# Unable to renew cert **URL:** \ **Category:** Help\ **Created:** [March 8, 2023, 8:34am UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097 "2023-03-08T08:34:25Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![teockm](https://avatars.discourse-cdn.com/v4/letter/t/df705f/32.png) [@teockm](https://community.letsencrypt.org/u/teockm)\ **Post date:** [March 8, 2023, 8:34am UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097/1 "2023-03-08T08:34:25Z")
👀 lease fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [kee8.ddns.net](http://kee8.ddns.net) I ran this command: certbot renew It produced this output: Processing /etc/letsencrypt/renewal/kee8.ddns.net.conf * * * Cert is due for renewal, auto-renewing... Plugins selected: Authenticator nginx, Installer nginx Renewing an existing certificate Performing the following challenges: http-01 challenge for [sprocket.ddns.net](http://sprocket.ddns.net) http-01 challenge for [kee8.ddns.net](http://kee8.ddns.net) Using default address 80 for authentication. Waiting for verification... Cleaning up challenges Attempting to renew cert ([kee8.ddns.net](http://kee8.ddns.net)) from /etc/letsencrypt/renewal/kee8.ddns.net.conf produced an unexpected error: Failed authorization procedur$ All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/kee8.ddns.net/fullchain.pem (failure) * * * All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/kee8.ddns.net/fullchain.pem (failure) * * * 1 renew failure(s), 0 parse failure(s) IMPORTANT NOTES: - The following errors were reported by the server: Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org) 1$ My web server is (include version):nginx version: nginx version: nginx/1.14$ The operating system my web server runs on is (include version): Linux 5.10.103-v7+ #1529 SMP Tue Mar 8 12:21:37 GMT 2022 armv7l GNU/Linux on Raspberry Pi 3B My hosting provider, if applicable, is: self-host I can login to a root shell on my machine (yes or no, or I don't know):yes I'm using a control panel to manage my site (no, or provide the name and ve$ The version of my client is (e.g. output of certbot --version or certbot-au$ Additional info site [sprocket.ddns.net](http://sprocket.ddns.net) is no longer in use and ddns domain removed My web server is (include version): The operating system my web server runs on is (include version): My hosting provider, if applicable, is: self-host I can login to a root shell on my machine (yes or no, or I don't know):yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel):no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):certbot 0.31.0 Additional info site [sprocket.ddns.net](http://sprocket.ddns.net) is no longer in use and ddns domain removed ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 8, 2023, 9:26am UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097/2 "2023-03-08T09:26:20Z")
Hi @teockm, Try running something like `certbot --nginx --cert-name kee8.ddns.net -d kee8.ddns.net` If this works, it should replace your existing certificate with a newly obtained one that only includes the domain name that you are still using, and omits the old one. ---
**Author:** ![teockm](https://avatars.discourse-cdn.com/v4/letter/t/df705f/32.png) [@teockm](https://community.letsencrypt.org/u/teockm)\ **Post date:** [March 8, 2023, 12:44pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097/3 "2023-03-08T12:44:50Z")
Thanks for the quick response. Tried your suggestion but got the following error message: Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator nginx, Installer nginx Obtaining a new certificate Performing the following challenges: http-01 challenge for [kee8.ddns.net](http://kee8.ddns.net) Waiting for verification... Cleaning up challenges Failed authorization procedure. [kee8.ddns.net](http://kee8.ddns.net) (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: 66.228.0.178: Fetching [http://kee8.ddns.net/.well-known/acme-challenge/4Pm8R7y34ad93bELbhfpCxnIbc1Yogr9xMKxJRf2s3I:](http://kee8.ddns.net/.well-known/acme-challenge/4Pm8R7y34ad93bELbhfpCxnIbc1Yogr9xMKxJRf2s3I:) Timeout during connect (likely firewall problem) IMPORTANT NOTES: - The following errors were reported by the server: ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 8, 2023, 12:55pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097/4 "2023-03-08T12:55:43Z")
