Issue Problems Issuing a Let's Encrypt Certificate

[Robin McDermott]

Server operating system version

AlmaLinux 9.5

Plesk version and microupdate number

Plesk Obsidian 18.0.66 Update #2

When I try to issue a Let's Encrypt Certificate, I get this following:

Could not issue an SSL/TLS certificate for mydomain.com
Details
Could not issue a Let's Encrypt SSL/TLS certificate for mydomain.com. Authorization for the domain failed.
Details
Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz/2209120705/470928486175.
Details:
Type: urn:ietfarams:acme:error:connection
Status: 400
Detail: 207.21.xxx.xx: Fetching http://mydomain.com/.well-known/acme-challenge/SDVleuJRLDYtRanIfyX4fPZOifKWaxYnHXKb1v_huuU: Timeout during connect (likely firewall problem)

I do have a hardware firewall...but didn't have this problem with my previous server which was behind the same hardware firewall.

 

[Martin Dias]

Can you open the URL manually?
Is both the IPv4 (A record) and IPv6 (AAAA record) reachable? Both in and out traffic.

 

[Raul A.]

Do you allow http:// via the hardware firewall? Let's Encrypt will try to access the challenge URL via HTTP.

 

[Robin McDermott]

Do you allow http:// via the hardware firewall? Let's Encrypt will try to access the challenge URL via HTTP.

I assume so since I am able to display the website via http.

 

[Robin McDermott]

Can you open the URL manually?
Is both the IPv4 (A record) and IPv6 (AAAA record) reachable? Both in and out traffic.

Do you mean this one? http://mydomain.com/.well-known/acme-challenge/SDVleuJRLDYtRanIfyX4fPZOifKWaxYnHXKb1v_huuU:

When I try to open it with my domain in the url, I get:

SDVleuJRLDYtRanIfyX4fPZOifKWaxYnHXKb1v_huuU.N9e1xU5mklpy6psQYrgc3xKppNA7Ti9jjodp94Kyfhs

I do not have an IPv6 record for the domain. When I do a dns check on the IP address it can't find it, but when I search for the A record using the domain name, I can see it is pointing to the proper domain. I realize this might not answer your question...I might not know how to do what you are asking about.

 

[Raul A.]

Try to access the challenge URL from a different IP address than your usual IP. Your IP address might be whitelisted in the hardware firewall.

 

[Robin McDermott]

Try to access the challenge URL from a different IP address than your usual IP. Your IP address might be whitelisted in the hardware firewall.

Hmmmm, good guess Raul! I think that is, in fact, the issue. Will talk with my host, Aptum, and ask them if that is the issue and to open up the port. Will report back.