letsencrypt 405 Method Not Allowed error...how to renew with AIO?

[btakita]

My site will is unable to renew the lets encrypt certs. Here are the apache logs.

Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
{"level":"info","ts":1696663616.2243063,"msg":"using provided configuration","config_file":"/tmp/Caddyfile","config_adapter":""}
[Sat Oct 07 01:26:56.227293 2023] [mpm_event:notice] [pid 73:tid 139729992325960] AH00489: Apache/2.4.57 (Unix) configured -- resuming normal operations
[Sat Oct 07 01:26:56.228157 2023] [core:notice] [pid 73:tid 139729992325960] AH00094: Command line: '/usr/local/apache2/bin/httpd -D FOREGROUND'
{"level":"info","ts":1696663616.254734,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."}
{"level":"info","ts":1696663616.3525107,"msg":"[INFO][FileStorage:/mnt/data/caddy] Lock for 'issue_cert_cloud.foresight.host' is stale (created: 2023-09-30 13:28:26.150599275 -0600 MDT, last update: 2023-10-07 01:24:12.737257762 -0600 MDT); removing then retrying: /mnt/data/caddy/locks/issue_cert_cloud.foresight.host.lock"}
{"level":"error","ts":1696663618.465826,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"cloud.foresight.host","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"2605:a140:2135:4472::1: Connection refused","instance":"","subproblems":[]}}
{"level":"error","ts":1696663618.4659226,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"cloud.foresight.host","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"2605:a140:2135:4472::1: Connection refused","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/1187877397/213409396166","attempt":1,"max_attempts":3}
{"level":"error","ts":1696663618.4659762,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"cloud.foresight.host","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:connection - 2605:a140:2135:4472::1: Connection refused"}
{"level":"error","ts":1696663618.4660256,"logger":"tls.renew","msg":"will retry","error":"[cloud.foresight.host] Renew: [cloud.foresight.host] solving challenge: cloud.foresight.host: [cloud.foresight.host] authorization failed: HTTP 400 urn:ietf:params:acme:error:connection - 2605:a140:2135:4472::1: Connection refused (ca=https://acme-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":2.11024004,"max_duration":2592000}
{"level":"error","ts":1696663679.6160266,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"cloud.foresight.host","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"2605:a140:2135:4472::1: Connection refused","instance":"","subproblems":[]}}
{"level":"error","ts":1696663679.616837,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"cloud.foresight.host","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"2605:a140:2135:4472::1: Connection refused","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/116875804/11423045434","attempt":1,"max_attempts":3}
{"level":"error","ts":1696663679.6170602,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"cloud.foresight.host","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:connection - 2605:a140:2135:4472::1: Connection refused"}
{"level":"error","ts":1696663679.6172712,"logger":"tls.renew","msg":"will retry","error":"[cloud.foresight.host] Renew: [cloud.foresight.host] solving challenge: cloud.foresight.host: [cloud.foresight.host] authorization failed: HTTP 400 urn:ietf:params:acme:error:connection - 2605:a140:2135:4472::1: Connection refused (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":2,"retrying_in":120,"elapsed":63.261485832,"max_duration":2592000}

With the letsencrypt statuses:

https://acme-v02.api.letsencrypt.org/acme/order/1187877397/213409396166

{
  "status": "invalid",
  "expires": "2023-10-14T07:26:56Z",
  "identifiers": [
    {
      "type": "dns",
      "value": "cloud.foresight.host"
    }
  ],
  "authorizations": [
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/271524536356"
  ],
  "finalize": "https://acme-v02.api.letsencrypt.org/acme/finalize/1187877397/213409396166"
}

https://acme-staging-v02.api.letsencrypt.org/acme/order/116875804/11423045434

{
  "status": "invalid",
  "expires": "2023-10-14T07:27:58Z",
  "identifiers": [
    {
      "type": "dns",
      "value": "cloud.foresight.host"
    }
  ],
  "authorizations": [
    "https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/8721932814"
  ],
  "finalize": "https://acme-staging-v02.api.letsencrypt.org/acme/finalize/116875804/11423045434"
}

https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/8721932814

{
  "identifier": {
    "type": "dns",
    "value": "cloud.foresight.host"
  },
  "status": "invalid",
  "expires": "2023-10-14T07:27:58Z",
  "challenges": [
    {
      "type": "tls-alpn-01",
      "status": "invalid",
      "error": {
        "type": "urn:ietf:params:acme:error:connection",
        "detail": "2605:a140:2135:4472::1: Connection refused",
        "status": 400
      },
      "url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/8721932814/S2-fXg",
      "token": "Fx9jmM07hfK2XBVPrd_xkMl2LkBK7VtBQMV1tSNVY14",
      "validationRecord": [
        {
          "hostname": "cloud.foresight.host",
          "port": "443",
          "addressesResolved": [
            "209.126.2.16",
            "2605:a140:2135:4472::1"
          ],
          "addressUsed": "2605:a140:2135:4472::1"
        }
      ],
      "validated": "2023-10-07T07:27:58Z"
    }
  ]
}

https://acme-staging-v02.api.letsencrypt.org/acme/finalize/116875804/11423045434

{
  "type": "urn:ietf:params:acme:error:malformed",
  "detail": "Method not allowed",
  "status": 405
}

[szaimen]

Hi, see #2105

[btakita]

I saw the Timeout during connect (likely firewall problem) error & resolved it by removing the AAAA record. Thank you.