# Unable to renew cert, to create cert

**URL:** <https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859>\
**Category:** Help\
**Created:** [April 27, 2020, 9:28am UTC](https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859 "2020-04-27T09:28:57Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![aze291](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aze291/32/39271_2.png) [@aze291](https://community.letsencrypt.org/u/aze291)\
**Post date:** [April 27, 2020, 9:28am UTC](https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859/1 "2020-04-27T09:28:57Z")

</div>

Before filling the fields asked, I shall explain what happened.  
I work on a Raspberry pi 3 (with apache2) and, mysteriously, could never make crontab work, so I manually renewed my certificate every 50 days.  
I’ve been doing so for several years.  
Yesterday, I tried to renew my cert and this time it didn’t work.  
I digged the problem, thought it was some kind of acme-challenge problem, i tried to repair my sites-available files (adding a rewriterule etc) but it remained broken.  
Tired of all this, I wanted to start anew, I removed my cert, returned to a http working model.  
It works : I can connect through network to my website in http.  
But when I wanted to certbot-auto back again, the same problem appeared.  
I hope I’m clear enough.

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: [http://lesmaths.ze.cx](http://lesmaths.ze.cx)

I ran this command: certbot-auto --apache

It produced this output:  
/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/cryptography/hazmat/bindings/openssl/binding.py:163: CryptographyDeprecationWarning: OpenSSL version 1.0.1 is no longer supported by the OpenSSL project, please upgrade. The next version of cryptography will drop support for it.  
utils.CryptographyDeprecationWarning  
Saving debug log to /var/log/letsencrypt/letsencrypt.log  
Plugins selected: Authenticator apache, Installer apache

Which names would you like to activate HTTPS for?

* * *

1: [lesmaths.ddns.net](http://lesmaths.ddns.net)  
2: [tables.dynu.com](http://tables.dynu.com)  
3: crd.gotdns.ch  
4: crd.ze.cx  
5: lesmaths.ze.cx

* * *

Select the appropriate numbers separated by commas and/or spaces, or leave input  
blank to select all options shown (Enter ‘c’ to cancel): 5  
Obtaining a new certificate  
Performing the following challenges:  
http-01 challenge for lesmaths.ze.cx  
Waiting for verification…  
Challenge failed for domain lesmaths.ze.cx  
http-01 challenge for lesmaths.ze.cx  
Cleaning up challenges  
Some challenges have failed.

IMPORTANT NOTES:

- The following errors were reported by the server:

My web server is (include version): _Apache/2.4.10 (Raspbian)_

The operating system my web server runs on is (include version): _Raspbian GNU/Linux 8 (jessie)_

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know): _yes_

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): _certbot 1.3.0_

Thank you so much if you can tell me what’s wrong.

aze291

EDIT : I went to [https://letsdebug.net/](https://letsdebug.net/), ran all the tests i could and everything seems well [https://letsdebug.net/lesmaths.ze.cx/127778](https://letsdebug.net/lesmaths.ze.cx/127778) but still, it doesn’t work.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [April 27, 2020, 9:38am UTC](https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859/2 "2020-04-27T09:38:47Z")

</div>

Hi @aze291

> [@aze291](#):
>
> Domain: lesmaths.ze.cx  
> Type: connection  
> Detail: During secondary validation: Fetching  
> [http://lesmaths.ze.cx/.well-known/acme-challenge/xUcBHX5Eb19vd\_BuhfwVCy5LP6D-DGfJlqIJVT7eqkg:](http://lesmaths.ze.cx/.well-known/acme-challenge/xUcBHX5Eb19vd_BuhfwVCy5LP6D-DGfJlqIJVT7eqkg:)  
> Timeout during connect (likely firewall problem)

**During secondary validation** is the new problem.

Read

> [@ACME v1/v2: Validating challenges from multiple network vantage points](https://community.letsencrypt.org/t/acme-v1-v2-validating-challenges-from-multiple-network-vantage-points/112253):
>
> O…

So the main Letsencrypt servers are able to connect your domain (same with letsdebug), but the secondary servers are blocked.

Looks like you have a regional firewall that blocks -\> remove these blocks.

---

<div class="post-metadata">

**Author:** ![aze291](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aze291/32/39271_2.png) [@aze291](https://community.letsencrypt.org/u/aze291)\
**Post date:** [April 27, 2020, 10:19am UTC](https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859/3 "2020-04-27T10:19:32Z")

</div>

Thank you for your reply. I’ll try to solve this as soon as I get home.

Good day to you

aze291

---

<div class="post-metadata">

**Author:** ![aze291](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aze291/32/39271_2.png) [@aze291](https://community.letsencrypt.org/u/aze291)\
**Post date:** [April 28, 2020, 10:50pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859/4 "2020-04-28T22:50:22Z")

</div>

Hi there  
I put down my firewall, I had the same problem.

I have another correlated question : because of the deprecation warning, i updated openssl and it’s now version 1.1.1g.  
But i still have this deprecation warning for version 1.0.1.  
It may be irrelevant… or a clue ?

Thank you

aze291

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [April 29, 2020, 3:01am UTC](https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859/5 "2020-04-29T03:01:04Z")

</div>

> [@aze291](#):
>
> I updated openssl and it’s now version 1.1.1g.  
> But I still have this deprecation warning for version 1.0.1.

