# Unable to update challenge :: authorization must be pending. Exiting **URL:** \ **Category:** Help\ **Created:** [May 27, 2020, 7:10pm UTC](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054 "2020-05-27T19:10:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![obw](https://avatars.discourse-cdn.com/v4/letter/o/58956e/32.png) [@obw](https://community.letsencrypt.org/u/obw)\ **Post date:** [May 27, 2020, 7:10pm UTC](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054/1 "2020-05-27T19:10:53Z")
Dear sir, madam, My domain is: sexpertise-online.nl I ran this command: I did not run a command - I received an email message with a problem report after automatic renew attempt of the certificate, I presume (see below for the problem message) It produced this output: The complete error message is “Subject: Error during automated certificate renewal for sexpertise-online.nl Requesting new certificate order… Processing [https://acme-v02.api.letsencrypt.org/acme/authz-v3/4819831468](https://acme-v02.api.letsencrypt.org/acme/authz-v3/4819831468)… Processing authorization for sexpertise-online.nl… Waiting for domain verification… Let’s Encrypt was unable to verify the challenge. Unable to update challenge :: authorization must be pending. Exiting…” My web server is (include version): I cannot see the system info which should contain info about the web server (this info is hidden for me as reseller) The operating system my web server runs on is (include version): I don’t know - this info should be in the system info which I can’t see… My hosting provider, if applicable, is: [https://www.sity.nl/](https://www.sity.nl/) I can login to a root shell on my machine (yes or no, or I don’t know): no I’m using a control panel to manage my site (no, or provide the name and version of the control panel): DirectAdmin - I can’t see a version number The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): I’m not aware of something like a ‘client’ Thanks for your help! wkr, Otto ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [May 27, 2020, 7:28pm UTC](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054/2 "2020-05-27T19:28:25Z")
> [@obw](#): > > Processing [https://acme-v02.api.letsencrypt.org/acme/authz-v3/4819831468…](https://acme-v02.api.letsencrypt.org/acme/authz-v3/4819831468%E2%80%A6) > Processing authorization for sexpertise-online.nl… > Waiting for domain verification… > Let’s Encrypt was unable to verify the challenge. Unable to update challenge :: authorization must be pending. Exiting…” Validation failed, but the ACME client tried to proceed anyway, and failed with the "authorization must be pending" error message instead of showing you why the authorization failed. If you click on the authz link, you can see the original error message: ` "detail": "DNS problem: SERVFAIL looking up CAA for sexpertise-online.nl - the domain's nameservers may be malfunctioning",` I'm not sure why, but there seem to be issues with the domain's DNS. [Unboundtest.com](https://unboundtest.com/) shows the same thing: [https://unboundtest.com/m/CAA/sexpertise-online.nl/ZWRPEB3E](https://unboundtest.com/m/CAA/sexpertise-online.nl/ZWRPEB3E) ---
**Author:** ![obw](https://avatars.discourse-cdn.com/v4/letter/o/58956e/32.png) [@obw](https://community.letsencrypt.org/u/obw)\ **Post date:** [May 27, 2020, 7:55pm UTC](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054/3 "2020-05-27T19:55:01Z")
Hi MNordhoff, Thanks for your quick response! I’ll take your info and ask the company that hosts my domains and DNS setup what can be wrong here. Thanks again for your help! wkr, Otto ---
**Author:** ![obw](https://avatars.discourse-cdn.com/v4/letter/o/58956e/32.png) [@obw](https://community.letsencrypt.org/u/obw)\ **Post date:** [June 2, 2020, 9:33am UTC](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054/4 "2020-06-02T09:33:50Z")
Hi Matt, I did add the CAA record and don’t get an error message any more referring to CAA, but now I got another error message when Let’s Encrypt tried to update the cert last night: “Error: [http://sexpertise-online.nl/.well-known/acme-challenge/letsencrypt\_1591058240](http://sexpertise-online.nl/.well-known/acme-challenge/letsencrypt_1591058240) is not reachable. Aborting the script. dig output for sexpertise-online.nl: Please make sure /.well-known alias is setup in WWW server.” I asked my hosting provider for the setup of this on their server and they confirmed that the .well-known is available on their server, but added as remart that in the DNS record also an A record for sexpertise-online.nl should be there (so without the www), but this is already the case since the domain was setup years ago…, so it seems that the problem lies somewhere else… Could you provide me with another hint how to solve the problem of Let’s Encrypt not being able to update the cert for sexpertise-online.nl? Thanks for your help! wkr, Otto ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [June 2, 2020, 9:44am UTC](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054/5 "2020-06-02T09:44:37Z")
Hi @obw > [@obw](#): > > “Error: [http://sexpertise-online.nl/.well-known/acme-challenge/letsencrypt\_1591058240](http://sexpertise-online.nl/.well-known/acme-challenge/letsencrypt_1591058240) is not reachable. Aborting the script. > dig output for sexpertise-online.nl: > Please make sure /.well-known alias is setup in WWW server.” now you have a different error - see your check, ~~2 hours old - [https://check-your-website.server-daten.de/?q=sexpertise-online.nl](https://check-your-website.server-daten.de/?q=sexpertise-online.nl) | Host | Type | IP-Address | is auth. | ∑ Queries | ∑ Timeout | | --- | --- | --- | --- | --- | --- | | sexpertise-online.nl | | Server failure | yes | 3 | 0 | | www.sexpertise-online.nl | A | 88.214.28.6 Alkmaar/North Holland/Netherlands (NL) - Infra Blocks B.V. Hostname: web3.hostingcp.eu | yes | 1 | 0 | | | AAAA | | yes | | | Your www has an ip address. Your non-www has a fatal Server failure. So creating a certificate with the non-www can't work because no ip address is found. Ah - no TCP connections: | X | Fatal error: Nameserver doesn't support TCP connection: ns3.domeinnaamreseller.nl / 52.28.174.166: ServerFailure | | --- | --- | | X | Fatal error: Nameserver doesn't support TCP connection: ns4.domeinnaamreseller.nl / 18.196.2.217: ServerFailure | | X | Fatal error: Nameserver doesn't support TCP connection: ns5.domeinnaamreseller.nl / 18.196.2.217: ServerFailure | And same with CAA- and TXT-checks - a lot of Server failures. That ![2020-06-02.sexpertise-online.nl](https://global.discourse-cdn.com/letsencrypt/original/3X/9/b/9b76aabbcce96dc885f75d62a52596b1c80735a2.png) will block creating Letsencrypt certificates. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [June 2, 2020, 9:45am UTC](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054/6 "2020-06-02T09:45:51Z")
> [@obw](#): > > “Error: [http://sexpertise-online.nl/.well-known/acme-challenge/letsencrypt\_1591058240](http://sexpertise-online.nl/.well-known/acme-challenge/letsencrypt_1591058240) is not reachable. Aborting the script. > dig output for sexpertise-online.nl: > Please make sure /.well-known alias is setup in WWW server.” That's part of some kind of self-check built into your ACME client. It would be good if it has logs showing more information, but I don't know about that. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [June 22, 2020, 4:34pm UTC](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054/7 "2020-06-22T16:34:16Z")
A post was split to a new topic: [Creating certificate doesn’t work - different ip addresses](https://community.letsencrypt.org/t/creating-certificate-doesnt-work-different-ip-addresses/126537) ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 22, 2020, 4:48pm UTC](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054/8 "2020-07-22T16:48:13Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.