Lets encrypt renew fail

Question

Hi everyone, 
 We're using the integrated Let's Encrypt feature in SFOS V21. We've noticed some strange behavior when it comes to renewing certificates. 
 When the firewall attempts to renew the certificate, it fails with the message: "Reason for failure: unknown network error." This issue affects all Let's Encrypt certificates on the appliance. However, when the certificate is deleted and new issued, the verification works immediately. In both cases &ndash; whether renewing or issuing &ndash; the Let's Encrypt requests can be seen in the WAF log. 
 The Sophos Firewall has its public IP address directly on its WAN interface, so there's no provider router that could potentially block ports. 
 Does anyone have any tips for us? 
 
 Greetings!

AttilaKovacs · Accepted Answer

Hi, I can't send you a PM, so answering here. You still have an old certificate from the EAP for kennwort.hv-office.de, and this cannot be renewed anymore due to an IP address change, please recreate this one as well, then the issue should be solved.

LuCar Toni · Answer

To give context: The config made in EAP is invalid. If you save now in GA a new certificate, the config is valid and will work for a renewal.

Lets encrypt renew fail

Top Replies