Wacs Domain cert generation - test successful but real fails 400

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: mattball.co.uk, home.mattball.co.uk, and mattball.mooo.com

I ran this command: WACS (Win-acme 2.2.9.1701)

It produced this output:

1: http (3 bindings)

Site identifier(s) or <Enter> to choose all: <Enter>

1: mattball.co.uk (Site 1)
2: home.mattball.co.uk (Site 1)
3: mattball.mooo.com (Site 1)

Listed above are the bindings found on the selected site(s). By default all
of them will be included, but you may either pick specific ones by typing the
host names or identifiers (comma-separated) or filter them using one of the
options from the menu.

P: Pick bindings based on a search pattern
R: Pick bindings based on a regular expression
A: Pick *all* bindings

Binding identifiers(s) or menu option: 1

 1: mattball.co.uk (Site 1)

Continue with this selection? (y*/n) - yes

Friendly name '[IIS] (any site), mattball.co.uk'. <Enter> to accept or type desired name: <Enter>

 By default your source identifiers are covered by a single certificate. But
if you want to avoid the 100 domain limit, want to prevent information
disclosure via the SAN list, and/or reduce the operational impact of a single
validation failure, you may choose to convert one source into multiple
certificates, using different strategies.

4: Single certificate
Would you like to split this source into multiple certificates?: 4

 The ACME server will need to verify that you are the owner of the domain
names that you are requesting the certificate for. This happens both during
initial setup *and* for every future renewal. There are two main methods of
doing so: answering specific http requests (http-01) or create specific dns
records (dns-01). For wildcard identifiers the latter is the only option.
Various additional plugins are available from
https://github.com/win-acme/win-acme/.

Have tried both 2 and 9
2: [http] Serve verification files from memory
9: [tls-alpn] Answer TLS verification request from win-acme

How would you like prove ownership for the domain(s)?: <Enter>

After ownership of the domain(s) has been proven, we will create a
Certificate Signing Request (CSR) to obtain the actual certificate. The CSR
determines properties of the certificate like which (type of) key to use. If
you are not sure what to pick here, RSA is the safe default.

2: RSA key

What kind of private key should be used for the certificate?: <Enter>


When we have the certificate, you can store in one or more ways to make it
accessible to your applications. The Windows Certificate Store is the default
location for IIS (unless you are managing a cluster of them).
4: Windows Certificate Store (Local Computer)

How would you like to store the certificate?: <Enter>
3: [Default] - Use global default, currently WebHosting

Choose store to use, or type the name of another unlisted store: <Enter>
5: No (additional) store steps

Would you like to store it in another way too?: <Enter>

[VERB] Autofac: creating PluginFrontend<InstallationPluginOptions> scope with parent target
[VERB] Autofac: creating PluginFrontend<InstallationPluginOptions> scope with parent target
[VERB] Autofac: creating PluginFrontend<InstallationPluginOptions> scope with parent target

With the certificate saved to the store(s) of your choice, you may choose one
or more steps to update your applications, e.g. to configure the new
thumbprint, or to update bindings.

1: Create or update bindings in IIS

Which installation step should run first?: <Enter>

This plugin will update *all* binding using the previous certificate in both
Web and FTP sites, regardless of whether those bindings were created manually
or by the program itself. Therefor you'll never need to run this installation
step twice.

During initial setup, it will try to make as few changes as possible to IIS
to cover the source identifiers. If new bindings are needed, by default it
will create those at the same site where the HTTP binding for that host was
found.

