Troubleshooting · 15.1
ACME
For an order error, TLSPilot shows the error type of the CA, for example urn:ietf:params:acme:error:rateLimited, followed by its details. For a failed challenge, it shows Authorization invalid for <name>. Details: with the challenge type and the text of the CA, followed by a hint of TLSPilot. The meaning of the error types is defined in RFC 8555.
| Symptom | Cause | Solution |
|---|---|---|
| Order and account | ||
| Invalid ACME contact email '<address>'. Set a real address on the ACME provider (not @example.com). | The contact email of the ACME provider is invalid or a placeholder. | Enter a real address under Contact email of the provider, or leave the optional field empty, see chapter ACME settings. |
| Directory URL is required. | A directory URL field of the ACME provider is empty, so the provider is incomplete. | Enter the directory URL of the provider in the dialog Modify ACME provider and click Verify directory…, see chapter ACME settings. |
| ZeroSSL requires ACME External Account Binding (EAB). or Select an ACME EAB credential before issuing from <provider>. | The provider requires EAB, and no EAB credential is selected. | Create EAB credentials at the provider (ZeroSSL: Developer section, Generate EAB Credentials) and select the credential in the settings on the tab ACME providers. |
| ACME EAB credential <name> is missing Key ID or HMAC. or, when you verify the provider, EAB bind failed. Check Key ID, HMAC, and region. | The EAB credential is incomplete or does not match the provider. | Store the Key ID as user name and the HMAC as secret of the credential. Then select the provider on the tab ACME providers, click Modify and click Verify directory… again. |
| Directory is unreachable. or Directory GET timed out. Check the URL and network. or The URL did not return an ACME directory (missing newAccount / newNonce). | The directory URL is wrong, or the management host cannot reach the CA. | Check the directory URL and region of the provider and the outbound connection, see chapter Network connectivity. |
rateLimited. Force renew… warns that the CA may rate-limit renewals outside its normal window. | The CA limits how many certificates you may request. At Let’s Encrypt, the duplicate certificate limit is 5 certificates for the same set of names per 7 days. | Wait and avoid repeated Force renew. The warning shows how many certificates TLSPilot issued for the same names in the last 7 days. Renewals controlled by ARI are exempt from this limit. Use Staging for tests. |
badNonce, Fail to fetch new nonce | The CA rejected the anti-replay nonce of a request. TLSPilot already retries such requests automatically several times. | If the error remains, click Force renew… again later. |
orderNotReady or ACME order is not ready to finalize (Status=<status>). | The authorizations were not completed in time. TLSPilot waits for the order to become ready before it finalizes it. | Click Force renew… again. If an authorization failed, solve its error first. |
| ACME order is invalid and cannot be finalized: <error> or ACME order could not be finalized (CSR/Finalize). | The CA has set the order to invalid, for example after a failed authorization, or rejected the CSR. | Solve the error shown in the details, then click Force renew…. |
rejectedIdentifier | The CA does not issue for one of the names. TLSPilot first repeats the order without the reference to the replaced certificate (ARI); the error remains if the CA refuses the name itself. | Check the names of the certificate. Let’s Encrypt issues for IP addresses only with the profile shortlived, see chapter ACME profiles. |
| Validation | ||
unauthorized in the details | The CA does not accept the proof of control for the name, for example a wrong challenge response. | Check that the challenge is published where the public name points, see chapters DNS-01 and HTTP-01 and TLS-ALPN-01. |
dns in the details | The CA had a problem with a DNS query during the validation. | Check the public name servers of the domain and their answers, also for CAA records. |
connection in the details | The CA could not connect to the validation target. | Open the port from the internet (HTTP-01: 80, TLS-ALPN-01: 443), see chapter Ports and listeners. Avoid geo-blocking and IP allowlists for the CA, as the CA connects from several locations, see chapter Multi-perspective validation. |
caa | A CAA record forbids the CA to issue. | Allow the CA in the CAA record (issue, for wildcards issuewild). With accounturi, the record must name the ACME account of TLSPilot; after Reset Account, the next issue registers a new account. With validationmethods, the challenge type you use must be listed. See chapter CAA records. |
| Authorization invalid for <name>, and the details of the CA contain secondary validation | The validation from the data center of the CA succeeded, but too many of its remote network perspectives saw a different result (Multi-Perspective Issuance Corroboration). | Make sure that every location on the internet gets the same answer: for DNS-01 from all authoritative nameservers, for HTTP-01 and TLS-ALPN-01 without geo-blocking or allowlists. See chapters Multi-perspective validation, DNS-01 and HTTP-01 and TLS-ALPN-01, then click Force renew…. |
caa or dns in the details only at some attempts; another Force renew… works | The CA also checks the CAA records from several network perspectives, without a shared DNS cache. One nameserver of the domain answers differently or not at all, for example with SERVFAIL. | Query the CAA records at every authoritative nameserver, for example dig @<nameserver> CAA <name>, and correct the nameserver that differs. See chapters CAA records and Multi-perspective validation. |
| Authorization timed out for <name>. | The CA did not complete the validation in time. | Click Force renew… again. For DNS-01, see chapter DNS-01. |
| Wildcard domains on <certificate> require DNS-01. or This ACME provider does not support wildcard names. | Wildcard certificates need DNS-01, and not every ACME provider issues them. | Select DNS-01, or a provider that issues wildcard certificates. |
| ARI and ACME profiles | ||
| Tooltip of Next action: Controlled by the CA (ARI): renewal between <start> and <end> | No error. The CA sets the renewal window. | Nothing to do. If ARI fails, TLSPilot uses the slider Fallback if ARI fails, see chapter ARI – ACME Renewal Information. |
| Event 1221: Emergency renew for '<certificate>'. The CA moved the renewal window forward. Window ends <time>, next cycle <time>. | The CA pulled the renewal window forward, and the emergency option is on. | No action needed. TLSPilot renews immediately. If it fails, the service log shows Off-cycle renew failed for <certificate>, and event 1213 is written. |
| A planned renewal has no separate event. | The time is stored on the certificate. | Nothing to do. See chapter Keep it renewing. Renewal does not deploy. |
| The CA rejected ACME profile <name> (invalidProfile). | The CA does not accept the selected profile. | Select another profile or CA default, see chapter ACME profiles. |
| ACME profile '<name>' is not offered by this CA. The CA default is used. | The CA does not offer the stored profile. | Select one of the offered profiles if the CA default is not what you need. |