This article describes common issues when installing SSL certificates from Let's Encrypt. Problems include domains that cannot be resolved, lack of permissions on the verification URL, domains flagged as unsafe by Google, and missing DNS entries for wildcard certificates. Solutions include DNS checks, adjustments in the .htaccess file, and adding required DNS records. Domains flagged as unsafe by Google can be checked via the Safe Browsing Website Status to find out the reason for the classification and receive instructions for cleanup.
Domain not yet active/resolvable
No permissions on the verification URL
Domain flagged as unsafe by Google
SSL/TLS wildcard certificate selected without corresponding DNS entries
Domain not yet active/resolvable
|
Error message Error installing the Let's Encrypt SSL certificate: Failed letsencrypt execution: Failed authorization procedure. hansmuster.ch (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: DNS problem: NXDOMAIN looking up A for hansmuster.ch, www.hansmuster.ch (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: DNS problem: NXDOMAIN looking up A for www.hansmuster.ch |
or
| Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/2884970686. Details: Type: urn:ietf:params:acme:error:dns Status: 400 Detail: DNS problem: SERVFAIL looking up A for hansmuster.ch - the domain's nameservers may be malfunctioning |
Cause
The domain does not resolve to the IP address of the server where Let's Encrypt should be installed. It may be that the domain is not yet active (new domain/hosting order) or the DNS zone has not fully propagated.
Solution
Check whether the IP address for the domain (A record and www) resolves to the server where Let's Encrypt should be installed. Please note that after adjusting the nameservers or DNS zone, it may take up to 24 hours before the domain resolves to the new entries.
No permissions on the verification URL
|
Error message Error installing the Let's Encrypt SSL certificate: Failed letsencrypt execution: Failed authorization procedure. www.hansmuster.ch (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.hansmuster.ch/.well-known/acme-challenge/c7t_LmLlPxmICnDeaLXhVjcnt51KkQyCbU3q2bxPowo or Error: Let's Encrypt SSL certificate installation failed: Challenge marked as invalid. Details: Invalid response from http://hansmuster.ch/.well-known/acme-challenge/AiXBJuXuawjMQbVh9Vn3jinzy7eRmVozdYE3qBkDEqM: " |
Cause
When connecting to Let's Encrypt, it reaches the root folder path. Once there, Let's Encrypt cannot install the certificate due to redirects.
|
Note Let's Encrypt certificates are always valid for 3 months. They are automatically renewed in the last weeks. If the .htaccess file is renamed again at this time, Let's Encrypt cannot issue the certificate. |
Possible solution
Add the exception for the .well-known folder in the .htaccess file as follows:
RewriteEngine on
RewriteCond %{REQUEST_URI} !^/.well-known/
RewriteRule (.*) http://www.domain.ch [R=301,L]
Please note that this is an approach to a solution. Depending on the application used, the content of the specified .htaccess file may vary.
Domain flagged as unsafe by Google
|
Error message Error installing the Let's Encrypt SSL certificate: Type: urn:acme:error:unauthorized Status: 403 Detail: Error creating new authz :: "DOMAIN" was considered an unsafe domain by a third-party API Execution of /usr/local/psa/admin/plib/modules/letsencrypt/scripts/cli.php failed with exit code 1 and the output: Invalid response from https://acme-v01.api.letsencrypt.org/acme/new-authz. Details: Type: urn:acme:error:unauthorized Status: 403 Detail: Error creating new authz :: "DOMAIN" was considered an unsafe domain by a third-party API |
Cause
Google has flagged the site as unsafe.
Solution
Visit the following link and search for the domain specified in the message: Safe Browsing Website Status
You will see the current status and the reason for the unsafe classification.
On the same page, you will find further information and instructions on how to clean up the domain.
SSL/TLS wildcard certificate selected without corresponding DNS entries
| Error message: Let's Encrypt SSL/TLS wildcard certificate is being issued for the domain beispieldomain.ch. Please wait until a DNS record with the following parameters is added: Record type: TXT Domain name: _acme-challenge.beispieldomain.ch Record: GPVH0rWlDPfr-GvWZeQ633T2_bmGc9R1Cqu-45ZC3U8 |
If you want to cancel and delete the certificate request, click "Cancel".
Before clicking "Continue," make sure the DNS record has been added and can be resolved externally.
If the option "Issue SSL/TLS wildcard certificate" is selected when issuing the Let's Encrypt certificate, a TXT record in the DNS zone of the affected domain is required for verification. This record must be created before the certificate issuance can be completed. If Plesk's own nameservers are selected for the domain, the required TXT record is created directly by Plesk.