• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.

Issue Daily email "Could not issue/renew Let`s Encrypt certificates for adminmame"

B

brownbag

Basic Pleskian
Since I set up my plesk server, I've been getting a daily email, "Could not issue/renew Let's Encrypt certificates for Gavin" (Gavin is my name).
The basic content is as follows:
Could not secure domains of Gavin (login admin) with Let`s Encrypt certificates. Please log in to Plesk and secure the domains listed below manually.
Securing of the following domains has failed:

* 'compleit.com'
Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/2742710018.
Details:
Type: urn:ietf:params:acme:error:unauthorized
Status: 403
Detail: Invalid response from Zuver Domains [112.140.180.152]: "<!DOCTYPE html>\r\n<html xmlns=\"http://www.w3.org/1999/xhtml\">\r\n<head>\r\n\r\n <meta http-equiv=\"x-ua-compatible\" content=\"IE=edge\""

The following domains have been secured without some of their Subject Alternative Names:

<none>

Could not renew Let`s Encrypt certificates for Gavin (login admin). Please log in to Plesk and renew the certificates listed below manually.

To resolve this issue, it has been suggested to me that I need to set up a wildcard certificate. So I opened Let's encrypt, selected my domain and checked the box to ‘Issue a wildcard SSL/TLS certificate’ box. Then in my domain registry, I created a DNS TXT record for _acme-challenge.compleit.com with the value equaling the record name. Then i wanted 10 minutes for this DNS record to propogate and pressed Continue. But then I got an error, "Could not issue a Let's encrypt SSL/TLS certificate for compleit.com. Authorization for the domain failed".
I have three questions:
1. Am I not waiting long enough?
2. Do I just need to keep persisting or have I made a mistake somewhere?
3. What is the impact of this 'issue'?
 

Attachments

  • DNSRECORD.png
    DNSRECORD.png
    8.4 KB · Views: 29
  • let's encrypt.jpg
    let's encrypt.jpg
    50.7 KB · Views: 33
  • lets encrypt-error.png
    lets encrypt-error.png
    19.5 KB · Views: 26
Short answer: The IP of your domain "compleit.com.au" does not point to your Plesk server. The IP of your domain currently is 112.140.180.152, which belongs to a domain parking service.

You can't install a Let's Encrypt certificate on your server when the domain does not point to the IP of your Plesk server.

Solution: Check with the registrar of your domain and change the DNS records so that your domain points to the IP address of your server. Wait for DNS propagation and then try again to issue the certificate.
 
Monty said:
Short answer: The IP of your domain "compleit.com.au" does not point to your Plesk server. The IP of your domain currently is 112.140.180.152, which belongs to a domain parking service.

You can't install a Let's Encrypt certificate on your server when the domain does not point to the IP of your Plesk server.

Solution: Check with the registrar of your domain and change the DNS records so that your domain points to the IP address of your server. Wait for DNS propagation and then try again to issue the certificate.
Click to expand...

Yes, compleit.com.au is not fully set up yet, but this issue is with compleit.com. I can't see anything in the email or in what I've done that has anything to do with compleit.com.au. If you can see that, can you please point me to it? Thanks.
 
I saw compleit.com.au in your pasted error message: "Invalid response from Zuver Domains [112.140.180.152] " (move your mouse over "Zuver Domains").
But I must confess I didn't properly look at your screenshots, they show a different issue than the text in your pasted error message.

Anyway, let's focus on the screenshots: It's a DNS issue again. Your domain "compleit.com" is registered on the nameservers of "nameserver.net.au":

Code: 
# dig +short compleit.com NS
ns3.nameserver.net.au.
ns2.nameserver.net.au.
ns1.nameserver.net.au.

And there is no TXT record for _acme-challenge.compleit.com on those nameservers:
Code: 
# dig _acme-challenge.compleit.com TXT

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51268
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

However, when I query your Plesk nameserver directly I get the TXT record:

Code: 
# dig _acme-challenge.compleit.com TXT @compleit.com  

;; ANSWER SECTION:
_acme-challenge.compleit.com. 86400 IN  TXT     "sbAucR0OoVSMLG0MEI<redacted>"

Note: nsX.nameserver.net.au are external nameservers, so your DNS records inside Plesk do not have any effect on your domain.

So, either you register your domain to your own nameserver (the one from your Plesk server) at your registrar or you enter the TXT record manually at nameserver.net.au for your domain.

There is a nice KB article that explains exactly this: Cannot issue wildcard Let's Encrypt certificate in Plesk: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com
 
You must log in or register to reply here.

Similar threads

S
Issue Let's Encrypt/SSL It! empty domain name error
Replies
8
Views
1K
SilentWarrior
S
R
Issue Problems Issuing a Let's Encrypt Certificate
Replies
6
Views
902
Robin McDermott
R
M
Issue Let's Encrypt Bulk Domain Renewal
Replies
4
Views
518
MacGyver
M
V
Issue Failed to reassign let's encrypt
Replies
1
Views
256
Aleksei Fedorov
A
Bitpalast
Question How to remove SSL renewal attempts for good?
Replies
8
Views
2K
Bitpalast
Bitpalast
Back
Top