Let Encrypt won't create cert with forced SSL setting

[WholesaleDialup]

Just a shot in the dark but, I wonder if this change has anything to do with our issue:

Version 1.58.0 | Directadmin Docs

DirectAdmin Knowledge Base

www.directadmin.com

 

[floyd]

With https turned on can you reach .well-known with your domain?

 

[WholesaleDialup]

With https turned on can you reach .well-known with your domain?

Yes no problem, I put a test file there and it comes up fine in my browser. It's the redirect to https that's killing the LetsEncrypt renewal script but in the browser it works fine.

 

[floyd]

What about from the command line with curl?

 

[WholesaleDialup]

Yes, tried that too. Works fine. Also, just for grins I tried turning off my firewall just in case that was interfering and nope.

 

[Aar]

@WholesaleDialup Is it a domain or a subdomain, what gives the error?

In my case it is a subdomain, but it seems that it hangs on it, and does not extend the underlying domains.
I can reach the .well-known also by http and https.

 

[LawsHosting]

Well, if the cert expired or there's no cert to begin with and Letsencrypt is trying to contact the site under https (due to the redirect), surely it'll fail. If it hasn't expired or there's already a cert, then ignore my analogy.

 

[Aar]

But in my case it wasn't expired.

 

[LawsHosting]

You say you use Cloudflare, is this just DNS or DNS and filtering/proxy?

 

[Aar]

I use proxy and filtering.

 

[LawsHosting]

What if you turn the proxy off, just to see.... It shouldn't matter, but will be interesting........

I also use cloudflare, but just for DNS.

 

[Aar]

That will probably a part of the solution somewhere.
Because after I changed the 'Always use SSL' setting to 'off' in the CF proxy / filtering, the renew-proces continued.
But I think this was also true when I set the 'Always use SSL' setting to 'off' at CF, and the 'Force SSL' setting in DA to 'on'.

So it won't be CF.

Perhaps it pays to test this with a test domain and manually adjust the time for renewal in DA. Difficult to debug if you have to wait up to 60 days.