Resolved Failed to renew SSL certificate with Let's encrypt extension

[Dirk Illenberger]

Hi there,

I am using Plesk Onyx on an Ubuntu Linux to manage a couple of web sites. For most of the domains I use the Plesk "Let's encrypt" extension to manage SSL certificates. This used to work fine until recently when I received an error message that a certificate could not be renewed. I tried to to it manually by clicking on the "Renew" button in the "Let's encrypt" plesk extension. And again I got the same error message:

[2019-08-05 16:59:42.382] ERR [extension/letsencrypt] Domain validation failed for immo-wertschoepfung.de: Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz/ZwkvjOm1v7CHb2Ocms2N73pSkhaYegH90fkqgX4_FW8.
Details:
Type: urn:ietfarams:acme:error:connection
Status: 400
Detail: Fetching https://immo-wertschoepfung.de/.wel...e/J2Ixl-3TYR5XFC3LMl7-gJgVBu8nrmPFs1xeiedcnTY: Timeout during connect (likely firewall problem)

I did a bit of research and here are my results:

• I can read https://immo-wertschoepfung.de/.wel...e/J2Ixl-3TYR5XFC3LMl7-gJgVBu8nrmPFs1xeiedcnTY when I put that URL in a browser.
• Renewing SSL certificates of other domains on the same server still work (so I reckon it's not a firewall issue)

I haven't done any recent changes on the server apart from standard updates.

I googled for a while and found out that quite a few people have the same problem but I could not work out how to solve it in my case. So I very much appreciate any ideas and help from you guys.

Regards,
Dirk.

 

[IgorG]

I googled for a while

Have you seen this article Unable to issue Let's Encrypt certificate in Plesk: "Timeout during connect (likely firewall problem)" OR "Error getting validation data" ?

 

[Dirk Illenberger]

Hi Igor,

thank you very much for your answer. The nmap und dig tests were successful. In the article you referred to it says that it could also be a 30x redirection. In fact, I have such a redirection. So I removed it, tried to renew the certificate and it worked!!

I thought this was strange so I tried to renew certificates of other domains without removing the redirection. This worked perfectly. So, I really don't know what is different in the domain that didn't work but I am really happy that I have a way to renew the certificate.

Therefore, thank you very much Igor for pointing out this article.
Regards,
Dirk.