Create new bindings in a different site? (y/n*) - no

3: No (additional) installation steps

Add another installation step?: <Enter>

[VERB] Constructing ACME protocol client...
[VERB] Getting service directory...
[DBUG] [HTTP] Send GET to https://acme-v02.api.letsencrypt.org/directory
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {
 "5sQi4TwVJRk": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
 "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
 "meta": {
   "caaIdentities": [
     "letsencrypt.org"
   ],
   "profiles": {
     "classic": "https://letsencrypt.org/docs/profiles#classic",
     "shortlived": "https://letsencrypt.org/docs/profiles#shortlived",
     "tlsclient": "https://letsencrypt.org/docs/profiles#tlsclient",
     "tlsserver": "https://letsencrypt.org/docs/profiles#tlsserver"
   },
   "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.6-August-18-2025.pdf",
   "website": "https://letsencrypt.org"
 },
 "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
 "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
 "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
 "renewalInfo": "https://acme-v02.api.letsencrypt.org/acme/renewal-info",
 "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
}
[DBUG] Loading signer from C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Signer_v2
[DBUG] Loading account from C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Registration_v2
[VERB] Using existing ACME account
[DBUG] Using default account...
[VERB] Autofac: creating Execution scope with parent wacs
[VERB] Autofac: creating PluginBackend<ITargetPlugin> scope with parent Execution
[VERB] W3SVC detected and running
[VERB] No FTPSVC detected
[DBUG] Scanning IIS bindings for host names
[VERB] 3 named bindings found in IIS
[DBUG] Filtering based on binding type
[VERB] No site filter applied
[DBUG] Filtering by host: ^(mattball\.co\.uk)$
[VERB] 1 bindings remaining after host filter
[VERB] 1 matching binding found
[INFO] Plugin IIS generated source mattball.co.uk with 1 identifiers
[VERB] Autofac: creating Split scope with parent PluginBackend<ITargetPlugin>
[VERB] Autofac: creating PluginBackend<IOrderPlugin> scope with parent Split
[INFO] Plugin Single created 1 order
[VERB] Checking [IIS] (any site), mattball.co.uk
[VERB] Autofac: creating Order scope with parent PluginBackend<ITargetPlugin>
[VERB] Autofac: creating PluginBackend<ICsrPlugin> scope with parent order-main
[DBUG] Reading certificate cache
[DBUG] No cache files found for renewal
[VERB] Order Main should run (new/changed source)
[VERB] Obtain order details for Main
[DBUG] Refreshing cached order
[DBUG] Refreshing order...
[DBUG] [HTTP] Send HEAD to https://acme-v02.api.letsencrypt.org/acme/new-nonce
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Empty response
[DBUG] [HTTP] Send POST to https://acme-v02.api.letsencrypt.org/acme/order/1491669486/501142272921
[VERB] [HTTP] Request content: {"protected":"eyJhbGciOiJFUzI1NiIsInVybCI6Imh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL29yZGVyLzE0OTE2Njk0ODYvNTAxMTQyMjcyOTIxIiwibm9uY2UiOiJua3Eza2tzWmN4cWF4YVVqMmdrUmoxREVDOWNxSy1pSGx6SUQ2eDNVeF85UWxyWUxSOGMiLCJraWQiOiJodHRwczovL2FjbWUtdjAyLmFwaS5sZXRzZW5jcnlwdC5vcmcvYWNtZS9hY2N0LzE0OTE2Njk0ODYifQ","payload":"","signature":"8lN5Gs_A2Nnt_gSbhnqxewsKCZl7J0c4e40NtbnKIiogL9kQHeaAVZ64HVWXk5Gy0SQA3OUl2Xfi0tGBem7kfQ"}
