Resolved SSL create and renew errors on random domains / possibly a Let's Encrypt issue, but maybe only in combination with Plesk

[Bitpalast]

Server operating system version

Alma 8

Plesk version and microupdate number

18.0.61 #6

We are seeing some random create and renewal errors of Let's Encrypt as described in

Failed reissue on plesk due to Could not obtain directory: cURL error 35: Encountered end of file

was happened around 08.30AM indonesia time (GMT +08.00) our IP is 202.157.184.151

community.letsencrypt.org

This only occurs on some domain names while other domains on the same host can renew the certs without issues. I've already tried to reconfigure the domain configuration files, remove the existing certificate including removing it from the SSL directory and SQLite database (notifications ...), checked the syntax and logic of the webserver config files manually, checked accessibility of the local directories such as the acme-challenge directory, verified that Let's Encrypt acme-v02.api.letsencrypt.org can be reached and responds with expected data. All checks out good, yet some domains just won't renew with:

Could not obtain directory: cURL error 35: OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to acme-v02.api.letsencrypt.org:443 (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://acme-v02.api.letsencrypt.org/directory

As the user who posted to the Let's Encrypt forum is using Plesk, too, it may be wise for the tech team to reach out to Let's Encrypt to find out whether there is a fundamental issue between Plesk SSLIt and them.

 

[Peter99]

Lets's Encrypt is currently facing some issues.

Let's Encrypt Status

Support for Let's Encrypt services is community-based and information on current status and outages can be found at: https://community.letsencrypt.org

letsencrypt.status.io

 

[Bitpalast]

Lets's Encrypt is currently facing some issues.

Let's Encrypt Status

Support for Let's Encrypt services is community-based and information on current status and outages can be found at: https://community.letsencrypt.org

letsencrypt.status.io

That notice is a result from the user reports on the issue described above.

 

[Kaspar@Plesk]

Thank you for posting about this @Bitpalast. We're currently investigating the issue.

Do the affected domains have IPv6 enabled by any chance?

 

[Peter99]

That notice is a result from the user reports on the issue described above.

I can confirm that i am also unable to renew certs.
My error:

Invalid response from https://acme-v02.api.letsencrypt.org/acme/finalize/87065621/285696765117.

Details:

Type: urn:ietf: params: acme: error: orderNotReady

Status: 403

Detail: Order's status ("pending") is not acceptable for finalization

 

[Peter99]

Another server, in another location however reports the same error as yours, Peter.

Could not obtain directory: cURL error 35: OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to acme-v02.api.letsencrypt.org:443 (see libcurl - Error Codes) for https://acme-v02.api.letsencrypt.org/directory

 

[Peter99]

@Bitpalast Can you try and renew the certificates again?
On serveral sites, i have attempted the renewal process for up 4 times after failure and then they seem to go through.

 

[grizlyadams]

Anyone have any ETA on a resolution? - I can't issue a cert - plesk just hangs for 3 minutes or so, then i get

"Could not obtain directory: cURL error 35: error:0A000126:SSL routines::unexpected eof while reading (see libcurl - Error Codes) for https://acme-v02.api.letsencrypt.org/directory"

CURLE_SSL_CONNECT_ERROR (35)

A problem occurred somewhere in the SSL/TLS handshake. You really want the error buffer and read the message there as it pinpoints the problem slightly more. Could be certificates (file formats, paths, permissions), passwords, and others.

 

[grizlyadams]

Anyone have any ETA on a resolution? - I can't issue a cert - plesk just hangs for 3 minutes or so, then i get

"Could not obtain directory: cURL error 35: error:0A000126:SSL routines::unexpected eof while reading (see libcurl - Error Codes) for https://acme-v02.api.letsencrypt.org/directory"

CURLE_SSL_CONNECT_ERROR (35)

A problem occurred somewhere in the SSL/TLS handshake. You really want the error buffer and read the message there as it pinpoints the problem slightly more. Could be certificates (file formats, paths, permissions), passwords, and others.

it has worked now.

 

[Kaspar@Plesk]

The issue seems to be resolved on the side of Lets's Encrypt. If any one is still experiencing issues please let us know.

 

[Bitpalast]

Yes, it's resolved! Thank you and good that it was just an issue on Let's Encrypt side.

 

[Change Maker]

I had been getting these same messages for quite a while, but they seemed to have stopped. Nothing in yet today. I really was baffling me.
Glad it's been resolved.