Cant issue LetsEncrypt certificate if Force SSL is enabled

enhost

Hello,

I have had this issue since I first installed and setup enhance that if I enabled force SSL before requesting the certificate it would fail as it could not access the the .known folder to verify the domain. I initially chalked this up to an issue with trying to enable forced SSL before setting up the certificate.

Now however 90 days later all of my certificates are failing to renew for the same reason and therefore silently take the websites down as the certs fail expire.

Does anybody else have this issue, or is it just my instance?

Adam

Having force SSL enabled shouldn't cause this to happen. What is the exact error from Let's Encrypt? They did have a long API outage yesterday according to their status page.

enhost

Hi @Adam , thanks for getting back to me

This is the error I am constantly getting, I have swapped my domain for example.com and my IP for 0.0.0.0.

If I disable the HTTPS redirect it starts working fine, this is across all domains on my instance.

Failed to issue a Let's Encrypt certificate for example.com: LetsEncrypt challenge failed for example.com: Some(ServerError { type: Some("urn:ietf:params:acme:error:connection"), title: None, status: Some(400), detail: Some("0.0.0.0: Fetching https://example.com/.well-known/acme-challenge/EOjZaEl0H9-XQ8f41xtgP85W4dPud3xUtDST2rPVGQE: Timeout during connect (likely firewall problem)") })

enhost

Hi @Adam sorry to bother you again, do you have any other ideas what may be causing this for me?

Adam

That error suggests that Let's Encrypt can't reach your server on port ipv4/https. Possible causes:

Routing issue between Let's Encrypt and your server
DNS issue, maybe the website has multiple A records
Firewall issue as per the error message - maybe your server has an external firewall which has blocked the IP of the Let's Encrypt server

Gianni

@enhost did you resolve the issue? I'm having the same problem all of a sudden. Certs were renewing ok up until recently.

enhost

Gianni Not really, but the problem went away when I changed to LiteSpeed webserver from apache and now it seems to work fine.

Gianni

I disabled force HTTPS and it renewed the cert no problem.

Potential answer to why:

"The response you provided indicates that there is a redirect in place from the HTTP URL to the HTTPS URL for the .well-known/acme-challenge/ directory. This is likely causing the Let's Encrypt challenge to fail because the challenge is expecting a specific response at the HTTP URL, but it's being redirected to HTTPS."

enhost

Gianni Exact issue I had, same thing does not happen with LiteSpeed so that fixed the issue for me personally. However I do think there is an issue with the way apache handles force HTTPS for the .well-known folder

XN-Matt

Gianni That shouldn't happen as there is an exception so it doesn't redirect the .well-known even if enabled.

All of our sites are enabled/forced and renew OK.

kess

I use Apache since the beginning... never had such problem...

Shaijee

I'm experiencing the same issue when "Force HTTPS" is enabled. However, when it's disabled, the SSL certificate generates without any problems.

Failed to issue a Let's Encrypt certificate for example.com: LetsEncrypt challenge failed for example.com: Some(ServerError { type: Some("urn:ietf:params:acme:error:connection"), title: None, status: Some(400), detail: Some("0.0.0.0: Fetching https://example.com/.well-known/acme-challenge/yC7zVeFjQRSqDuklVeHl-WuJS9CupU9YAiaoUfg3HX4: Connection refused") })

FranzL

This also happened to me today on the control panel site. Disabled "Force HTTPS" and it was able to renew the cert.

cristianuibar

Hello. This happened to me as well just now. For the past few days, I have been unable to renew it.

I used NGINX. I changed the webserver to Apache, but it still didn't work.

The "fix" was to disable "Force SSL" as other colleagues have suggested before.