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {
 "status": "invalid",
 "expires": "2026-04-23T02:05:08Z",
 "identifiers": [
   {
     "type": "dns",
     "value": "mattball.co.uk"
   }
 ],
 "authorizations": [
   "https://acme-v02.api.letsencrypt.org/acme/authz/1491669486/688849310161"
 ],
 "finalize": "https://acme-v02.api.letsencrypt.org/acme/finalize/1491669486/501142272921"
}
[WARN] Cached order has status invalid, discarding
[DBUG] Deleted C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Orders\fe1f768e776c6e28ca603943290832197b1b2464.order.json
[VERB] Creating order for identifiers: ["mattball.co.uk"] (notAfter: null, previous: [none])
[DBUG] [HTTP] Send POST to https://acme-v02.api.letsencrypt.org/acme/new-order
[VERB] [HTTP] Request content: {"protected":"eyJhbGciOiJFUzI1NiIsInVybCI6Imh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL25ldy1vcmRlciIsIm5vbmNlIjoid04wV1hDcnh6MnRFZkFtc0pPdnZhQTFvd0NQcV8xN1FQWm8zbzlDUjliRVZCQ3lMN1VRIiwia2lkIjoiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYWNjdC8xNDkxNjY5NDg2In0","payload":"eyJpZGVudGlmaWVycyI6W3sidHlwZSI6ImRucyIsInZhbHVlIjoibWF0dGJhbGwuY28udWsifV19","signature":"9EQcOMWGfzVDQBZvhpouvJhpl2GXuEmJFI9A49LSmUD3xh9bmeWO1ZGoc5PP3nPrhPMCCy0KQqGE-HDUE0xHHw"}
[VERB] [HTTP] Request completed with status Created
[VERB] [HTTP] Response content: {
 "status": "pending",
 "expires": "2026-04-23T02:15:49Z",
 "identifiers": [
   {
     "type": "dns",
     "value": "mattball.co.uk"
   }
 ],
 "authorizations": [
   "https://acme-v02.api.letsencrypt.org/acme/authz/1491669486/688853305011"
 ],
 "finalize": "https://acme-v02.api.letsencrypt.org/acme/finalize/1491669486/501145090981"
}
[VERB] Order https://acme-v02.api.letsencrypt.org/acme/order/1491669486/501145090981 created
[DBUG] [HTTP] Send POST to https://acme-v02.api.letsencrypt.org/acme/authz/1491669486/688853305011
[VERB] [HTTP] Request content: {"protected":"eyJhbGciOiJFUzI1NiIsInVybCI6Imh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2F1dGh6LzE0OTE2Njk0ODYvNjg4ODUzMzA1MDExIiwibm9uY2UiOiJ3TjBXWENyeHR4Q29GNEJ3Uk5rTGk1MnNzUGVEOHdYOTBPclFSelBjTVlwNzBGeUZ5eUEiLCJraWQiOiJodHRwczovL2FjbWUtdjAyLmFwaS5sZXRzZW5jcnlwdC5vcmcvYWNtZS9hY2N0LzE0OTE2Njk0ODYifQ","payload":"","signature":"SP30sQMi_9gCsWEuP4MpM9rY7nZHhDMBKfCfq0ERrJmkNsj-_jqIp9bsPVFDLcMoXS3eQFofKr-pDmiHwkfCZA"}
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {
 "identifier": {
   "type": "dns",
   "value": "mattball.co.uk"
 },
 "status": "pending",
 "expires": "2026-04-23T02:15:49Z",
 "challenges": [
   {
     "type": "dns-01",
     "url": "https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/ZINcbA",
     "status": "pending",
     "token": "aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo"
   },
   {
     "type": "http-01",
     "url": "https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/raHauQ",
     "status": "pending",
     "token": "aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo"
   },
   {
     "type": "tls-alpn-01",
     "url": "https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/FBOnNQ",
