# Unable to renew certificates via http-01 apache2, Raspbian stretch, certbot **URL:** \ **Category:** Help\ **Created:** [March 3, 2019, 3:16am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificates-via-http-01-apache2-raspbian-stretch-certbot/87626 "2019-03-03T03:16:33Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![medic2607](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@medic2607](https://community.letsencrypt.org/u/medic2607)\ **Post date:** [March 3, 2019, 3:16am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificates-via-http-01-apache2-raspbian-stretch-certbot/87626/1 "2019-03-03T03:16:33Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [medic2607.ddns.net](http://medic2607.ddns.net) I ran this command: sudo certbot renew --dry-run It produced this output: * * * Processing /etc/letsencrypt/renewal/medic2607.ddns.net.conf * * * Cert is due for renewal, auto-renewing… Plugins selected: Authenticator apache, Installer apache Renewing an existing certificate Performing the following challenges: http-01 challenge for [medic2607.ddns.net](http://medic2607.ddns.net) Waiting for verification… Cleaning up challenges Attempting to renew cert ([medic2607.ddns.net](http://medic2607.ddns.net)) from /etc/letsencrypt/renewal/medic2607.ddns.net.conf produced an unexpected error: Failed authorization procedure. [medic2607.ddns.net](http://medic2607.ddns.net) (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [http://medic2607.ddns.net/.well-known/acme-challenge/D1oUr0OEPeTEYDVvsNp3Lcn-2OLKa49ITpUs3t5zjzg:](http://medic2607.ddns.net/.well-known/acme-challenge/D1oUr0OEPeTEYDVvsNp3Lcn-2OLKa49ITpUs3t5zjzg:) Timeout during connect (likely firewall problem). Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/medic2607.ddns.net/fullchain.pem (failure) * * * \*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry \*\* (The test certificates below have not been saved.) All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/medic2607.ddns.net/fullchain.pem (failure) \*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry \*\* (The test certificates above have not been saved.) * * * 1 renew failure(s), 0 parse failure(s) IMPORTANT NOTES: - The following errors were reported by the server: My web server is (include version): Apache/2.4.25 The operating system my web server runs on is (include version): Raspbian Stretch My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don’t know): Yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): certbot 0.28.0 ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [March 3, 2019, 4:08am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificates-via-http-01-apache2-raspbian-stretch-certbot/87626/2 "2019-03-03T04:08:24Z")
The immediate problem seems to be that [your ISP blocks port 80](http://www.dslreports.com/faq/5684). Port 80 is required in order to renew Let’s Encrypt certificates using HTTP validation. It’s possible that you were previously renewing using TLS-SNI (port 443), but [this is no longer possible with Let’s Encrypt](https://community.letsencrypt.org/t/important-what-you-need-to-know-about-tls-sni-validation-issues/50811). Given that `ddns.net` (run by [noip.com](http://noip.com)) does not support TXT records, it seems that you cannot use DNS validation either. Your choices are very limited: - You can try get your ISP to unblock port 80 - You can abandon Certbot and use acme.sh in TLS-ALPN mod (first stopping your Apache webserver) to issue a certificate: [https://github.com/Neilpang/acme.sh#5-use-standalone-ssl-server-to-issue-cert](https://github.com/Neilpang/acme.sh#5-use-standalone-ssl-server-to-issue-cert) - You can abandon `ddns.net` and use a dynamic DNS provider that supports Let’s Encrypt DNS validation, like [duckdns.org](http://duckdns.org) or [afraid.org](http://afraid.org) or [some others](https://community.letsencrypt.org/t/dns-providers-who-easily-integrate-with-lets-encrypt-dns-validation/86438)). ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 3, 2019, 9:37am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificates-via-http-01-apache2-raspbian-stretch-certbot/87626/3 "2019-03-03T09:37:15Z")
> [@\_az](#): > > - You can try get your ISP to unblock port 80 > **[Optimum | FAQ](https://www.optimum.net/FAQ/#/answers/a_id/2140/kw/port%2080)** > > Get online support for your cable, phone and internet services from > Optimum. Pay your bill, connect to WiFi, check your email and voicemail, see what's on TV and more! ---
**Author:** ![medic2607](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@medic2607](https://community.letsencrypt.org/u/medic2607)\ **Post date:** [March 4, 2019, 2:27am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificates-via-http-01-apache2-raspbian-stretch-certbot/87626/4 "2019-03-04T02:27:51Z")
So it looks like the best solution is also the most obvious…was able to open port 80 through my ISP and all is working well. Thank you both for your replies. @_az @Osiris ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [April 3, 2019, 2:27am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificates-via-http-01-apache2-raspbian-stretch-certbot/87626/5 "2019-04-03T02:27:56Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.