Sometime back – it’s not clear how long but at least several months – Let’s Encrypt renewals started failing on my Discourse forum, after running fine for years. When I initially noted this some days ago, the cert had expired in August 2021. After trying some manual renewals and nginx restarts, I found the cert bumped up to expiring just a few days ago. Still not a current cert, obviously. Manually running acme.sh to force a renewal (within the discourse container) is yielding this error (where [site] is my site address, of course): [site]:Verify error:Fetching http://[site]/.well-known/acme-challenge/[long alpha challenge string]: Error getting validation data I should note that the site requires login for all user access, but this has not been a problem for ssl cert renews during the years of prior operation. Any ideas? Thanks very much! UPDATE: Testing the verify using wget returns a 404. However, I do not know where this data is configured into nginx for Discourse in a container and how it relates to the related nginx that proxies outside the container.

Bingo! This problem is solved. The underlying issue was poor connectivity through a tunnel providing a single ip address associated with the Discourse forum. While tests via other sites including external ones had not shown this, your recommended test via mobile (which I should have thought of, but with all the other tests I’d done I just didn’t think of it this time) did show the performance problem, which apparently was bad enough to prevent certificate renewals from completing (via the route that Let’s Encrypt was using). This was straightforward to solve once the tunnel was indicated as the culprit, and a rebuild of the Discourse app immediately pulled in renewed certs, so back to full operation. Thanks Jonathan and all! Have a great upcoming New Year!

Manually running the (in container) cron job for cert renewal, the failure is always the same. The attempt to get: http://[site]/.well-known/acme-challenge/[challenge-string] fails with “Error getting validation data.”

Not being familiar with the process, could it be expecting the container to be in a state which is not the case when running that script alone? E.g. perhaps it’s expecting another cron job to occur first which prepares nginx for allowing access to such a URL. Have you tried doing a rebuild? (Which will attempt to obtain a new certificate in the process.) You mention it’s hosted locally. Are you able to access the instance from outside your network using the domain name?

Hi, yes multiple rebuilds. No change. I use Let’s Encrypt on a bunch of non-discourse sites and they all renew just fine. Yes, I can access from an external site and I’ve tested using wget, the result is 404. Question: Exactly where does the nginx html tree live in this case, the part that would contain (or should contain) the .well-known directory? I have been unable to find it. Thanks.

I couldn’t find a cron job, just a runlevel script at /etc/runit/1.d/letsencrypt. It looks like that script starts a new instance of nginx with a config which includes this: location ~ /.well-known { root /var/www/discourse/public; allow all; } I think that means the path would end up being /var/www/discourse/public/acme-challenge, though it may well be created before the challenge, then removed afterwards. If that’s the script you’ve tried running manually, did you stop nginx first? The instance the script tries to start will try to listen on port 80 so I suspect that would fail if nginx is already running for Discourse.

I think I may see the problem. But I don’t know how to fix it. It appears that all attempts to access the forum on https port 80 are (as expected) being redirected https 443. Right. But this means that when Let’s Encrypt attempts to validate for the renewal, it fails, because the current certificate has expired. I can see the redirect with wget. So the question is, how do I disable the redirect temporarily so that Let’s Encrypt can validate and get me a new non-expired cert? An additional possible complication is that the redirect is a 301 permanent. Thanks.

This redirect is in /etc/nginx/conf.d/discourse.conf and will not be used when nginx is stopped, then started with the config mentioned in my previous post. I’m afraid I’m not very familiar with how the auto-upgrade works so I’m not sure what the appropriate method would be to renew while the container is running. In theory, just stopping and starting the container should result in it renewing but since you said a rebuild didn’t do it, that probably won’t either. acme.sh has options like --renew-all but I’m not sure what other options are needed for it to do the right thing here. The following might be all you need but I can’t say for certain. LE_WORKING_DIR="/shared/letsencrypt" /root/acme.sh/acme.sh --renew-all

And indeed this does permit Let’s Encrypt to get in without the redirect, but apparently the file it’s looking for does not exist, so ultimately the same verification failure.

I have the same problem. Has anyone worked out a clear procedure the correct the problem?

I’m now using this to try successfully get the cert. It appears that the validation token IS being retrieved by curl, but acme.sh is STILL declaring a validation failure every time! So still down. “/shared/letsencrypt”/acme.sh --renew-all --force --insecure --home “/shared/letsencrypt” --debug

Let's Encrypt cert renewals (suddenly) failing

Product Support Self-hosting

griffin (Jonathan Griffin) December 27, 2021, 8:11pm 18

Hi @L30110

I’m one of the regulars over in the Let’s Encrypt community. I was sent by @JimPas to take a look into this thread, which I will do as soon as I return from lunch.

Topic		Replies	Views
Let's Encrypt renewal errors Self-hosting	9	2007	February 22, 2020
Discourse failure to renew certificate Bug letsencrypt	24	1404	December 23, 2025
Letsencrypt not renewing Self-hosting	5	1669	July 14, 2017
Bootstrap error during Discourse install: ENOENT - /etc/runit/1.d/letsencrypt Self-hosting	24	828	November 21, 2025
Letsencrypt certificate failure to renew Product Support	10	1793	October 8, 2021

Let's Encrypt cert renewals (suddenly) failing

Related topics