# .well-known/acme-challenge Connection refused **URL:** \ **Category:** Help\ **Created:** [April 2, 2024, 7:31am UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801 "2024-04-02T07:31:20Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 2, 2024, 7:31am UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/1 "2024-04-02T07:31:20Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: abragam.imt.kit.edu I ran this command: sudo certbot --apache It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log Which names would you like to activate HTTPS for? We recommend selecting either all domains, or all domains in a VirtualHost/server block. * * * 1: abragam.imt.kit.edu 2: www.abragam.imt.kit.edu * * * Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter 'c' to cancel): Requesting a certificate for abragam.imt.kit.edu and www.abragam.imt.kit.edu Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems: Domain: abragam.imt.kit.edu Type: connection Detail: 141.52.156.23: Fetching [http://abragam.imt.kit.edu/.well-known/acme-challenge/95To-8uKY0ju0JvOETjEzuDrFeA-Eb\_PEgZESyPAhcc:](http://abragam.imt.kit.edu/.well-known/acme-challenge/95To-8uKY0ju0JvOETjEzuDrFeA-Eb_PEgZESyPAhcc:) Connection refused Domain: www.abragam.imt.kit.edu Type: dns Detail: DNS problem: NXDOMAIN looking up A for www.abragam.imt.kit.edu - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for www.abragam.imt.kit.edu - check that a DNS record exists for this domain Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet. My web server is (include version): Apache2 The operating system my web server runs on is (include version): Ubuntu 22.04.4 LTS My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): Yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 2.9.0 ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 2, 2024, 12:35pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/2 "2024-04-02T12:35:59Z")
Hi @jnc, and welcome to the LE community forum ๐Ÿ™‚ I see two problems: - all HTTP requests are unable to reach your web server [OR your web server is not configured to respond to HTTP requests] - the HTTPS port is "speaking" HTTP ```nohighlight curl -Ii https://abragam.imt.kit.edu curl: (35) error:0A00010B:SSL routines::wrong version number curl -Ii http://abragam.imt.kit.edu:443 HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 12:32:42 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Tue, 26 Mar 2024 14:24:00 GMT ETag: "5d-614910a96ffd3" Accept-Ranges: bytes Content-Length: 93 Vary: Accept-Encoding Content-Type: text/html ``` Let's have a look at the output of: `sudo apachectl -t -D DUMP_VHOSTS` ---
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 2, 2024, 12:55pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/3 "2024-04-02T12:55:26Z")
> [@rg305](#): > > sudo apachectl -t -D DUMP\_VHOSTS Thank you very much! Here is the output for `sudo apachectl -t -D DUMP_VHOSTS`: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message VirtualHost configuration: \*:443 is a NameVirtualHost default server 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:32) port 443 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:32) port 443 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/default-ssl.conf:2) \*:80 is a NameVirtualHost default server 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1) port 80 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1) port 80 namevhost abragam.imt.kit.edu (/etc/apache2/sites-enabled/test.conf:3) alias www.abragam.imt.kit.edu ---
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 2, 2024, 12:57pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/4 "2024-04-02T12:57:05Z")
I figured out that there has to be some steps I need to perform which i found here > **[KIT / KIT-CA / ACME / acme4netvs ยท GitLab](https://docs.ca.kit.edu/acme4netvs/en/)** > > GitLab am KIT ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 2, 2024, 1:00pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/5 "2024-04-02T13:00:29Z")
You may want to include the alias shown: > [@jnc](#): > > `alias www.abragam.imt.kit.edu` In order to do that, you will have to first update the DNS zone to resolve that name to the same IP as `abragam.imt.kit.edu`. But the real problem now seems to be the lack of HTTP access to your system. ```nohighlight curl -Ii abragam.imt.kit.edu curl: (56) Recv failure: Connection reset by peer ``` See: [Let's Debug (letsdebug.net)](https://letsdebug.net/abragam.imt.kit.edu/1854814) ---
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 2, 2024, 1:08pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/6 "2024-04-02T13:08:47Z")
