Waiting for verification... Challenge failed for domain

jirirohlicek · April 25, 2022, 10:50am

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: portalistest.caa.cz

I ran this command: /bin/certbot renew

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/portalis.caa.cz.conf

OCSP check failed for /etc/letsencrypt/archive/portalis.caa.cz/cert28.pem (are we offline?)
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate for portalis.caa.cz
Performing the following challenges:
http-01 challenge for portalis.caa.cz
Waiting for verification...
Challenge failed for domain portalis.caa.cz
http-01 challenge for portalis.caa.cz
Cleaning up challenges
Failed to renew certificate portalis.caa.cz with error: Some challenges have failed.

Processing /etc/letsencrypt/renewal/portalistest.caa.cz.conf

OCSP check failed for /etc/letsencrypt/archive/portalistest.caa.cz/cert27.pem (are we offline?)
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate for portalistest.caa.cz
Performing the following challenges:
http-01 challenge for portalistest.caa.cz
Waiting for verification...
Challenge failed for domain portalistest.caa.cz
http-01 challenge for portalistest.caa.cz
Cleaning up challenges
Failed to renew certificate portalistest.caa.cz with error: Some challenges have failed.

All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/portalis.caa.cz/fullchain.pem (failure)
/etc/letsencrypt/live/portalistest.caa.cz/fullchain.pem (failure)

2 renew failure(s), 0 parse failure(s)

My web server is (include version):

The operating system my web server runs on is (include version): Apache/2.4.6 () OpenSSL/1.0.2k-fips

My hosting provider, if applicable, is: N/A

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.11.0

Osiris · April 25, 2022, 4:06pm

Certbot should also have provided error messages provided by the ACME server, could you post those too please?

If you can't see them, you could share the log file.

MikeMcQ · April 25, 2022, 4:52pm

Yes, the error messages from certbot would be helpful. But, right now it looks like a firewall is blocking both ports 80 and 443.

You can check port 80 using the Let's Debug tool

jirirohlicek · April 25, 2022, 5:56pm

Thank you for your help. I supposed problem connecting http://portalis.caa.cz:80, I tested from other public IP's and got connected.
I have to check with infrastructure admin if there is some block for letsencrypt servers.

jirirohlicek · April 25, 2022, 6:15pm

tail -f /var/log/firewalld-droppd.log

Apr 25 20:09:50 portalis kernel: rpfilter_DROP: IN=eth0 OUT= MAC=33:33:00:00:00:01:00:1c:7f:00:0b:19:86:dd SRC=2001:0af0:8000:1e01:0000:0000:0000:0065 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0

Apr 25 20:10:50 portalis kernel: rpfilter_DROP: IN=eth0 OUT= MAC=33:33:00:00:00:01:00:1c:7f:00:0b:19:86:dd SRC=2001:0af0:8000:1e01:0000:0000:0000:0065 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0

Apr 25 20:13:51 portalis kernel: rpfilter_DROP: IN=eth0 OUT= MAC=33:33:00:00:00:01:00:1c:7f:00:0b:19:86:dd SRC=2001:0af0:8000:1e01:0000:0000:0000:0065 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0

certbot log

/bin/certbot renew

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/portalis.caa.cz.conf

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate for portalis.caa.cz
Performing the following challenges:
http-01 challenge for portalis.caa.cz
Waiting for verification...
Challenge failed for domain portalis.caa.cz
http-01 challenge for portalis.caa.cz
Cleaning up challenges
Failed to renew certificate portalis.caa.cz with error: Some challenges have failed.

Processing /etc/letsencrypt/renewal/portalistest.caa.cz.conf

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate for portalistest.caa.cz
Performing the following challenges:
http-01 challenge for portalistest.caa.cz
Waiting for verification...
Challenge failed for domain portalistest.caa.cz
http-01 challenge for portalistest.caa.cz
Cleaning up challenges
Failed to renew certificate portalistest.caa.cz with error: Some challenges have failed.

All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/portalis.caa.cz/fullchain.pem (failure)
/etc/letsencrypt/live/portalistest.caa.cz/fullchain.pem (failure)

2 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

The following errors were reported by the server:

Domain: portalis.caa.cz
Type: connection
Detail: 193.86.115.73: Fetching
http://portalis.caa.cz/.well-known/acme-challenge/WKciji370MTTZ4lW_8OLPtvOY9sRD0Q1m54KQzNOlv0:
Timeout during connect (likely firewall problem)

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.

The following errors were reported by the server:

Domain: portalistest.caa.cz
Type: connection
Detail: 193.86.115.73: Fetching
http://portalistest.caa.cz/.well-known/acme-challenge/aUSOYjXmSSO8ukAxmAhp4FWGSWM1-XjfqqY5wCZrHMQ:
Timeout during connect (likely firewall problem)

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.

jirirohlicek · April 25, 2022, 6:21pm

letsencrypt.log.txt (56.2 KB)

MikeMcQ · April 25, 2022, 6:37pm

It is not just Let's Encrypt servers. I cannot reach http://portalis.caa.cz from my test server in an AWS region in the US east coast. The Let's Debug tool I linked to is good first test.

Check if maybe there is a geographic based firewall. Also make sure you are testing from other IPs in the public internet (not your local network). Also test to make sure your server public IP still matches your DNS.

curl -I -m10 portalis.caa.cz
curl: (28) Connection timed out after 10001 milliseconds

rg305 · April 25, 2022, 7:22pm

Problem #1:

curl -Ii http://portalis.caa.cz/
curl: (56) Recv failure: Connection reset by peer

curl -Ii https://portalis.caa.cz/
curl: (7) Failed to connect to portalis.caa.cz port 443: Connection timed out

jirirohlicek · April 27, 2022, 6:14am

Thank all for your help. Customer staff told me, they have set up geoblocking, access from Czech Republic territory only.
We have to set up some exception for certificate renewal.

I added admins email to notify them on certificate problem and told them how to run renewal manually. I think this is the best solution.

system · May 27, 2022, 6:15am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Failed to renew - Some challenges have failed Help	3	623	January 9, 2022
Challenge failed for domain Help	12	3027	September 3, 2020
Renew stopped working, new certs not working too Help	2	535	April 22, 2020
The Certificate Authority failed to download the temporary challenge files created by Certbot, while port 80 is open Help	5	119	March 17, 2025
Challenge failed Help	19	637	July 28, 2023

Waiting for verification... Challenge failed for domain

tail -f /var/log/firewalld-droppd.log

Apr 25 20:13:51 portalis kernel: rpfilter_DROP: IN=eth0 OUT= MAC=33:33:00:00:00:01:00:1c:7f:00:0b:19:86:dd SRC=2001:0af0:8000:1e01:0000:0000:0000:0065 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0

/bin/certbot renew

Thank all for your help. Customer staff told me, they have set up geoblocking, access from Czech Republic territory only. We have to set up some exception for certificate renewal.

Related topics

Thank all for your help. Customer staff told me, they have set up geoblocking, access from Czech Republic territory only.
We have to set up some exception for certificate renewal.