Port 80 needs to be open. ---
**Author:** ![teockm](https://avatars.discourse-cdn.com/v4/letter/t/df705f/32.png) [@teockm](https://community.letsencrypt.org/u/teockm)\ **Post date:** [March 8, 2023, 1:20pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097/5 "2023-03-08T13:20:20Z")
I checked my proxy server's firewall status and it showed both ports 80 and 443 allowed. My web server with a local 192.168.1.xx address has port 80 open as well. ---
**Author:** ![linkp](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/linkp/32/60089_2.png) [@linkp](https://community.letsencrypt.org/u/linkp)\ **Post date:** [March 8, 2023, 1:33pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097/6 "2023-03-08T13:33:51Z")
Something is preventing the connection. > **[Test result for kee8.ddns.net: Error](https://letsdebug.net/kee8.ddns.net/1400159)** > > 2 unique issue(s) detected (ANotWorking, IssueFromLetsEncrypt) Does your ISP block port 80? ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [March 8, 2023, 4:25pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097/7 "2023-03-08T16:25:57Z")
Supplemental information ```plaintext $ nmap -Pn kee8.ddns.net Starting Nmap 7.80 ( https://nmap.org ) at 2023-03-08 16:18 UTC Nmap scan report for kee8.ddns.net (66.228.0.178) Host is up (0.25s latency). Not shown: 999 filtered ports PORT STATE SERVICE 443/tcp open https Nmap done: 1 IP address (1 host up) scanned in 22.83 seconds ``` ```plaintext $ nmap -Pn sprocket.ddns.net Starting Nmap 7.80 ( https://nmap.org ) at 2023-03-08 16:19 UTC Failed to resolve "sprocket.ddns.net". WARNING: No targets were specified, so 0 hosts scanned. Nmap done: 0 IP addresses (0 hosts up) scanned in 0.12 seconds ``` **Failed traceroute on Port 80 to domain name [kee8.ddns.net](http://kee8.ddns.net)** ```plaintext $ sudo traceroute -T -p 80 kee8.ddns.net traceroute to kee8.ddns.net (66.228.0.178), 30 hops max, 60 byte packets 1 EdgeRouter-4 (192.168.1.1) 0.181 ms 0.145 ms 0.129 ms 2 96.120.60.137 (96.120.60.137) 8.722 ms 8.897 ms 8.883 ms 3 162.151.125.157 (162.151.125.157) 14.986 ms 8.854 ms 14.959 ms 4 68.85.243.154 (68.85.243.154) 8.827 ms 8.813 ms 16.627 ms 5 96.216.60.245 (96.216.60.245) 8.597 ms 8.771 ms 14.555 ms 6 24.124.129.61 (24.124.129.61) 14.861 ms 21.432 ms 21.415 ms 7 ae-69-ar01.beaverton.or.bverton.comcast.net (96.216.60.157) 56.945 ms 22.955 ms 8.836 ms 8 be-36211-cs01.portland.or.ibone.comcast.net (68.86.94.193) 9.675 ms be-36241-cs04.portland.or.ibone.comcast.net (68.86.94.205) 9.572 ms be-36221-cs02.portland.or.ibone.comcast.net (68.86.94.197) 16.569 ms 9 be-1211-cr11.portland.or.ibone.comcast.net (96.110.46.226) 16.504 ms be-1311-cr11.portland.or.ibone.comcast.net (96.110.46.242) 15.823 ms be-1111-cr11.portland.or.ibone.comcast.net (96.110.46.210) 16.432 ms 10 be-303-cr13.sunnyvale.ca.ibone.comcast.net (96.110.39.41) 30.094 ms be-301-cr13.sunnyvale.ca.ibone.comcast.net (96.110.36.121) 30.065 ms 30.038 ms 11 be-1213-cs02.sunnyvale.ca.ibone.comcast.net (96.110.46.21) 30.006 ms be-1113-cs01.sunnyvale.ca.ibone.comcast.net (96.110.46.9) 29.977 ms be-1213-cs02.sunnyvale.ca.ibone.comcast.net (96.110.46.21) 29.948 ms 12 be-3202-pe02.529bryant.ca.ibone.comcast.net (96.110.41.214) 30.563 ms be-3102-pe02.529bryant.ca.ibone.comcast.net (96.110.41.210) 38.159 ms be-3402-pe02.529bryant.ca.ibone.comcast.net (96.110.41.222) 36.764 ms 13 75.149.231.242 (75.149.231.242) 37.952 ms 35.137 ms 34.029 ms 14 203.208.173.137 (203.208.173.137) 206.356 ms 203.208.172.233 (203.208.172.233) 22.580 ms 22.471 ms 15 203.208.158.190 (203.208.158.190) 209.847 ms 203.208.173.105 (203.208.173.105) 203.967 ms 203.208.158.190 (203.208.158.190) 192.816 ms 16 203.208.166.234 (203.208.166.234) 200.303 ms 203.208.182.250 (203.208.182.250) 205.111 ms 203.208.166.234 (203.208.166.234) 206.483 ms 17 203.208.182.249 (203.208.182.249) 197.210 ms 203.208.158.190 (203.208.158.190) 206.426 ms 203.208.182.249 (203.208.182.249) 197.955 ms 18 