Generating certificate results in invalid_argument error

cristianuibar

I get this error when I try to generate a let's encrypt certificate, what is the problem?

{code: "invalid_argument", detail: "ssl_certificate", message: "Timeout expired"}

The status code seems to be 400.

Are there any logs I can check to see a more detailed error or stacktrace?

Rich

I'd check the nameservers for that domain are correctly setup for that domain and fully propagated, if US DNS checks fail, LE usually will fail. Propagation for NS records can take 24-48 hours.

LE Timeout will happen after X number of tries that fail, you'll also have to wait a little time for your server IP to release to perform updated checks again. (LE safely measure)

You'll probably find the logs under appcd on the server the website is on. I've had that error before and it was a misaligned domain NS records.

cristianuibar

Rich

I was watching DNS propagation using whatsmydns.net and it kept showing the IPs only on some servers.

It was only after I decided to debug this further and tested it with https://dnsviz.net/ and with https://dnssec-analyzer.verisignlabs.com/ that made me realized my mistake.

It seems I had enabled DNSSEC previously but I since moved the domain to another website and that disabled the DNSSEC record for me.

So DNSSEC was an issue in this case.

Rich

cristianuibar Nice one on identifying the issue and sharing back to complete the post 🙂