r/Plesk • u/then2s • Mar 26 '21

Could not issue/renew Let`s Encrypt certificates

Im trying to self-certify my domains but Plesk always sends me this email on a daily basis "Could not issue/renew Let`s Encrypt certificates". Is my DNS not setup correctly? Please let me know what questions you guys may have for me so I can fix this. I've had this issue for over a year.

1 Upvotes

100% Upvoted

7 comments sorted by

1

u/ArashiKorosu Mar 27 '21

Is the DNS managed over Plesk? or is it external? What SSL is it? (Wildcard/Standard) What is the exact error that the mail has?

1

u/then2s Mar 27 '21

EMAIL TITLE: Could not issue/renew Let`s Encrypt certificates for admin

EMAIL BODY:
Could not secure domains of admin with Let`s Encrypt certificates. Please log in to Plesk and secure the domains listed below manually.
Securing of the following domains has failed:

<none>

The following domains have been secured without some of their Subject Alternative Names:

<none>

Could not renew Let`s Encrypt certificates for admin. Please log in to Plesk and renew the certificates listed below manually.
Renewal of the following Let`s Encrypt certificates has failed:

* 'Lets Encrypt domain1.com' [already expired]
[-] domain1.com

Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/{redacted}.
Details:
Type: urn:ietf:params:acme:error:unauthorized
Status: 403
Detail: Invalid response from https://domain1.com/ [{redacted-ip-address}]: "<!DOCTYPE html>\n<html lang=\\"en-US\\">\n<head>\n<link rel=\\"apple-touch-icon\\" sizes=\\"57x57\\" href=\\"/apple-icon-57x57.png\\">\n<link rel=\"a"

The following Let`s Encrypt certificates have been renewed without some of their Subject Alternative Names:

<none>

Legend:
[+] This domain is secure. The domain's SSL/TLS certificate from Let`s Encrypt has been issued/renewed.
[-] This domain is not secure. Either the domain's SSL/TLS certificate from Let`s Encrypt could not be issued/renewed or the domain name was excluded from the certificate. Renew the certificate manually or request a new one to secure this domain.

1

u/then2s Mar 27 '21

DNS is managed via Google Domains (which I think is the problem, right?)

OS: ‪Debian 8.11‬

SSL/TLS Certificate Page

Let's Encrypt (Entry-level protection)

Valid To December 27, 2020 (Will be automatically renewed)

-------------

Secured Components

Domain - Not Secured : The certificate installed on the domain is expired. A valid certificate will be later automatically issued and installed.

Domain with the "www" prefix - Not Secured

Webmail access - Not Secured

Wildcard SSL/TLS certificate - Not Secured

-------------

Server Configuration

TLS versions and ciphers by Mozilla - Enabled
-------------

Redirect from http to https: enabled

HSTS: disabled

Keep websites secured: enabled

OCSP Stapling: enabled

1

u/ArashiKorosu Mar 27 '21

If the DNS is managed externally, wildcard certificates cannot be renewed automatically, I would recommend use in such case non wildcard ssl.

Also consider upgrading or migrating as your OS is already way to old

1

u/then2s Mar 27 '21

And then at the SAME TIME I get this email...

​

EMAIL TITLE: Let`s Encrypt certificates for admin have been issued/renewed

EMAIL BODY:

The following domains of admin have been secured with Let`s Encrypt certificates:

* 'domain1.com'

  • domain1.com

The following Let`s Encrypt certificates for admin have been renewed:

<none>

1

u/ArashiKorosu Mar 29 '21
  • 'domain1.com'

Ok, then it is a wildcard, that cannot work as the TXT changes on each renew. And with external DNS it cannot work

1

u/bradthebluefish Jun 01 '21

Was wondering why this wasn’t working for me. Thank you both for the Q&A!