203.208.166.234 (203.208.166.234) 207.678 ms 203.208.177.218 (203.208.177.218) 203.569 ms 203.208.171.110 (203.208.171.110) 198.550 ms 19 203.208.177.218 (203.208.177.218) 198.518 ms 165.21.138.182 (165.21.138.182) 214.150 ms 202.292 ms 20 SN-SINTP1-BO118-ae4.singnet.com.sg (165.21.138.93) 204.971 ms 204.220 ms 206.876 ms 21 SN-SINTP1-BO118-ae4.singnet.com.sg (165.21.138.93) 196.516 ms * * 22 165.21.138.182 (165.21.138.182) 217.901 ms * 103.67.168.134 (103.67.168.134) 207.652 ms 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * ``` **Good traceroute on Port 443 to domain name [kee8.ddns.net](http://kee8.ddns.net)** ```plaintext $ sudo traceroute -T -p 443 kee8.ddns.net traceroute to kee8.ddns.net (66.228.0.178), 30 hops max, 60 byte packets 1 EdgeRouter-4 (192.168.1.1) 0.198 ms 0.148 ms 0.174 ms 2 96.120.60.137 (96.120.60.137) 7.208 ms 7.194 ms 7.180 ms 3 162.151.125.157 (162.151.125.157) 7.159 ms 10.734 ms 7.132 ms 4 68.85.243.154 (68.85.243.154) 8.710 ms 8.595 ms 8.559 ms 5 96.216.60.245 (96.216.60.245) 8.628 ms 8.509 ms 8.589 ms 6 24.124.129.61 (24.124.129.61) 8.461 ms 11.744 ms 11.708 ms 7 ae-69-ar01.beaverton.or.bverton.comcast.net (96.216.60.157) 19.972 ms 18.423 ms 18.358 ms 8 be-36231-cs03.portland.or.ibone.comcast.net (68.86.94.201) 16.089 ms be-36211-cs01.portland.or.ibone.comcast.net (68.86.94.193) 16.075 ms be-36241-cs04.portland.or.ibone.comcast.net (68.86.94.205) 16.058 ms 9 be-1211-cr11.portland.or.ibone.comcast.net (96.110.46.226) 10.367 ms be-1311-cr11.portland.or.ibone.comcast.net (96.110.46.242) 9.587 ms 9.548 ms 10 be-302-cr13.sunnyvale.ca.ibone.comcast.net (96.110.36.125) 23.839 ms be-301-cr13.sunnyvale.ca.ibone.comcast.net (96.110.36.121) 23.824 ms be-303-cr13.sunnyvale.ca.ibone.comcast.net (96.110.39.41) 28.500 ms 11 be-1113-cs01.sunnyvale.ca.ibone.comcast.net (96.110.46.9) 28.483 ms be-1313-cs03.sunnyvale.ca.ibone.comcast.net (96.110.46.33) 28.469 ms be-1413-cs04.sunnyvale.ca.ibone.comcast.net (96.110.46.45) 27.837 ms 12 be-3202-pe02.529bryant.ca.ibone.comcast.net (96.110.41.214) 29.284 ms 29.270 ms be-3402-pe02.529bryant.ca.ibone.comcast.net (96.110.41.222) 21.157 ms 13 75.149.231.242 (75.149.231.242) 20.143 ms 24.932 ms 24.904 ms 14 * * 203.208.172.233 (203.208.172.233) 24.902 ms 15 203.208.172.225 (203.208.172.225) 198.683 ms 203.208.182.85 (203.208.182.85) 202.456 ms 203.208.182.249 (203.208.182.249) 215.304 ms 16 203.208.182.250 (203.208.182.250) 208.729 ms 204.605 ms 200.584 ms 17 203.208.177.218 (203.208.177.218) 191.199 ms 203.208.153.186 (203.208.153.186) 205.089 ms 203.208.158.190 (203.208.158.190) 205.035 ms 18 203.208.171.110 (203.208.171.110) 205.957 ms 203.208.166.234 (203.208.166.234) 201.440 ms SN-SINTP1-BO118-ae4.singnet.com.sg (165.21.138.93) 209.183 ms 19 203.208.177.218 (203.208.177.218) 200.479 ms 203.208.166.234 (203.208.166.234) 195.678 ms SN-SINTP1-BO118-ae4.singnet.com.sg (165.21.138.93) 202.904 ms 20 SN-SINTP1-BO118-ae4.singnet.com.sg (165.21.138.93) 202.852 ms 103.67.168.134 (103.67.168.134) 212.056 ms 211.940 ms 21 165.21.138.182 (165.21.138.182) 230.818 ms 215.170 ms * 22 66.228.0.178 (66.228.0.178) 216.890 ms 103.67.168.134 (103.67.168.134) 208.436 ms 214.306 ms 23 66.228.0.178 (66.228.0.178) 272.631 ms 278.179 ms * ``` **And for Port 80 the breakage seem to happen here:** **22 165.21.138.182 (165.21.138.182) 217.901 ms \* 103.67.168.134 (103.67.168.134) 207.652 ms** 23 \* \* \* ---
**Author:** ![teockm](https://avatars.discourse-cdn.com/v4/letter/t/df705f/32.png) [@teockm](https://community.letsencrypt.org/u/teockm)\ **Post date:** [March 9, 2023, 2:05pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097/8 "2023-03-09T14:05:41Z")
Many thanks for the nmap results. I triggered me to check my router settings. I had removed the port 80 from my port forwarding long ago and forgotten all about it. Renewed the cert with the command suggested by Mr Schoen. Everything works! Thanks again to all who responded. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [April 8, 2023, 2:05pm UTC](https://community.letsencrypt.org/t/unable-to-renew-cert/194097/9 "2023-04-08T14:05:51Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.