     "status": "pending",
     "token": "aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo"
   }
 ]
}
[VERB] Autofac: creating Target scope with parent PluginBackend<ICsrPlugin>
[VERB] Autofac: creating PluginFrontend<ValidationPluginOptions> scope with parent target
[VERB] W3SVC detected and running
[VERB] No FTPSVC detected
[VERB] Autofac: creating PluginBackend<IValidationPlugin> scope with parent PluginBackend<ICsrPlugin>
[VERB] Handle authorization 1/1
[VERB] Autofac: creating PluginBackend<IValidationPlugin> scope with parent PluginBackend<ICsrPlugin>
[INFO] [mattball.co.uk] Authorizing...
[VERB] [mattball.co.uk] Initial authorization status: pending
[VERB] [mattball.co.uk] Challenge types available: ["dns-01", "http-01", "tls-alpn-01"]
[VERB] [mattball.co.uk] Initial challenge status: pending
[INFO] [mattball.co.uk] Authorizing using http-01 validation (SelfHosting)
[VERB] Starting commit stage
[VERB] Commit was succesful
[DBUG] [mattball.co.uk] Submitting challenge answer
[DBUG] [HTTP] Send POST to https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/raHauQ
[VERB] [HTTP] Request content: {"protected":"eyJhbGciOiJFUzI1NiIsInVybCI6Imh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2NoYWxsLzE0OTE2Njk0ODYvNjg4ODUzMzA1MDExL3JhSGF1USIsIm5vbmNlIjoibmtxM2trc1pud25iZkZQZXpxUG1TcTNVN2JaSmwwZHhVSzNqYXliTk9KamxVU1pZQWtZIiwia2lkIjoiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYWNjdC8xNDkxNjY5NDg2In0","payload":"e30","signature":"aKwMN5jLdYEBx2kykGt_aGYT3CMYcjyvoXeyXh9sZQICr-ZNVrFHd8JstZhuthKVPoXkey24BAmyXPgqkiAy7w"}
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {
 "type": "http-01",
 "url": "https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/raHauQ",
 "status": "pending",
 "token": "aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo"
}
[DBUG] Refreshing authorization (1/15)
[DBUG] [HTTP] Send POST to https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/raHauQ
[VERB] [HTTP] Request content: {"protected":"eyJhbGciOiJFUzI1NiIsInVybCI6Imh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2NoYWxsLzE0OTE2Njk0ODYvNjg4ODUzMzA1MDExL3JhSGF1USIsIm5vbmNlIjoid04wV1hDcnhOYzVoYl9BMUZDbVNqTUQ1T08tNld3dndyMFMtMXV0VlB3NkdlWHJzT2pjIiwia2lkIjoiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYWNjdC8xNDkxNjY5NDg2In0","payload":"","signature":"gxU0clsynZPWkRqpCF4unybgxE-85GNCNKSo6yaXWqQ_eX0Wr-c-ihqzOrLC_eWfsTsCiFmIUgUflsZXQPzU1A"}
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {
 "type": "http-01",
 "url": "https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/raHauQ",
 "status": "pending",
 "token": "aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo"
}
[DBUG] Refreshing authorization (2/15)
[DBUG] [HTTP] Send POST to https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/raHauQ
[VERB] [HTTP] Request content: {"protected":"eyJhbGciOiJFUzI1NiIsInVybCI6Imh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2NoYWxsLzE0OTE2Njk0ODYvNjg4ODUzMzA1MDExL3JhSGF1USIsIm5vbmNlIjoibmtxM2trc1p2YWI0MU9zLUlSQ0Q2eTlfc0pHcVE3MG0wOVR1ZnZLNmRtT3ktRzc3bF9BIiwia2lkIjoiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYWNjdC8xNDkxNjY5NDg2In0","payload":"","signature":"ClQHIq7ghz5kEn77SOJUOfU_rFxKm8i8tlCFoWcxs6Z_m_myxB3cFX4WiS4GLc4La2Esj4U8Rx0CUerusFFX6A"}
