed out looking up A for cerebral.cua.uam.mx; DNS problem: query timed out looking up AAAA for cerebral.cua.uam.mx", "status": 400 }, "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/255995631996/Isp0Og", "token": "_JHZpxA2nhjsSNfFk2iRBCSWm1y5jmQBF6WqGvHwSuk", "validated": "2023-08-18T04:42:31Z" } ] }] DEBUG: Failed to do challenge for cerebral.cua.uam.mx with type http-01. DEBUG: close port 80. {"error":109,"file":"client_v2-base.cpp","msg":"Failed to new certificate."} -------- ``` I also ran the LetEncrypt Debugging tool to check the status for the http-01 challenge, and I got: ```plaintext A test authorization for cerebral.cua.uam.mx to the Let's Encrypt staging service has revealed issues that may prevent any certificate for this domain being issued. DNS problem: query timed out looking up A for cerebral.cua.uam.mx; DNS problem: query timed out looking up AAAA for cerebral.cua.uam.mx ``` In some forums, I found that a possible problem was that port 80 was closed in the router or by the ISP. However, from my HOME (different network) I used this website [https://www.yougetsignal.com/tools/open-ports/](https://www.yougetsignal.com/tools/open-ports/) and the result was that port 80 is open. I also used [check-host.net](http://check-host.net) and the result is that my website is accessible through port 80 from several countries: [https://check-host.net/check-http?host=cerebral.cua.uam.mx&csrf\_token=dc2d46888b4b2c8aae0a8cab2295c0ae6869c229](https://check-host.net/check-http?host=cerebral.cua.uam.mx&csrf_token=dc2d46888b4b2c8aae0a8cab2295c0ae6869c229) Finally, I checked the A record for my domain using this page: > **[DNS Lookup - Check All DNS Records for Any Domain](https://dnschecker.org/all-dns-records-of-domain.php?query=cerebral.cua.uam.mx&rtype=ALL&dns=google)** > > Our DNS Lookup tool directly queries the domain's authoritative name server. It let you check all DNS records of a domain. Enter domain, and get results. and the A record is my domain: cerebral.cua.uam.mx I don't know what other configuration in my NAS to check to find out what the problem is. I hope someone here can please help me to find the error. Thanks in advance, Antonio ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 18, 2023, 6:29am UTC](https://community.letsencrypt.org/t/unable-to-create-new-certificate-for-web-page-in-synology/203745/3 "2023-08-18T06:29:30Z")
Hi @ajaimes, and welcome to the LE community forum 🙂 Thanks for all the detailed information. The error is definitely DNS related; As both LE and LetsDebug show the same problem. [cerebral.cua.uam.mx | DNSViz](https://dnsviz.net/d/cerebral.cua.uam.mx/dnssec/) shows: ![warning message image](https://global.discourse-cdn.com/letsencrypt/original/3X/d/6/d6ce878efb9b2fb3d18ed794139d3e34202ded99.png) My guess is that there are DNS server along the path that are not RFC compliant. OR There are firewalls that are blocking some of the networks LE uses for DNS queries. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [August 18, 2023, 7:19am UTC](https://community.letsencrypt.org/t/unable-to-create-new-certificate-for-web-page-in-synology/203745/4 "2023-08-18T07:19:27Z")
> [@rg305](#): > > The error is definitely DNS related; As both LE and LetsDebug show the same problem. Interestingly UnboundTest doesn't have an issue with the DNS configuration: [https://unboundtest.com/m/A/cerebral.cua.uam.mx/VIMK6LIZ](https://unboundtest.com/m/A/cerebral.cua.uam.mx/VIMK6LIZ) ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 18, 2023, 7:28am UTC](https://community.letsencrypt.org/t/unable-to-create-new-certificate-for-web-page-in-synology/203745/5 "2023-08-18T07:28:24Z")
> [@rg305](#): > > OR > There are firewalls that are blocking some of the networks LE uses for DNS queries. OR IPS type devices that don't like the number of requests [per second] that LE/LetsDebug produce. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 18, 2023, 1:01pm UTC](https://community.letsencrypt.org/t/unable-to-create-new-certificate-for-web-page-in-synology/203745/6 "2023-08-18T13:01:28Z")
> [@rg305](#): > > The error is definitely DNS related; As both LE and LetsDebug show the same problem. > [@Osiris](#): > > UnboundTest doesn't have an issue with the DNS Let's Debug's own simple DNS lookup worked fine. But, its test with Let's Encrypt Staging had the same DNS query timeout as Let's Encrypt production in post #1 ([see here](https://letsdebug.net/cerebral.cua.uam.mx/1584984?debug=y)) Unboundtest not only works but is very fast to respond so not showing a reason for a query timeout. > [@rg305](#): > > devices that don't like the number of requests [per second] that LE/LetsDebug produce @ajaimes I agree with @rg305 that this looks a good possibility. I cannot reproduce the query timeout even with repeated requests but Let's Encrypt will issue many more requests and from various world-wide locations. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [August 18, 2023, 1:09pm UTC](https://community.letsencrypt.org/t/unable-to-create-new-certificate-for-web-page-in-synology/203745/7 "2023-08-18T13:09:38Z")
> [@MikeMcQ](#): > > Unboundtest not only works but is very fast to respond so not showing a reason for a query timeout. Maybe some geograpic difference or hosting provider difference? ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 17, 2023, 1:10pm UTC](https://community.letsencrypt.org/t/unable-to-create-new-certificate-for-web-page-in-synology/203745/8 "2023-09-17T13:10:16Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.