I am having problems when renewing my letsencrypt certificate. I am using nginx and certbot for renewal.

Output is the following:

Attempting to renew cert from /etc/letsencrypt/renewal/example.com.conf 
produced an unexpected error:
Failed authorization procedure. example.com (http-01): urn:acme:error:connection :: 
The server could not connect to the client to verify the domain :: 
Fetching http://example.com/.well-known/acme-challenge/AUStfngCwdGL8Hel2jR0jG4wLZZjXi-s7AypLNWrECo: 
Timeout. Skipping.

. Most peculiar my nginx - access log does not report any access at all whatsoever.

From the letsencrypt log:

2017-09-18 18:27:34,331:DEBUG:certbot.plugins.webroot:Creating root challenges validation dir at /var/www/example/.well-known/acme-challenge
2017-09-18 18:27:34,334:DEBUG:certbot.plugins.webroot:Attempting to save validation to /var/www/example/.well-known/acme-challenge/AUStfngCwdGL8Hel2jR0jG4wLZZjXi-s7AypLNWrECo
2017-09-18 18:27:34,335:INFO:certbot.auth_handler:Waiting for verification...

If I create /var/www/example/.well-known/acme-challenge/AUStfngCwdGL8Hel2jR0jG4wLZZjXi-s7AypLNWrECo manually and connect via firefox, I can connect without problems. Also then the nginx-access log gets filled. Nginx error log is empty in both cases.

In case it is of help, my nginx config for the site looks like this:

server {
listen 80;
listen [::]:80;

server_name example.com;

location /.well-known {
    root /var/www/example;

location / {
    return 301 https://$server_name$request_uri;


server {

listen 443 ssl;
listen [::]:443 ssl;


Honestly I am not really sure where to find any more clues as to what might be the matter. Any of you have some ideas?

  • What is your command for certbot? Did you specify --webroot?
    – chloesoe
    Sep 18, 2017 at 20:12
  • My command is certbot renew. I tried adding --webroot , however to no success. I checked the following: 1) Certbot creates the necessary file. 2) I can access the file from my computer 3) My access is logged via nginx, letsencrypt is not logged. Therefore I suspect, that letsencrypt either doesnt even try to connect or somehow (how?) fails to connect. Sep 19, 2017 at 15:54

1 Answer 1


So far I got messages like The server could not connect to the client to verify the domain :: only if the my DNS changes weren't propagated to all DNS servers yet.

When you connect via Firefox to example.com/.well-known/ you are really go over the internet or is the address only known on your network?

If you do a dig @ example.com, is the name resolved to to the correct IP address?

  • 1
    I found the problem. The A-Record was correct (thus my firefox connected properly), however the AAAA-Record was not. Apparently letsencrypt evaluates the ipv6 address. Sep 19, 2017 at 20:39
  • Same here, @user2089648. The IPv6 connectivity on my server went down, and I needed to reboot to fix it. I didn't notice from my end, as I don't have IPv6 connectivity at my house! Mar 8, 2018 at 10:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .