| SYSTEM INFORMATION | |
|---|---|
| OS type and version | Ubuntu Linux 24.04.3 |
| Webmin version | 2.520 |
| Virtualmin version | 7.50.0 Professional |
| Webserver version | Apache version 2.4.58 |
| Related packages | n/a |
Failed while requesting a certificate for xxx.com, www.xxx.com from Let’s Encrypt ..
.. request failed, I cannot find the 'acme … ’ file
does anyone know where I should find the file created by certbot? Also the Webserver is actually apache, but he letsencrypt log seem to indicate it expect nginx
This problem just started 3 days ago, but has already renewed 6 different Domain certificates more than 5 times for each … nothing modified for the two domains that started failing in the last few days … I am looking for clues about why it happened and how to fix it.
Diagnostic info: Web-based validation failed :
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for xxx.com and www.xxx.com
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: xxx.com
Type: connection
Detail: IP4Address: Fetching https:///.well-known/acme-challenge/GOsZ5je2-aDkgalzb7wKgpLW6vGNksIkgTuy9jhg9Us: Invalid empty host in redirect target
Domain: www.xxx.com
Type: connection
Detail: IPAddrress: Fetching https:///.well-known/acme-challenge/WIdKAlqKmX96kfC1tLCgefxKHq77zp–nSNMU4G0OKU: Invalid empty host in redirect target
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
All challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
DNS-based validation failed :
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for xxx.com and www.xxx.com
Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: xxx.com
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.xxx.com - check that a DNS record exists for this domain
Domain: www.xxx.com
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.www.xxxcom - check that a DNS record exists for this domain
Hint: The Certificate Authority failed to verify the DNS TXT records created by the --manual-auth-hook. Ensure that this hook is functioning correctly and that it waits a sufficient duration of time for DNS propagation. Refer to “certbot --help manual” and the Certbot User Guide.
All challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
letsencrypt log excerpt: Requesting a certificate for xxx.com, www.xxx.com from Let’s Encrypt ..
.. request failed : Web-based validation failed :
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for xxx.com and www.xxx.com
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: xxx.com
Type: connection
Detail: IP$ Address: Fetching https:///.well-known/acme-challenge/GOsZ5je2-aDkgalzb7wKgpLW6vGNksIkgTuy9jhg9Us: Invalid empty host in redirect target
Domain: www.xxx.com
Type: connection
Detail: IP$ Address: Fetching https:///.well-known/acme-challenge/WIdKAlqKmX96kfC1tLCgefxKHq77zp–nSNMU4G0OKU: Invalid empty host in redirect target
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
All challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
DNS-based validation failed :
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for xxx.com and www.xxx.com
Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: xxx.com
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.xxx.com - check that a DNS record exists for this domain
Domain: www.xxx.com
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.www.xxx.com - check that a DNS record exists for this domain
Hint: The Certificate Authority failed to verify the DNS TXT records created by the --manual-auth-hook. Ensure that this hook is functioning correctly and that it waits a sufficient duration of time for DNS propagation. Refer to “certbot --help manual” and the Certbot User Guide.
All challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
letsencrypt log file excerpt:
2025-11-25 15:41:55,662:DEBUG:certbot._internal.main:certbot version: 2.9.0
2025-11-25 15:41:55,662:DEBUG:certbot._internal.main:Location of certbot entry point: /bin/letsencrypt
2025-11-25 15:41:55,663:DEBUG:certbot._internal.main:Arguments: [‘-a’, ‘webroot’, ‘-d’, ‘xxx.com’, ‘-d’, ‘xxx.com’, ‘–webroot-path’, ‘/home/xxx/public_html’, ‘–duplicate’, ‘–force-renewal’, ‘–non-interactive’, ‘–agree-tos’, ‘–config’, ‘/tmp/.webmin/300939_8878_1_letsencrypt.cgi’, ‘–rsa-key-size’, ‘2048’, ‘–cert-name’, ‘xxx.com’, ‘–no-autorenew’, ‘–reuse-key’, ‘–key-type’, ‘rsa’]
2025-11-25 15:41:55,663:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2025-11-25 15:41:55,675:DEBUG:certbot._internal.log:Root logging level set at 30
2025-11-25 15:41:55,676:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2025-11-25 15:41:55,676:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * webroot
Description: Saves the necessary validation files to a .well-known/acme-challenge/ directory within the nominated webroot path. A seperate HTTP server must be running and serving files from the webroot path. HTTP challenge only (wildcards not supported).
