<div style="font-family: 'Calibri', 'sans-serif';"><div dir="ltr">
<div dir="ltr">The "failed to connect" seems pretty straightforward. Are you sure your Apache logs show they are connecting? I would still bet on firewall issues.</div><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr">-derek</div><div dir="ltr"><br></div><div dir="ltr">Sent from my mobile. Please excuse any typos.</div></div>
</div><br><div id="htc_header">----- Reply message -----<br>From: "James Sumners" <james.sumners@gmail.com><br>To: "Atlanta Linux Enthusiasts" <ale@ale.org><br>Subject: [ale] let's encrypt cert renewals?<br>Date: Wed, May 10, 2017 8:42 PM</div></div><br><div dir="ltr">I have no issues using <a href="https://github.com/hlandau/acme">https://github.com/hlandau/acme</a></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 10, 2017 at 8:40 PM, DJ-Pfulio <span dir="ltr"><<a href="mailto:DJPfulio@jdpfu.com" target="_blank">DJPfulio@jdpfu.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Anyone else having trouble renewing let's encrypt certs?<br>
<br>
Apache2 on Ubuntu 16.04.<br>
<br>
Failing tls-sni-01 challenge.<br>
<br>
I have 2 sites on the same machine. Both have renewed 3 times without<br>
issues. Today, they both failed. The script that always worked before:<br>
<br>
#!/bin/sh<br>
export PATH=/usr/local/sbin:/usr/<wbr>local/bin:/usr/sbin:/usr/bin:/<wbr>sbin:/bin<br>
/usr/bin/letsencrypt renew<br>
<br>
<br>
<br>
I've been through the log file(s). Not anything useful, just:<br>
<br>
FailedChallenges: Failed authorization procedure. <a href="http://site.domain.com" rel="noreferrer" target="_blank">site.domain.com</a><br>
(tls-sni-01): urn:acme:error:connection :: The server could not connect<br>
to the client to verify the domain :: Failed to connect to<br>
50.xx.xx.xx:443 for tls-sni-01 challenge<br>
<br>
DNS is correct.<br>
Site is up on 443, but not on 80.<br>
I opened the site to everyone. Normally, only allow a few specific subnets.<br>
<br>
Ideas?<br>
______________________________<wbr>_________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/<wbr>listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/<wbr>listinfo</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">James Sumners<br><a href="http://james.sumners.info/" target="_blank">http://james.sumners.info/</a> (technical profile)<br><a href="http://jrfom.com/" target="_blank">http://jrfom.com/</a> (personal site)<br><a href="http://haplo.bandcamp.com/" target="_blank">http://haplo.bandcamp.com/</a> (music)</div>
</div>