Urn:ietf:params:acme:error:connection Error, issuing new certificate failed: dehydrated failure

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: quanqiu.group

I ran this command:

It produced this output:

[error] 25#25: *10 [lua] lets_encrypt.lua:40: issue_cert(): auto-ssl: dehydrated failed: env HOOK_SECRET=0b6494dbc2cc3890efd07f31228cc62a7a59958860b5eaadca2ae125c83df672 HOOK_SERVER_PORT=8999 /usr/local/openresty/luajit/bin/resty-auto-ssl/dehydrated --cron --accept-terms --no-lock --domain quanqiu.group --challenge http-01 --config /etc/resty-auto-ssl/letsencrypt/config --hook /usr/local/openresty/luajit/bin/resty-auto-ssl/letsencrypt_hooks status: 256 out: # INFO: Using main config file /etc/resty-auto-ssl/letsencrypt/config

  • Generating account key…
  • Registering account key with ACME server…
  • Fetching account ID…
    startup_hook
  • Creating chain cache directory /etc/resty-auto-ssl/letsencrypt/chains
    Processing quanqiu.group
  • Creating new directory /etc/resty-auto-ssl/letsencrypt/certs/quanqiu.group …
  • Signing domains…
  • Generating private key…
  • Generating signing request…
  • Requesting new certificate order from CA…
  • Received 1 authorizations URLs from the CA
  • Handling authorization for quanqiu.group
  • 1 pending challenge(s)
  • Deploying challenge tokens…
    deploy_challenge
  • Responding to challenge for quanqiu.group authorization…
    invalid_challenge
    Invalid challenge: DOMAIN=quanqiu.group RESPONSE={
    “type”: “http-01”,
    “status”: “invalid”,
    “error”: {
    “type”: “urn:ietf:params:acme:error:connection”,
    “detail”: “Fetching https://quanqiu.group/.well-known/acme-challenge/cx_YwMrK4Xg-GuyCGld4QQNasM-O_SLY6kKbmKwProg: Timeout after connect (your server may be slow or overloaded)”,
    “status”: 400
    },
    “url”: “https://acme-v02.api.letsencrypt.org/acme/chall-v3/2199018098/bfIoSQ”,
    “token”: “cx_YwMrK4Xg-GuyCGld4QQNasM-O_SLY6kKbmKwProg”,
    “validationRecord”: [
    {
    “url”: “http://quanqiu.group/.well-known/acme-challenge/cx_YwMrK4Xg-GuyCGld4QQNasM-O_SLY6kKbmKwProg”,
    “hostname”: “quanqiu.group”,
    “port”: “80”,
    “addressesResolved”: [
    “106.15.121.65”
    ],
    “addressUsed”: “106.15.121.65”
    },
    {
    “url”: “https://quanqiu.group/.well-known/acme-challenge/cx_YwMrK4Xg-GuyCGld4QQNasM-O_SLY6kKbmKwProg”,
    “hostname”: “quanqiu.group”,
    “port”: “443”,
    “addressesResolved”: [
    “106.15.121.65”
    ],
    “addressUsed”: “106.15.121.65”
    }
    ]
    }
    err: nil, context: ssl_certificate_by_lua*, client: 101.87.247.185, server: 0.0.0.0:443
    2020/01/09 17:23:04 [error] 25#25: 10 [lua] ssl_certificate.lua:97: issue_cert(): auto-ssl: issuing new certificate failed: dehydrated failure, context: ssl_certificate_by_lua, client: 101.87.247.185, server: 0.0.0.0:443
    2020/01/09 17:23:04 [error] 25#25: 10 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for quanqiu.group - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua, client: 101.87.247.185, server: 0.0.0.0:443
    2020/01/09 17:23:06 [error] 25#25: 13 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua, client: 101.87.247.185, server: 0.0.0.0:443
    2020/01/09 17:23:06 [error] 25#25: 13 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for quanqiu.group - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua, client: 101.87.247.185, server: 0.0.0.0:443
    2020/01/09 17:23:06 [error] 24#24: 11 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua, client: 101.87.247.185, server: 0.0.0.0:443
    2020/01/09 17:23:06 [error] 24#24: 11 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for quanqiu.group - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua, client: 101.87.247.185, server: 0.0.0.0:443
    2020/01/09 17:23:06 [error] 24#24: 14 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua, client: 101.87.247.185, server: 0.0.0.0:443
    2020/01/09 17:23:06 [error] 24#24: 14 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for quanqiu.group - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua, client: 101.87.247.185, server: 0.0.0.0:443
    2020/01/09 17:23:20 [error] 25#25: 19 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua, client: 3.14.255.131, server: 0.0.0.0:443
    2020/01/09 17:23:20 [error] 25#25: 19 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for quanqiu.group - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua, client: 3.14.255.131, server: 0.0.0.0:443
    2020/01/09 17:23:20 [error] 25#25: 22 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua, client: 52.28.236.88, server: 0.0.0.0:443
    2020/01/09 17:23:20 [error] 25#25: 22 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for quanqiu.group - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua, client: 52.28.236.88, server: 0.0.0.0:443
    2020/01/09 17:23:21 [error] 25#25: 27 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua, client: 64.78.149.164, server: 0.0.0.0:443
    2020/01/09 17:23:21 [error] 25#25: 27 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for quanqiu.group - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua, client: 64.78.149.164, server: 0.0.0.0:443

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

1 Like

All the firewalls are disabled. 80 443 ports are open. Also read through all related posts on the forum, tried all the suggestions, but don’t work for my situation.

Please help, thanks!

1 Like

Your port 443 is very slow to establish a TLS session. The TCP connection opens quickly enough, but your server does not respond to the ClientHello for multiple seconds.

See also: https://letsdebug.net/quanqiu.group/91734 , which confirms the slowness independently.

Let’s Encrypt will wait for up to 10 seconds in total when checking a challenge response. It’s possible that your server is taking longer than that to generate a response, which results in the timeout, from Let’s Encrypt’s perspective.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.