Interfaces: Authenticator, Plugin
Entry point: EntryPoint(name=‘webroot’, value=‘certbot._internal.plugins.webroot:Authenticator’, group=‘certbot.plugins’)
Initialized: <certbot._internal.plugins.webroot.Authenticator object at 0x78195b665d30>
Prep: True
2025-11-25 15:41:55,676:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot._internal.plugins.webroot.Authenticator object at 0x78195b665d30> and installer None
2025-11-25 15:41:55,676:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator webroot, Installer None
2025-11-25 15:41:55,851:DEBUG:certbot._internal.main:Picked account: <Account(RegistrationResource(body=Registration(key=None, contact=(), agreement=None, status=None, terms_of_service_agreed=None, only_return_existing=None, external_account_binding=None), uri=‘https://acme-v02.api.letsencrypt.org/acme/acct/2139127305’, new_authzr_uri=None, terms_of_service=None), dc5deccf68d319b72d35d02461d2f21b, Meta(creation_dt=datetime.datetime(2024, 12, 28, 20, 44, 46, tzinfo=), creation_host=‘xxx.ca’, register_to_eff=None))>
2025-11-25 15:41:55,852:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2025-11-25 15:41:55,867:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2025-11-25 15:41:56,101:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 “GET /directory HTTP/1.1” 200 1063
2025-11-25 15:41:56,102:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx <<< not Apache? Why?
Date: Tue, 25 Nov 2025 20:41:56 GMT
Content-Type: application/json
Content-Length: 1063
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
“BVDsvoC2wg0”: “Adding random entries to the directory - API Announcements - Let's Encrypt Community Support”,
“keyChange”: “https://acme-v02.api.letsencrypt.org/acme/key-change”,
“meta”: {
“caaIdentities”: [
“letsencrypt.org”
],
“profiles”: {
“classic”: “Profiles - Let's Encrypt”,
“shortlived”: “Profiles - Let's Encrypt (not yet generally available)”,
“tlsclient”: “Profiles - Let's Encrypt”,
“tlsserver”: “Profiles - Let's Encrypt”
},
“termsOfService”: “https://letsencrypt.org/documents/LE-SA-v1.6-August-18-2025.pdf”,
“website”: “https://letsencrypt.org”
},
“newAccount”: “https://acme-v02.api.letsencrypt.org/acme/new-acct”,
“newNonce”: “https://acme-v02.api.letsencrypt.org/acme/new-nonce”,
“newOrder”: “https://acme-v02.api.letsencrypt.org/acme/new-order”,
“renewalInfo”: “https://acme-v02.api.letsencrypt.org/acme/renewal-info”,
“revokeCert”: “https://acme-v02.api.letsencrypt.org/acme/revoke-cert”
}
2025-11-25 15:41:56,271:DEBUG:certbot._internal.display.obj:Notifying user: Renewing an existing certificate for xxx.com and www.xxx.com
2025-11-25 15:41:56,271:DEBUG:certbot.configuration:Var reuse_key=True (set by user).
2025-11-25 15:41:56,549:INFO:certbot._internal.client:Reusing existing private key from /etc/letsencrypt/live/xxx.com/privkey.pem.
2025-11-25 15:41:56,555:DEBUG:acme.client:Requesting fresh nonce
2025-11-25 15:41:56,555:DEBUG:acme.client:Sending HEAD request to https://acme-v02.api.letsencrypt.org/acme/new-nonce.
2025-11-25 15:41:56,610:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 “HEAD /acme/new-nonce HTTP/1.1” 200 0
2025-11-25 15:41:56,610:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx <<< also why not Apache?
