Canapin reports that Let’s Encrypt SSL certificates on their Discourse forum fail to auto-renew, showing timeout and malformed authorization errors in acme.sh.log, despite a standard setup with no CDN or reverse proxy. Rebuilding the app manually triggers successful renewal. pfaffman suggests the issue may relate to the ACME process not listening properly or HTTP-to-HTTPS redirection interfering, though notes the logs show HTTPS attempts. Canapin confirms the problem has persisted for months, requiring manual rebuilds (e.g., June 20 and recently). pfaffman recommends manually running the renewal inside the container for debugging. featheredtoast identifies the root cause: ACME struggles with HTTP-to-HTTPS redirects, as it defaults to using the original protocol (HTTP) during renewal. They note recent updates to the Let’s Encrypt template should resolve this going forward.
When was your last rebuild? Oh, but this has been going on for a while.
There was something recently about the http port being redirected for .well-known paths, but yours it https. It doesn’t make much sense that it’d be timing out unless the acme process that’s supposed to be listening isn’t for some reason.
I recently worked on the le cert renewal. It is the http to https redirect - acme does not handle being told to redirect well at all and by default attempts to connect on the same protocol (http) as it did when it was setup initially
Recent updates to the let’s encrypt template should fix these renewals going forward.
