During secondary validation: no valid A records found #5164
-
|
hi all... i couldn't find anything online with clear answer for the issue below... it looks like domains with expired certificates keep sending back this below when an attempt is made to call acme with --renew. it's the second time it happens in about a month for 2 different domains that have expired certificates. renewing domains that are still within the expiration date is not an issue... mydomain.com :Verify error:During secondary validation: no valid A records found for mydomain.com; no valid AAAA records found for mydomain.com dig clearly returns the A record which hasn't changed in years... in addition... i see the "challenge" files and their contents written under .well-known/acme-challenge/... so that part works. it's not that those are missing. currently have 5 - one for each attempt to renew the certificate. i would like to know how to resolve the "secondary validation" issue... thanks... acme.sh --debug --renew -d mydomain.com |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
"Secondary validation" is when the CA (Let's Encrypt) has already checked your http challenge response OK, but when they check it from a different geographic location it fails. You are most likely geoblocking traffic from certain countries (or all non-US etc). You need to either not block geographically or just block certain countries you have a problem with, alternatively use a web application firewall to allow all http requests for /.well-known/acme-challenge/* paths. |
Beta Was this translation helpful? Give feedback.
-
|
Note that Let's Encrypt recently started checking http challenge responses from more countries (mainly europe and singapore I think), which is why your validation is not failing. |
Beta Was this translation helpful? Give feedback.
-
|
finally. thank you. |
Beta Was this translation helpful? Give feedback.
Note that Let's Encrypt recently started checking http challenge responses from more countries (mainly europe and singapore I think), which is why your validation is not failing.