Date: Tue, 25 Nov 2025 20:41:56 GMT
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: https://acme-v02.api.letsencrypt.org/directory;rel=“index”
Replay-Nonce: zahUfOdGPpVlJojG19nFqwYWvDuzVSaLpAoZJcNNaYCB1jGFxt4
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
2025-11-25 15:41:56,610:DEBUG:acme.client:Storing nonce: zahUfOdGPpVlJojG19nFqwYWvDuzVSaLpAoZJcNNaYCB1jGFxt4
2025-11-25 15:41:56,610:DEBUG:acme.client:JWS payload:
b’{\n “identifiers”: [\n {\n “type”: “dns”,\n “value”: “xxx.com”\n },\n {\n “type”: “dns”,\n “value”: “www.xxx.com”\n }\n ]\n}’
2025-11-25 15:41:56,615:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/new-order:
{
“protected”: “eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMjEzOTEyNzMwNSIsICJub25jZSI6ICJ6YWhVZk9kR1BwVmxKb2pHMTluRnF3WVd2RHV6VlNhTHBBb1pKY05OYVlDQjFqR0Z4dDQiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL25ldy1vcmRlciJ9”,
“signature”: “IafFX0BnpN2OK2ZYEZ6lmWg4BGMNd2I_GpACwetFtCbpXefhsSD-tWvOPhYeHFkeRhXPkNjGoD2k-Zog3D9OUYz63IiUkWaZWuxfjjlERhV9x9gf5rxgh_RmwQubQIm_q5RGWA4F_lHwP3owowPA-VC81uwYzhfSJIByed03DUruB-_pM5HXPYsQ21ENCTKV7bLVKMaNGVLfYc74S-5y3n1TUVuD2t8Uf7bSzo9UWku4XDWTLQxlRgPxcAB-kVURNvXSerwCCJRMuD49-zzBFglCW5FSHX9ruRsjF0RzuS42TofyU5CrQGkBi3FtFR5euGAdNlbTRH0vzcwsjNs1vg”,
“payload”: “ewogICJpZGVudGlmaWVycyI6IFsKICAgIHsKICAgICAgInR5cGUiOiAiZG5zIiwKICAgICAgInZhbHVlIjogInByaW50YWJsZXM0ZnJlZS5jb20iCiAgICB9LAogICAgewogICAgICAidHlwZSI6ICJkbnMiLAogICAgICAidmFsdWUiOiAid3d3LnByaW50YWJsZXM0ZnJlZS5jb20iCiAgICB9CiAgXQp9”
}
2025-11-25 15:41:56,699:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 “POST /acme/new-order HTTP/1.1” 429 568
2025-11-25 15:41:56,699:DEBUG:acme.client:Received response:
HTTP 429
Server: nginx
Date: Tue, 25 Nov 2025 20:41:56 GMT
Content-Type: application/problem+json
Content-Length: 568
Connection: keep-alive
Boulder-Requester: 2139127305
Cache-Control: public, max-age=0, no-cache
Link: https://acme-v02.api.letsencrypt.org/directory;rel=“index”
Replay-Nonce: jkzIQkhdC1oeixN6Gb8V9RcEUMFC8iAlsVWWJZ049f4AiZWrsDc
{
“type”: “urn:ietf:params:acme:error:rateLimited”,
“detail”: “Your account is temporarily prevented from requesting certificates for xxx.com, www.xxx.com and possibly others. Please visit: Let's Encrypt - Portal”,
“status”: 429
}
2025-11-25 15:41:56,700:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
File “/bin/letsencrypt”, line 33, in
sys.exit(load_entry_point(‘certbot==2.9.0’, ‘console_scripts’, ‘certbot’)())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/certbot/main.py”, line 19, in main
return internal_main.main(cli_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/certbot/_internal/main.py”, line 1894, in main
return config.func(config, plugins)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/certbot/_internal/main.py”, line 1600, in certonly
lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/certbot/_internal/main.py”, line 131, in _get_and_save_cert
renewal.renew_cert(config, domains, le_client, lineage)
File “/usr/lib/python3/dist-packages/certbot/_internal/renewal.py”, line 399, in renew_cert
new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/certbot/_internal/client.py”, line 428, in obtain_certificate
orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/certbot/_internal/client.py”, line 478, in _get_order_and_authorizations
orderr = self.acme.new_order(csr_pem)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/acme/client.py”, line 137, in new_order
response = self._post(self.directory[‘newOrder’], order)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/acme/client.py”, line 365, in _post
return self.net.post(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/acme/client.py”, line 738, in post
return self._post_once(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/acme/client.py”, line 751, in _post_once
response = self._check_response(response, content_type=content_type)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/usr/lib/python3/dist-packages/acme/client.py”, line 602, in _check_response
raise messages.Error.from_json(jobj)
acme.messages.Error: urn:ietf:params:acme:error:rateLimited :: There were too many requests of a given type :: Your account is temporarily prevented from requesting certificates for xxx.com, www.xxx.com and possibly others. Please visit: Let's Encrypt - Portal
2025-11-25 15:41:56,740:ERROR:certbot._internal.log:An unexpected error occurred:
2025-11-25 15:41:56,740:ERROR:certbot._internal.log:Your account is temporarily prevented from requesting certificates for xxx.com, www.xxx.com and possibly others. Please visit: Let's Encrypt - Portal?
