Solved Free Let's Encrypt certificates error: domain was skipped due to unreachable

E

euroG

Verified User
Joined
Mar 22, 2018
Messages
18
AlmaLinux Server Release 8.9, DirectAdmin 1.700, OpenLiteSpeed

We have a problem renewing free Let's Encrypt certificates for at least 3 domains:

domain.it was skipped due to unreachable http://domain.it/.well-known/acme-challenge/letsencrypt_2c33e1e015043ea836ed19cbea6c84bd file.
www.domain.it was skipped due to unreachable http://www.domain.it/.well-known/acme-challenge/letsencrypt_73c6041f5c23cccf9cc9318198529632 file.
No domains pointing to this server to generate the certificate for.

The domains have been around for a long time, they are visible and point to the server, they already have free Let's Encrypt certificates, they have not made any changes in the applications in recent months.
The .htaccess file doesn't block the display of folders/files if I create them manually in the webroot:
/.well-known/acme-challenge/letsencrypt_73c6041f5c23cccf9cc9318198529632.txt
the file is visible correctly.

Two out of three domains do not have the IPV6 record in the zone.
I did dozens of tests to see if there were any communication problems between my server and let's encrypt or something else but everything came back negative.

I regenerated the server certificate, on the domain that supports the server without errors but I can't renew/regenerate the certificates of the individual hosts.

Thank you
Gabriella
 
zEitEr said:
Hello,



That's the error you should address
Click to expand...

Thanks for the reply.
As I mentioned, all 3 domains point to the server correctly, are visible, and already have a Let's Encrypt certificate created in February.

All domains have external nameserves from 3 different providers (Aruba, Register.it and Cloudflare)

We also tried disabling the firewall
 
Last edited:
If directadmin reports the error, then domains are not accessible over public DNS resolvers (unless your ISP or government blocks Google's and/or CloudFlare's DNS resolvers). If you need any further assistance you will need to show your real domain names either publicly or privately.
 
Is that full SSL or Flexible ?

I have the site working well with cloudflare full strict SSL using let's encrypt.
 
If you're on CF it's best to use CF's Origin Certificate SSL/TLS ->Origin Server under the Origin Certificates section, hit "Create Certificate" it will give you a certificate valid for 15 years. Then add this certificate to that domain from DirectAdmin. These certificates are wildcard so valid for subdomains as well.

share.evrimaltay.com.tr

CleanShot 2026-05-05 at 14.35.45

Screenshot uploaded to CleanShot Cloud
share.evrimaltay.com.tr share.evrimaltay.com.tr

Then you can even set Strict SSL since CF accepts its own certificates :)
 
Ohm J said:
Is that full SSL or Flexible ?

I have the site working well with cloudflare full strict SSL using let's encrypt.
Click to expand...
thanks but only one domain on this server has cloudflare ns, the other domain have differente ns and provider
 
We found the problem!
Our client had created some customization rules in the Openlitespeed vhost file with some LiteSpeed-related security policies that did not allow for proper alias handling!
Obviously he didn't tell anything to us!

Thanks a lot to everyone!
 
You must log in or register to reply here.
Back
Top