first update the DNS zone From here? > **[AccountSupport Login](https://secure.accountsupport.com/secure/login.html?st=1712063215&showWebmailTab=)** > > Small business web hosting offering additional business services such as: domain name registrations, email accounts, web services, online community resources and various small business solutions. But the real problem now seems to be the lack of HTTP access to your system. Any advice how to fix it? I can provide my virtual host info if it is useful. Thank you. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 2, 2024, 1:19pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/7 "2024-04-02T13:19:01Z")
Step 1 in getting a cert via `HTTP-01` authentication is having a working HTTP site. Does your site work via HTTP? Can the Internet see your HTTP site? ---
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 2, 2024, 1:58pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/8 "2024-04-02T13:58:43Z")
Hi, it does work via HTTP, only HTTPS is not working ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 2, 2024, 2:17pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/9 "2024-04-02T14:17:52Z")
> [@jnc](#): > > Hi, it does work via HTTP It is not working for requests from the public Internet. Example > **[Test result for abragam.imt.kit.edu: Error](https://letsdebug.net/abragam.imt.kit.edu/1854897)** > > 2 unique issue(s) detected (ANotWorking, IssueFromLetsEncrypt) ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [April 2, 2024, 4:50pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/10 "2024-04-02T16:50:34Z")
Supplemental information; I presently this is what I see. ```nohighlight $ nmap -Pn -p80,443 abragam.imt.kit.edu Starting Nmap 7.80 ( https://nmap.org ) at 2024-04-02 16:44 UTC Nmap scan report for abragam.imt.kit.edu (141.52.156.23) Host is up (0.17s latency). PORT STATE SERVICE 80/tcp closed http 443/tcp open https Nmap done: 1 IP address (1 host up) scanned in 0.91 seconds ``` HTTP - Connection refused ```nohighlight $ curl -Ii http://abragam.imt.kit.edu/.well-known/acme-challenge/sometestfile curl: (7) Failed to connect to abragam.imt.kit.edu port 80 after 361 ms: Connection refused ``` HTTPS - error:0A00010B:SSL routines::wrong version number ```nohighlight $ curl -k -Ii https://abragam.imt.kit.edu/.well-known/acme-challenge/sometestfile curl: (35) error:0A00010B:SSL routines::wrong version number ``` [http://abragam.imt.kit.edu](http://abragam.imt.kit.edu): **443** /.well-known/acme-challenge/sometestfile ```nohighlight $ curl -Ii http://abragam.imt.kit.edu:443/.well-known/acme-challenge/sometestfile HTTP/1.1 404 Not Found Date: Tue, 02 Apr 2024 16:48:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Type: text/html; charset=iso-8859-1 ``` And from around the world HTTP - "Connection refused" [Permanent link to this check report](https://check-host.net/check-report/176120eak475) HTTPS - "ssl3\_get\_record: wrong version number" [Permanent link to this check report](https://check-host.net/check-report/17612387kff0) `http://abragam.imt.kit.edu:443` - "OK" [Permanent link to this check report](https://check-host.net/check-report/17612738ka3d) ---
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 2, 2024, 7:20pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/11 "2024-04-02T19:20:05Z")
Thank you so much. Any guesses? What might be the issue? Why the connection keeps refusing from outside world? ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [April 2, 2024, 7:24pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/12 "2024-04-02T19:24:49Z")
@jnc I believe you have Apache configuration issues. **Apache** information can be found in documentation and forums: - [Documentation: Apache HTTP Server - The Apache HTTP Server Project](https://httpd.apache.org/docs/) - [Apache HTTP Server Support - The Apache HTTP Server Project](https://httpd.apache.org/support.html) - [https://www.apachelounge.com/](https://www.apachelounge.com/) Kindly wait to see if there are more knowledgeable Let's Encrypt community volunteers willing to assist. ---
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 3, 2024, 2:14pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/13 "2024-04-03T14:14:56Z")
Thank you very much. I figured out that the port 80 was closed by the administrators and I got the certificate now (only for abragam.imt.kit.edu and could not get the certificate for www.abragam.imt.kit.edu). However, my website is still only working with http and does not work with https. Any opinion? ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 3, 2024, 2:19pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/14 "2024-04-03T14:19:52Z")
> [@jnc](#): > > However, my website is still only working with http and does not work with https. Any opinion? Let's start by seeing what this looks like now ```nohighlight sudo apachectl -t -D DUMP_VHOSTS ``` And, as for your www subdomain, you should add an A record in your DNS like you have for the root domain. ---
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 3, 2024, 2:26pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/15 "2024-04-03T14:26:07Z")
