Unable to renew certificate

Help
1

My domain is: slint.fr

I ran this command:
./acme.sh --renew -d slint.fr

It produced this output:
[Mon Mar 10 10:17:57 CET 2025] Renewing: 'slint.fr'
[Mon Mar 10 10:17:57 CET 2025] Renewing using Le_API=https://acme-v02.api.letsencrypt.org/directory
[Mon Mar 10 10:17:58 CET 2025] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Mon Mar 10 10:17:59 CET 2025] Checking if there is an error in the Apache config file before starting.
Syntax OK
[Mon Mar 10 10:17:59 CET 2025] OK
[Mon Mar 10 10:17:59 CET 2025] Config file /etc/httpd/httpd.conf has been backed up to /root/.acme.sh/httpd.conf
[Mon Mar 10 10:17:59 CET 2025] In case an error causes it to not be restored automatically, you can restore it yourself.
[Mon Mar 10 10:17:59 CET 2025] You do not need to do anything on success, as the backup file will automatically be deleted.
[Mon Mar 10 10:17:59 CET 2025] Single domain='slint.fr'
[Mon Mar 10 10:18:02 CET 2025] Getting webroot for domain='slint.fr'
[Mon Mar 10 10:18:03 CET 2025] Verifying: slint.fr
[Mon Mar 10 10:18:03 CET 2025] Pending. The CA is processing your order, please wait. (1/30)
[Mon Mar 10 10:18:07 CET 2025] Pending. The CA is processing your order, please wait. (2/30)
[Mon Mar 10 10:18:11 CET 2025] Pending. The CA is processing your order, please wait. (3/30)
[Mon Mar 10 10:18:15 CET 2025] Pending. The CA is processing your order, please wait. (4/30)
[Mon Mar 10 10:18:19 CET 2025] Pending. The CA is processing your order, please wait. (5/30)
[Mon Mar 10 10:18:22 CET 2025] Pending. The CA is processing your order, please wait. (6/30)
[Mon Mar 10 10:18:26 CET 2025] slint.fr: Invalid status. Verification error details: 172.105.89.79: Fetching https://slint.fr/.well-known/acme-challenge/vR2g8Y2cEYeT7Ft2j68gFVStoe3dRsqlRdT_XPn5jLg: Timeout during connect (likely firewall problem)
Syntax OK
[Mon Mar 10 10:18:26 CET 2025] Please check log file for more details: /root/.acme.sh/acme.sh.log

My web server is (include version):
Server version: Apache/2.4.63 (Unix)
The operating system my web server runs on is (include version):
Skackware 15.0
My hosting provider, if applicable, is:
Linode
I can login to a root shell on my machine (yes or no, or I don't know):
Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
acme.sh v3.1.0

2

PS: I have already reported this issue here: Cant renew cerificate · Issue #6266 · acmesh-official/acme.sh · GitHub including a ling to a full debug log: https://github.com/user-attachments/files/19152437/acme.sh.log but did not receive an answer yet.

3

The Apache option uses an HTTP Challenge to validate your domain. An HTTP request to your domain by the Let's Encrypt server is failing to reach you. Usually it is because of a firewall. But, this can also be other options.

In your case you should review the IP addresses in your DNS. You have both IPv4 and IPv6 which is good. But, make sure they are both correct public IP addresses for your Apache server.

There are many ways to check that. These will show your public IP when run from your Apache server.

curl -4 https://ifconfig.io
curl -6 https://ifconfig.io

Also check any firewalls you have. And, any network settings at your hosting site. Make sure inbound requests on port 80 are allowed for both IPv4 and IPv6.

This is a helpful site to test new setups

3 Likes
4

Thanks for your fast answer Mike. Indeed there is an issue with IPv6. From the server
didier@darkstar:~$ curl -6 https://ifconfig.io
curl: (7) Failed to connect to ifconfig.io port 443 after 1 ms: Could not connect to server

Now I will try to find out what. From my desktop:
didier[~]$ host slint.fr
slint.fr has address 172.105.89.79
slint.fr has IPv6 address 2a01:7e01::f03c:92ff:fe08:1a0c
slint.fr mail is handled by 10 slint.fr.

However ping 172.105.89.79 works but ping 2a01:7e01::f03c:92ff:fe08:1a0c gives no answer. I guess this confirms that.

1 Like
5

My mistake: I had mistakenly disabled ipv6 in the kernel of the VPS. Enabling it allowed me to renew the certificate. Thanks for the help and sorry for the noise.
Best regards,
Didier

3 Likes