Verification fails - error 400 - Liquid Web and ESET

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: alexandriamanorct.com

I ran this command: Using plesk for windows ssl-it.

It produced this output: error: urn:ietf:params:acme:error:connection

My web server is (include version): IIS 10

The operating system my web server runs on is (include version): Windows server 2022 standard

My hosting provider, if applicable, is: liquid web

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Plesk Obsidian - 18.0.57 Update #5

This server has been running and generating certificates without a problem until last week.

We are suddenly seeing a large number of failed requests with error 400 connection reset by peer. I can manually navigate to challenge file from my device, or from a phone, never got any errors.

Here is the auth response details from lets-encrypt: https://acme-v02.api.letsencrypt.org/acme/authz-v3/307415285246 (Just the most recent example)

1 Like
2

Welcome to the community @mnemanov

When you say "a large number" do you mean affecting a wide variety of certs? Or just frequently for this specific cert / domain name?

I don't see any past Let's Encrypt certs for this specific domain name.

Can you identify any common elements for the other failures? Are they all on the same server with the same public IP? Or in the same subnet? Or not related at all :slight_smile:

Do you have a firewall that blocks specific IP addresses? Or maybe even some sort of DDoS firewall that blocks repeated requests?

Because generally a "reset by peer" is something actively done by some comms device at your facility.

2 Likes
3

These two are not [exactly] the same:

curl -Ii alexandriamanorct.com/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 301 Moved Permanently     <<<<<<<<<<<<<<<<<<<<<<<<<
Cache-Control: private
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Location: http://www.alexandriamanorct.com/.well-known/acme-challenge/Test_File-1234
Server: Microsoft-IIS/10.0
X-Redirect-By: WordPress     <<<<<<<<<<<<<<<<<<<<<<<<<
Date: Tue, 23 Jan 2024 23:23:39 GMT

curl -Ii www.alexandriamanorct.com/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 404 Not Found     <<<<<<<<<<<<<<<<<<<<<<<<<
Cache-Control: private
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Server: Microsoft-IIS/10.0
Link: <https://www.alexandriamanorct.com/wp-json/>; rel="https://api.w.org/"
Date: Tue, 23 Jan 2024 23:23:45 GMT

I can't be certain, but that may have something to do with the problem.

3 Likes
4

Hi, and thanks for your reply.

Yes this is a new domain on our server, the common element is our public ip 67.225.137.60

The redirects and 404 you are seeing are only for files that don't exist (if the file doesn't exist the request gets handed over to index.php, but if the file exists you will get the file without any redirects).

1 Like
5

Weird. I see this ... no redirects for root name and different response headers:

curl -I alexandriamanorct.com/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 404 Not Found
Content-Length: 12579
Content-Type: text/html
Server: Microsoft-IIS/10.0
Date: Tue, 23 Jan 2024 23:36:26 GMT

curl -I www.alexandriamanorct.com/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 404 Not Found
Content-Length: 12579
Content-Type: text/html
Server: Microsoft-IIS/10.0
Date: Tue, 23 Jan 2024 23:36:31 GMT
3 Likes
6

I am troubleshooting and temporarily changed the web root directory to a simple directory without wordpress.

1 Like
7

I could not yet try to see if my change makes a difference since I hit the rate limit.

8

Are you able to use the Let's Encrypt staging system with Plesk?

Much more flexible rate limits

3 Likes
9

Ok so I found the setting that lets me change the url, (but I have no idea if that takes affect immediately or not).

I was able to successfully issue the certificate now, but now I have no idea if that is due to the remove of wordpress, due to changing the validation url or just due to the random nature of the ongoing problem.

Is there any way you can see if my request now came thru the production or staging server?

10

If the certificate was issue on the staging server and I switch the setting back to use the production server, will this renewal fail? do they have the same data?

11

Oops, I see that the certificate is indeed from the staging server, and chrome doesn't like it

12

So I switched back to the regular lets-encrypt server and again it failed with the 400 error

https://acme-v02.api.letsencrypt.org/acme/authz-v3/307432882956

13

It still shows "Connection reset by peer" :frowning:

2 Likes
14

Yes I see that, but how do we find out who is blocking it?

I have reached out to liquidweb, they have no clue at the moment.

15

Something that changed sometime last week.

16

In checking logs, I can see that a successful validation shows 6 requests in the server logs (3 each for the domain with and without www), why does it need 3 requests?

(some of the cases where it failed showed 2 successful requests but failed due to the 3rd request apparently failing).

17

So just to test, I switched back to the staging server and I was able to issue a certificate. Then switched back to the production server and it fails again.

18

Sounds like something inline is picky about the inbound IPs.

4 Likes
19

Hi, we have the same issue here. Nothing changed at the config. The target is reachable. But the same error.

Host Name: gxxxxx1.b-x-xecxnic.de
Error Code: 400
Error Type: urn:ietf:params:acme:error:connection
Error Detail: 217.92.XXX.XXX: Fetching http://gxxxxx1.b-x-xecxnic.de/.well-known/acme-challenge/l1TdoTcnmNjvzOK0mVjuocHrVa0qiB-QypB4sc8Tpao: Connection reset by peer

20

@fagopon It is the same error message and the reason is likely that same. You have something that is blocking some or all IP addresses of Let's Encrypt. But, if you want specific help please start a new Help category thread and answer the questions you will be shown. Often problems that look similar at the start end up being very different.

5 Likes