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {
 "type": "http-01",
 "url": "https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/raHauQ",
 "status": "invalid",
 "validated": "2026-04-16T02:15:49Z",
 "error": {
   "type": "urn:ietf:params:acme:error:connection",
   "detail": "62.64.147.173: Fetching http://mattball.co.uk/.well-known/acme-challenge/aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo: Timeout during connect (likely firewall problem)",
   "status": 400
 },
 "token": "aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo",
 "validationRecord": [
   {
     "url": "http://mattball.co.uk/.well-known/acme-challenge/aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo",
     "hostname": "mattball.co.uk",
     "port": "80",
     "addressesResolved": [
       "62.64.147.173"
     ],
     "addressUsed": "62.64.147.173"
   }
 ]
}
[EROR] [mattball.co.uk] Authorization result: invalid
[EROR] [mattball.co.uk] {"type":"urn:ietf:params:acme:error:connection","detail":"62.64.147.173: Fetching http://mattball.co.uk/.well-known/acme-challenge/aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo: Timeout during connect (likely firewall problem)","status":400,"instance":null}
[VERB] Starting post-validation cleanup
[VERB] Post-validation cleanup was successful
[INFO] [mattball.co.uk] Deactivating pending authorization
[DBUG] [HTTP] Send POST to https://acme-v02.api.letsencrypt.org/acme/authz/1491669486/688853305011
[VERB] [HTTP] Request content: {"protected":"eyJhbGciOiJFUzI1NiIsInVybCI6Imh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2F1dGh6LzE0OTE2Njk0ODYvNjg4ODUzMzA1MDExIiwibm9uY2UiOiJ3TjBXWENyeFN3TnV5RXFkNm9JemttTUZqVzlLN2xEV2hCOWhQZE4tOER2RVZDLUo5OXciLCJraWQiOiJodHRwczovL2FjbWUtdjAyLmFwaS5sZXRzZW5jcnlwdC5vcmcvYWNtZS9hY2N0LzE0OTE2Njk0ODYifQ","payload":"eyJzdGF0dXMiOiJkZWFjdGl2YXRlZCJ9","signature":"ZTF_G4kURBvAW3axUEk6fsMl9G9J19Sa9a4wOc2g9G0Ry4k3jSk44CLLhik99XCayVnLF1XOYXo9nEXd5TOQ-g"}
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {
 "identifier": {
   "type": "dns",
   "value": "mattball.co.uk"
 },
 "status": "deactivated",
 "expires": "2026-04-23T02:15:49Z",
 "challenges": [
   {
     "type": "http-01",
     "url": "https://acme-v02.api.letsencrypt.org/acme/chall/1491669486/688853305011/raHauQ",
     "status": "invalid",
     "validated": "2026-04-16T02:15:49Z",
     "error": {
       "type": "urn:ietf:params:acme:error:connection",
       "detail": "62.64.147.173: Fetching http://mattball.co.uk/.well-known/acme-challenge/aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo: Timeout during connect (likely firewall problem)",
       "status": 400
     },
     "token": "aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo",
     "validationRecord": [
       {
         "url": "http://mattball.co.uk/.well-known/acme-challenge/aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo",
         "hostname": "mattball.co.uk",
         "port": "80",
         "addressesResolved": [
           "62.64.147.173"
         ],
         "addressUsed": "62.64.147.173"
       }
     ]
   }
 ]
}
Order 1/1 (Main): error Validation failed
Processing order 1/1: Main