You may have more than one version of OpenSSL.  
Please show results of these commands:

```nohighlight
find / -name openssl
which openssl

```

---

<div class="post-metadata">

**Author:** ![aze291](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aze291/32/39271_2.png) [@aze291](https://community.letsencrypt.org/u/aze291)\
**Post date:** [April 29, 2020, 8:20am UTC](https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859/6 "2020-04-29T08:20:57Z")

</div>

`find / -name openssl`  
gave out

/opt/eff.org/certbot/venv/lib/python2.7/site-packages/cryptography/hazmat/bindings/openssl  
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/cryptography/hazmat/backends/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/VC-WIN32/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/VC-WIN32/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/VC-WIN32/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/BSD-x86\_64/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/BSD-x86\_64/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/BSD-x86\_64/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/aix64-gcc/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/aix64-gcc/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/aix64-gcc/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/solaris64-x86\_64-gcc/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/solaris64-x86\_64-gcc/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/solaris64-x86\_64-gcc/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-armv4/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-armv4/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-armv4/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/VC-WIN64-ARM/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-x32/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-x32/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-x32/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/aix-gcc/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/aix-gcc/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/aix-gcc/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/darwin64-x86\_64-cc/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/darwin64-x86\_64-cc/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/darwin64-x86\_64-cc/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-ppc/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-ppc/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-ppc/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-ppc64le/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-ppc64le/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-ppc64le/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-aarch64/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-aarch64/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-aarch64/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/darwin-i386-cc/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/darwin-i386-cc/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/darwin-i386-cc/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-x86\_64/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-x86\_64/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-x86\_64/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux32-s390x/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux32-s390x/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux32-s390x/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-ppc64/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-ppc64/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-ppc64/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux64-s390x/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux64-s390x/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux64-s390x/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-elf/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-elf/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/linux-elf/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/VC-WIN64A/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/VC-WIN64A/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/VC-WIN64A/asm\_avx2/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/solaris-x86-gcc/asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/solaris-x86-gcc/no-asm/include/openssl  
/home/pi/node-v11.15.0-linux-armv7l/include/node/openssl/archs/solaris-x86-gcc/asm\_avx2/include/openssl  
/usr/share/doc/openssl  
/usr/share/bash-completion/completions/openssl  
/usr/share/lintian/overrides/openssl  
/usr/bin/openssl  
/usr/include/arm-linux-gnueabihf/openssl  
/usr/include/openssl  
/usr/local/include/node/openssl  
/usr/local/include/node/openssl/archs/VC-WIN32/asm/include/openssl  
/usr/local/include/node/openssl/archs/VC-WIN32/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/VC-WIN32/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/BSD-x86\_64/asm/include/openssl  
/usr/local/include/node/openssl/archs/BSD-x86\_64/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/BSD-x86\_64/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/aix64-gcc/asm/include/openssl  
/usr/local/include/node/openssl/archs/aix64-gcc/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/aix64-gcc/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/solaris64-x86\_64-gcc/asm/include/openssl  
/usr/local/include/node/openssl/archs/solaris64-x86\_64-gcc/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/solaris64-x86\_64-gcc/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/linux-armv4/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-armv4/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-armv4/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/VC-WIN64-ARM/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-x32/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-x32/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-x32/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/aix-gcc/asm/include/openssl  
/usr/local/include/node/openssl/archs/aix-gcc/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/aix-gcc/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/darwin64-x86\_64-cc/asm/include/openssl  
/usr/local/include/node/openssl/archs/darwin64-x86\_64-cc/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/darwin64-x86\_64-cc/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/linux-ppc/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-ppc/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-ppc/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/linux-ppc64le/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-ppc64le/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-ppc64le/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/linux-aarch64/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-aarch64/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-aarch64/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/darwin-i386-cc/asm/include/openssl  
/usr/local/include/node/openssl/archs/darwin-i386-cc/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/darwin-i386-cc/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/linux-x86\_64/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-x86\_64/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-x86\_64/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/linux32-s390x/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux32-s390x/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux32-s390x/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/linux-ppc64/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-ppc64/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-ppc64/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/linux64-s390x/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux64-s390x/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux64-s390x/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/linux-elf/asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-elf/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/linux-elf/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/VC-WIN64A/asm/include/openssl  
/usr/local/include/node/openssl/archs/VC-WIN64A/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/VC-WIN64A/asm\_avx2/include/openssl  
/usr/local/include/node/openssl/archs/solaris-x86-gcc/asm/include/openssl  
/usr/local/include/node/openssl/archs/solaris-x86-gcc/no-asm/include/openssl  
/usr/local/include/node/openssl/archs/solaris-x86-gcc/asm\_avx2/include/openssl  
/usr/lib/ruby/2.1.0/openssl

and `which openssl` outputted `/usr/bin/openssl`

and `/usr/bin/openssl version` said `OpenSSL 1.1.1g 21 Apr 2020`

---

<div class="post-metadata">

**Author:** ![aze291](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aze291/32/39271_2.png) [@aze291](https://community.letsencrypt.org/u/aze291)\
**Post date:** [April 29, 2020, 12:57pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859/7 "2020-04-29T12:57:18Z")

</div>

Hello there  
It took me time : it is solved. Thank to you both, you’re perfect.  
The problem was indeed a firewall that I didn’t remember having set. I had to list all services to find out which one was blocking.  
💜  
Thank you again

aze291

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [May 29, 2020, 12:57pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert-to-create-cert/120859/8 "2020-05-29T12:57:25Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.