Update Letsencrypt certificate fails

Help
1

Hi guys,

I'm using letsencrypt certificates since several years but now the update aka renewal fails completely.
The system is based on Ububtu 20.04 LTS and the apache webserver is the version 2.4.41. However, since some weeks this update process fails continously. I looks like the .well-known directory with the challenge isn't written by the cerbot application. I make use of the snap version of certbot rather then the apt version. But both fail with the same error message: "Cerbot failed to authenticate some domains (www.broesecke.eu) . During secondary validation the challenge couldn't be read, a time out occured.

Even the originating IPs performing this renewal aren't blocked by my firewall and this tends to the assumption, either a directive of my webserver or I do not fully understand the mechanismen of Certbot.

I hope someone can support me in determining the issue.

Thanks,
Michael

1 Like
2

You've skipped all the questionnaire questions. What command are you running? Which mode is certbot working in?

2 Likes
3

Hi,
I'm running certbot just as ist is. It's asking me to my domain in list and afterword I choose U for update.

Certbot is working the apache mode.

I had a lok at other threats and checked some issues but still I get the following result:

Domain: www.broesecke.eu
Type: connection
Detail: During secondary validation: 91.136.133.54: Fetching http://www.broesecke.eu/.well-known/acme-challenge/MUaHtg5hukiCvVpT1LE9xi3exKgXvH3ney-DFWLoDcw: Timeout during connect (likely firewall problem)

2 Likes
4

It looks like you are blocking connections from many parts of the world.

For the HTTP Challenge you must allow inbound requests on port 80 from anywhere. At least for URI containing /.well-known/acme-challenge/token

This site shows test results: Check website performance and response : Check host - online website monitoring

Let's Encrypt checks from several locations around the world. These can change at any time so LE does not publish the list of IPs it uses.

4 Likes
5

Yepp, I block a lot of connections. I had a several attacks some month ago and decided to block them as soon a possible. However, the port 80 is open but redicrt to my https site and both configs have the same web-root.

6

You need to open your firewall to allow all port 80 connections. Does it have an API that you could open and close just during the renewal? Certbot has --pre-hook and --post-hook for that.

Can your firewall look at URI and allow all acme-challenge?

2 Likes
7

Hmm, port 80 isn't blocked in the firewall. Yes, I block certain networks on forwarding to my webserver. If I use my mobile phone and open up http://www.broesecke.eu I get the certificate error and approve it, I can see the content of my webserver.

Can you please rfer to the documentiaon of pre and post hook?

P.S: Once I removed the premanent redirect just for fun and opened the connection and got the index.html created.

8

Well then open whatever block you have on networks so Let's Encrypt challenges reach you. Or, switch to DNS Challenge

The Certbot docs are here: User Guide — Certbot 5.0.0.dev0 documentation

See also: Challenge Types - Let's Encrypt

2 Likes
9

Ok, I disabled the main blocking rule and indeed port 80 was then reachable.
Seems the blocking list are too mighty and maybe to general.....

Thanks for openeing my eyes.

3 Likes
10

It may help to read through this description of why and how Let's Encrypt checks for control of the domain from many places around the world:

4 Likes
11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.