My web server is (include version): IIS 10.0

The operating system my web server runs on is (include version): Win 11 Pro

My hosting provider, if applicable, is: Giganet

I can login to a root shell on my machine (yes or no, or I don't know): Windows / yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): not using certbot

So this previously used to work just fine.. I ran a Cisco ASA 5506 with ports open for 80/443, and semi restricted to the source IP's.

Every few months I'd "open" up the source ip ranges, run the Acme SSL process, renew, then lock down the IP's again. No big issue. I also export one cert to pfx to use in a 3rd party app.

Now I've replace the 5506 with a Cisco FPR1010 in ASA mode, so same setup. Manually configured the firewall, nothing fancy, have tried disabling threat detection, http is not inspected, shun disabled etc, and 80/443 are accessible as normal. I open up the "source ips" to all , run the acme updater, and this is the error I get, 400.

It's like LetsEncrypt just can't find my server.
Now I can't use DNS easily, as I have a dynamic ip address.
So my mattball.co.uk and home.mattball.co.uk point to mattball.mooo.com (cname), which is dynamically updated to my IP. Being a DDNS entry, I can't update dns for mooo.com as I don't own it.

Typically, my priority is to generate a cert (pfx) for mattball.mooo.com, and ideally get the rest resolved but I cannot for the life of me figure out what's going on. Have tried all options and variations within Win-Acme. Tried removing my 443 bindings and using option tls-alpn, still fails.
Tried save verification files on network path and copying them into the iis .well-known\acme-challenge etc...

Still get Timeout during connect (likely firewall problem)","status":400,"instance":null}

Oh and the fun part is, if I run --test, it works perfectly fine....!?!?!?!?

Grrrrrrrr I only spent 4-5 hours on it tonight, from 11pm to 3.30am... so i'm really really stumped!

I can confirm if I open my port 80/443 to "any", it's accessible from ANYWHERE. (vpns, remote clients and friends abroad can all access it okay etc)

Any thoughts anyone, before I have to trodge off and buy a bunch of SSLs?

Your thoughts and ideas are greatly appreciated.

Matt

2

The IP is resolving fine, but either your router is not forwarding the port 80 request to your internal machine IP, or your machine firewall is blocking it, or your ISP is not allowing it.

The test is pretty easy, setup an http website that works locally, then test it as http on your phone using mobile data (not your wifi). If that works then you have working http, if not then fix that first.

It's often easier to use DNS challenges than to get self-hosted http forwarding to work.

Personally I'd advise against home hosting and if you need to access home based services yourself use tailscale etc. It's not worth it if your home machine gets compromised.

3

"error 400" is a bit vague...
Here is the more complete error message:

"detail":"62.64.147.173: Fetching http://mattball.co.uk/.well-known/acme-challenge/aUk8z1hkk1DiyF_3FtDsHgFDYWpTafERTEjakeURGLo: Timeout during connect (likely firewall problem)"`

note the "Timeout during connect (likely firewall problem)"

4

Yes, I can see from the public CT logs that you did get a certificate from Let's Encrypt staging. Which makes it all the more puzzling why you cannot get a production certificate. I don't have a specific suggestion right now but just wanted to highlight that for other volunteers. I saw the staging cert using censys

5

Thanks MikeMcQ

I can for sure confirm that port 80 is open to the public when running the cert request... I just have it locked down to customer IP addresses once it's completed.

Have been doing this same process for years without issue.. it's just this time that strangely the test works and passes, I can browse http from externally, yet it's as though LE is just unable to get to it.

Is there any way I can do an HTTP test from LE's side to troubleshoot why it's not working?
I can't see any other way to get the certs in place... other than buying them... which isn't cheap

6

What makes this worse is I can't run the "real" process too often for fear of hitting a limit...
The staging process is there to test things, but that works fine....
For an unknown reason, the live attempt just refuses to access the site.

7

Were there any changes to your network provider when you got the new Cisco?

There is no good reason from the LE side that a test from the Staging system would reach you but production would not. Sure, they are different IP addresses but the primary validation servers are in the same locale / system. They use one of the Cloudflare commercial networks (Magic Transit?) for the primary center and AWS based for the (currently) 4 secondary centers. Yours is failing at the primary as otherwise we'd see "Secondary" in the error.

Do you see the inbound HTTP request reach your Cisco? If not then somewhere in the backbone the packet is getting lost. These sometimes resolve on their own as the network providers discover and repair the problem.

Yes, switch to using the dns-01 challenge. Looks like GoDaddy is your DNS provider and they recently re-opened their API for this purpose. Beyond that I gave this advice which may be an option for you too: Posh-acme db_error submitting renewal - #8 by MikeMcQ

8

Tada - Figured it out in the end!

When migrating firewalls, i'd previously attempted to import the previous backup from the 5506.
Some of the rules were "actively" denying traffic, even though the rule wasn't listed in the ASDM.

Only showed when doing packet tracing and monitoring, I could see the request being denied but when selecting "show the rule".. it couldn't find it.

Ran command lines to clear out those stale rules... and boom.. it worked first time.

Thanks to everyone - Esp MikeMcQ, for taking an interest in this headache - muchly appreciated!

Win-Acme lives to fight another day...