• Hi, Pleskians! We are running a UX testing of our upcoming product intended for server management and monitoring.
    We would like to invite you to have a call with us and have some fun checking our prototype. The agenda is pretty simple - we bring new design and some scenarios that you need to walk through and succeed. We will be watching and taking insights for further development of the design.
    If you would like to participate, please use this link to book a meeting. We will sent the link to the clickable prototype at the meeting.
  • (Plesk for Windows):
    MySQL Connector/ODBC 3.51, 5.1, and 5.3 are no longer shipped with Plesk because they have reached end of life. MariaDB Connector/ODBC 64-bit 3.2.4 is now used instead.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

Resolved Let's Encrypt - 403

Solarom

New Pleskian
Hello,

When I try to renew the certificate for one of my domains, an error with status 403 appears :

Error: Could not issue a Let's Encrypt SSL/TLS certificate for as-sellerie.fr
Authorization for the domain failed.
Details Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/13732064593.
Details:
Type: urn:ietf:params:acme:error:unauthorized
Status: 403
Detail: Incorrect TXT record "EiLQK-WtYAANG7V-VEB0vQqubN6yFgyvEzjzbWLIHGY" found at _acme-challenge.as-sellerie.fr

This error only occurs with this domain. The _acme-challenge.as-sellerie.fr DNS record updates in Plesk, but it doesn't propagate.

When I run the command "dig TXT _acme-challenge.as-sellerie.fr + short" in SSH, it returns: "EiLQK-WtYAANG7V-VEB0vQqubN6yFgyvEzjzbWLIHGY". It doesn't match the new recording.

I followed Plesk's advice on this link :

But I don't know how to do step 6 of solving :

6 - If it does not resolve, add the record to the external DNS server, removing other existing acme-challenge records from there.

Can you help me please ?
 
Your DNS zone is not delegated to your Plesk server:
# dig +short as-sellerie.fr NS
ns8.lwsdns.com.
ns5.lwsdns.com.
ns6.lwsdns.com.
ns7.lwsdns.com.

So anything you do in the DNS zone in Plesk will not have any effect on the "real world".

Solution 1: Delegate the zone as-sellerie.fr to your Plesk server at your registrar

Solution 2: Update the TXT record manually at your DNS provider and re-perform the validation

Solution 3: Check if your DNS provider has an API that is supported by Plesk (see the comments in the KB article you posted)

Solution 4: Do not create a wildcard Let's Encrypt certificate (which uses the DNS-challenge) but use the HTTP-challenge instead, eliminating the need for DNS updates to your zone for the certificate validation
 
Solution 4: Do not create a wildcard Let's Encrypt certificate (which uses the DNS-challenge) but use the HTTP-challenge instead, eliminating the need for DNS updates to your zone for the certificate validation

Truly one of the best approaches to a seamless issuance/renewal process!
 
Back
Top