```nohighlight AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message VirtualHost configuration: *:443 is a NameVirtualHost default server 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:32) port 443 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:32) port 443 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/default-ssl.conf:2) *:80 is a NameVirtualHost default server 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1) port 80 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1) port 80 namevhost abragam.imt.kit.edu (/etc/apache2/sites-enabled/test.conf:3) alias www.abragam.imt.kit.edu ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 3, 2024, 2:27pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/16 "2024-04-03T14:27:51Z")
> [@jnc](#): > > I got the certificate now What command did you use? Because had you used the --apache option like you showed earlier it should have created a VirtualHost for you ---
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 3, 2024, 2:29pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/17 "2024-04-03T14:29:51Z")
Yes, I did use ```nohighlight sudo certbot certonly --apache ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 3, 2024, 2:40pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/18 "2024-04-03T14:40:16Z")
Oh, you added the certonly option on the command. That only gets a certificate it does not configure your Apache to use it. You need to create a VirtualHost manually or try rerunning the command without that option ---
**Author:** ![jnc](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jnc](https://community.letsencrypt.org/u/jnc)\ **Post date:** [April 3, 2024, 2:55pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/19 "2024-04-03T14:55:30Z")
Thanks Mike. I tried both options and restarted apache. ```nohighlight sudo certbot --apache ``` Saving debug log to /var/log/letsencrypt/letsencrypt.log Which names would you like to activate HTTPS for? * * * 1: abragam.imt.kit.edu 2: www.abragam.imt.kit.edu * * * Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter 'c' to cancel): 1 Certificate not yet due for renewal You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry. (ref: /etc/letsencrypt/renewal/abragam.imt.kit.edu.conf) What would you like to do? * * * 1: Attempt to reinstall this existing certificate 2: Renew & replace the certificate (may be subject to CA rate limits) * * * Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Renewing an existing certificate for abragam.imt.kit.edu Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/abragam.imt.kit.edu/fullchain.pem Key is saved at: /etc/letsencrypt/live/abragam.imt.kit.edu/privkey.pem This certificate expires on 2024-07-02. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. Deploying certificate Successfully deployed certificate for abragam.imt.kit.edu to /etc/apache2/sites-enabled/test-le-ssl.conf Your existing certificate has been successfully renewed, and the new certificate has been installed. > I tried with and without port 443 in my virtual host (one vs two blocks) and it looks like below with 2 blocks ```nohighlight DocumentRoot "/var/www/html" ServerName abragam.imt.kit.edu ServerAlias www.abragam.imt.kit.edu ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined # Other directives here RewriteEngine on RewriteCond %{SERVER_NAME} =abragam.imt.kit.edu [OR] RewriteCond %{SERVER_NAME} =www.abragam.imt.kit.edu RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent] DocumentRoot "/var/www/html" ServerName abragam.imt.kit.edu ServerAlias www.abragam.imt.kit.edu ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined # Other directives here RewriteEngine on RewriteCond %{SERVER_NAME} =abragam.imt.kit.edu [OR] RewriteCond %{SERVER_NAME} =www.abragam.imt.kit.edu RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent] ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 3, 2024, 10:03pm UTC](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801/20 "2024-04-03T22:03:57Z")
Abbreviated for clarity. **HTTP redirects to HTTPS:** > [@jnc](#): > > ```nohighlight > > ServerName abragam.imt.kit.edu > ServerAlias www.abragam.imt.kit.edu > RewriteCond %{SERVER_NAME} =abragam.imt.kit.edu [OR] > RewriteCond %{SERVER_NAME} =www.abragam.imt.kit.edu > RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent] > > > ``` **HTTPS redirects to HTTPS:** [this creates an endless loop] > [@jnc](#): > > ```nohighlight > > ServerName abragam.imt.kit.edu > ServerAlias www.abragam.imt.kit.edu > RewriteCond %{SERVER_NAME} =abragam.imt.kit.edu [OR] > RewriteCond %{SERVER_NAME} =www.abragam.imt.kit.edu > RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent] > > > ``` That said, the HTTPS server block has no certificate with which to encrypt any traffic. So, it likely fails to do anything. OR It tries to serve HTTP content on port 443. [Next page](https://community.letsencrypt.org/t/well-known-acme-challenge-connection-refused/215801.md?page=2)