Solved JWS has invalid anti-replay nonce.

Richard G

Verified User
Joined
Jul 6, 2008
Messages
13,782
Location
Maastricht
Oke today I got an message from the system message of DA:
Error during automated certificate renewal for domain.nl

So I had a look and this is what is happening:
Code:
2022/04/23 00:25:04 [INFO] [domain] acme: Preparing to solve DNS-01
2022/04/23 00:25:06 [INFO] [domain] acme: Trying to solve DNS-01
2022/04/23 00:25:06 [INFO] [domain] acme: Checking DNS record propagation using [8.8.8.8:53]
2022/04/23 00:25:36 [INFO] Wait for propagation [timeout: 5m0s, interval: 30s]
2022/04/23 00:25:46 [INFO] [domain] acme: Waiting for DNS record propagation.
2022/04/23 00:26:26 [INFO] [domain] acme: Waiting for DNS record propagation.
2022/04/23 00:27:06 [INFO] [domain] acme: Waiting for DNS record propagation.
2022/04/23 00:27:46 [INFO] [domain] acme: Waiting for DNS record propagation.
2022/04/23 00:28:26 [INFO] [domain] acme: Waiting for DNS record propagation.
2022/04/23 00:29:07 [INFO] [domain] acme: Waiting for DNS record propagation.
2022/04/23 00:29:47 [INFO] [domain] acme: Waiting for DNS record propagation.
2022/04/23 00:30:27 [INFO] [domain] acme: Waiting for DNS record propagation.
2022/04/23 00:30:57 [INFO] [domain] acme: Cleaning DNS-01 challenge
2022/04/23 00:31:00 [INFO] retry due to: acme: error: 400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/authz-v3/1010xxxxxx :: urn:ietf:params:acme:error:badNonce :: JWS has an invalid anti-replay nonce: "01022uyqM2xai2_E5XGcJCiC9ACuI5PrF2a5OLrpRkfR3RA"
2022/04/23 00:31:00 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/1010xxxxxx
2022/04/23 00:31:00 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/10106xxxxxx
2022/04/23 00:31:01 Could not obtain certificates:
error: one or more domains had a problem:
[*.domain] time limit exceeded: last error: read udp 95.xx.xx.xx:50138->84.my.home.ip:53: i/o timeout
[domain] time limit exceeded: last error: read udp 95.xx.xx.xx:60579->84.my.home.ip:53: i/o timeout
Certificate generation failed.
<br>

So now there are a couple of things very odd. I looked up that JWS error and sometimes it's a timeout and one has to try again.
I checked the status of that domain, and now I see this:


Certificate ExpiryMay 17 22:24:48 2022 GMT

So there is still time before expiration, but a bit higher it says:
Let's Encrypt in use. Auto-renewal in -5 Days.

So i doubt if it will try again, what's wrong here?

Is that because of a non existing 3rd nameserver which pointed to my home ip?

Removed the non existing nameserver and now seems to run fine.
 
Last edited:
Back
Top