Again letsencrypt issues updating

Hello.
I'm running the newest versions of Letsencrypt and Directadmin.

And again I got an error for updating my SSL certificate. And again if I go to Directadmin and do it again, it creates a certificate without issues.
I'm not sure but I thought it was the acme_challenge thing again. It still happens a lot of times.

But today I got another one, which is worse.

Requesting new certificate order...
Processing authorization for ftp.customerdomain.nl...
Waiting for domain verification...
Trying again...
1..2..3..4..5..
Challenge status: invalid. Challenge error: "type": "http-01", "status": "invalid", "error": { "type": "urn:ietfarams:acme:error:connection", "detail": "dns :: DNS problem: NXDOMAIN looking up A for ftp.customerdomain.nl", "status": 400 . Exiting...

Click to expand...

Right. But the A record does exists for a long time already and it resolves, so what the....???

I went down and had a look. Then I've seen this:

What? Renew in -4 days? Oke, in that case, let's click the "don't renew" button and create a wildcard certificate. So I did. It said it had removed the keys. Which in fact is not working very good either, because if I look in the SSL section, it still sees the names for the older SSL certificates and it says they are valid until March 27th 2019. So they were not removed very decently.

Anyway I created a new wildcard certificat... took a long time... got a tasq.queue.tmp file, which change in a task.queue file and then...

Found wildcard domain name and http-01 challenge type, switching to dns-01 validation.
Requesting new certificate order...
Processing authorization for customerdomain.nl...
DNS challenge test fail for _acme-challenge.customerdomain.nl IN TXT "d1JfowE8LjCi3D692ZIY6iljoRm5HZmmhnQp-uhPHk4", retrying...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
Retry failed, trying again in 15s...
DNS validation failed. Exiting...

Click to expand...

Oh yeah, oke, first time I asked for a wildcard domain certificate, let's try again.....
Again a /usr/local/directadmin/data/tasq.queue which changes in a tasq.queue.tmp and after some waiting again task.queue after some wait and same retry failed error as above.

What's going on here?

My server is working perfectly. I have my own DNS server, resolv.conf is pointing to 127.0.0.1 and an external server. I can do dig's and nslookups from and to my server.
I'm puzzeled now.

Hello Richard,

Recently had an issue with letsencrypt and turned out custom DNS servers had some IPs from letsencrypt banned, hence they could not complete domain resolving.

Your case might be the same, try and disable a firewall on your nameservers and see whether or not it solves the issue.

Hello Alex.

Thank you for the tip, but a firewall on my nameservers? I don't have that. I do have CSF/LFD running, but my the ports for nameservers are open.
What exactly do you mean by disabling a firewall on my nameservers, is that something different then CSF/LFD? I don't have special settings for the nameservers.

I thought about whitelisting LetsEncrypt ip's but found this from LE:

We don’t publish the IP ranges for our ACME service, and they will change without notice.

Click to expand...

The odd thing is that this is happening on this domain only at the moment. Other domains do renew their certificates, which would not be able if ip's were blocked. However, it's often we have to try 2 times before it succeeds. But that is mostly because of a wrong acme-challenge entry in DNS which is made automatically.

CSF means ConfigServer Security & Firewall.

If only one domain fails it might be due an issue with its resolving, probably an issue with DNSSEC, or whatever else...

LoL yes I know what csf means but you confuse me with these:

try and disable a firewall on your nameservers

Click to expand...

You can't disable firewall specifically on my nameservers only. You either open or close their ports. I don't know any other way.

And:

and turned out custom DNS servers had some IPs from letsencrypt banned,

Click to expand...

I wouldn't know how a custom DNS server could ban an ip.

So these is what's confusing me.
If you are pointing to the DNS_STRICT setting, I don't use it and the domain has no DNSSEC either.

I'll have another look and another try. Maybe I missed something else.

In my case nameservers are running CSF too, and CSF blocked some letsencrypt IPs over a cluster setup. I believe letsencrypt tried to verify a domain from a server with a closed 80 port, and CSF/LFD treated connections to a closed port as a port scanning attack.

If my idea does not fit your case, then you should ask directadmin support, and ask then to connect your server and investigate the case.

Or probably somebody else here has more ideas.

Thank you Alex!

and CSF/LFD treated connections to a closed port as a port scanning attack.

Click to expand...

Ah now I understand what you mean. We don't have however closed ports 80 or 443. But they might be if suspended maybe. Indeed in some rare cases I've also seen CSF blocking some things for port scans which were not really port scans.

But your reply brought me to the solution.

*** found it ***
Darn I feel stupid now. Doint too many things and I did check via SSH, and a domain is existing and a WP installation is present. It's a domain my admin made.
However I did not check via the browser. And there it's not working. So I did a further check and the domain is in quarantaine.

This still does not explain why I have those acme challenge errors on other domains every time so I have to do a second request for renewal, I already have a ticket about that some where. I might have a look and open it up again if it happens again.

Thanks!