Issue LetsEncrypt certificates no longer automatically renewing, even though Plesk says they should

[Koert]

Server operating system version

AlmaLinux 8.10 (Cerulean Leopard)

Plesk version and microupdate number

18.0.63 #1

I am having issues with LetsEncrypt that used to automatically renew just fine, but recently stopped automatically renewing even though Plesk says that auto renewal is turned on for the domain, it doesn't renew. Does anyone have any clue what could be wrong, or how I can figure out what could be wrong?

 

[Kaspar@Plesk]

Are there any error messages shown about renewal?

 

[mopanim]

I have two identical servers that suddenly stopped auto-renewing wildcard certificates from LetsEncrypt somewhere back in March or April. (probably earlier, but that's when they started expiring). I can manually renew them, and have had to do that twice since then. But they still do not auto-renew.

The best trouble-shooting I've been able to accomplish was that LetsDebug gave me errors connecting to the website when the website had both IPv4 and IPv6. Removing IPv6 (AAAA) DNS records immediately cleared up the LetsDebug errors and the manual renewals proceeded. I'm waiting to see if that fixes the auto-renew, but I won't know until the first week of October (30 days from expiration).

But its a bit counter-productive to have to delete AAAA records from sites.

Plesk is fully updated (18.0.63 Update #1) on both servers, running Debian 10.13 (1&1/IONOS repo). Above errors were present after the last Plesk update.

 

[Hangover2]

@Koert Do you have the latest version of SSL It! installed? Are you experiencing the same symptoms mentioned in the following bug report?
SSL It! breaks renewal and usage of Let's Encrypt wildcard certificates when subdomains are involved

This bug was only partially resolved. Occasionally, old wildcard certificate requests are still not cleaned up, leading to the failure of auto-renewing those certificates.

 

[SteveITS]

Removing IPv6 (AAAA) DNS records immediately cleared up the LetsDebug errors and the manual renewals proceeded

I ran into this once a while back. That implies there's an IPv6 connection or configuration problem. LE will try to connect from multiple source IPs and if it fails to connect it won't renew the cert.