Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 72 replies
  • Answers 4 answers
  • Subscribers 23 subscribers
  • Views 13250 views
  • Users 0 members are here
Options
Suggested

Sophos UTM 9.707-5 - Let’s Encrypt failed: Failed to retrieve the current Terms of Service link

lms87

Hello, 

I appear to be having issues trying to renew LE Certificates. This started a few days ago (when due for renewal) and initially I did come to this forum for answers and found that one post suggested to update to the latest UTM version. I'm now up to 9.707-5 but still have the same issue. 

Patterns also up to date:

Current pattern version: 204063
Latest available pattern version: 204063

It appears to be related to being unable to find the TOS but all links it shows resolve fine. The certificates I have are used for UTM Management and WAF.

Looking at the logs I see the following after turning the service off and back on...

2021:10:10-09:15:14 utm letsencrypt[9881]: I Create account: creating new Let's Encrypt acccount
2021:10:10-09:15:15 utm letsencrypt[9881]: E Create account: Incorrect response code from ACME server: 500
2021:10:10-09:15:15 utm letsencrypt[9881]: E Create account: URL was: acme-v02.api.letsencrypt.org/directory
2021:10:10-09:15:15 utm letsencrypt[9881]: E Create account: TOS_UNAVAILABLE: Failed to retrieve the current Terms of Service URL
2021:10:10-09:15:15 utm letsencrypt[9881]: E Create account: failed to create account

Prior to that, an attempt at renewing:

2021:10:10-08:44:02 utm letsencrypt[1020]: E Renew certificate: Incorrect response code from ACME server: 500
2021:10:10-08:44:02 utm letsencrypt[1020]: E Renew certificate: URL was: acme-v02.api.letsencrypt.org/directory
2021:10:10-08:44:02 utm letsencrypt[1020]: I Renew certificate: handling CSR REF_CaCsrXXXXLetsEncry for domain set [DOMAINS]
2021:10:10-08:44:02 utm letsencrypt[1020]: E Renew certificate: TOS_UNAVAILABLE: Could not obtain the current version of the Let's Encrypt Terms of Service
2021:10:10-08:44:02 utm letsencrypt[1020]: I Renew certificate: sending notification WARN-603
2021:10:10-08:44:02 utm letsencrypt[1020]: [WARN-603] Let's Encrypt certificate renewal failed accessing Let's Encrypt service
2021:10:10-08:44:02 utm letsencrypt[1020]: I Renew certificate: execution failed

The UTM has been rebooted, no change. I've turned off Web protection, no change...

Any ideas appreciated.

Thanks!
Parents
  • 0

    I just ran into this again, today. Months ago, I replaced the 93:­3C:­6D... cert with the CA:­BD:­2A... cert and it worked for a while.

    Today, I got these errors:

    2022:05:30-07:14:02 gateway letsencrypt[21106]: I Renew certificate: sending notification WARN-603
2022:05:30-07:14:02 gateway letsencrypt[21106]: [WARN-603] Let's Encrypt certificate renewal failed accessing Let's Encrypt service
2022:05:30-07:14:02 gateway letsencrypt[21106]: I Renew certificate: execution failed
2022:05:30-07:27:02 gateway letsencrypt[23352]: E Renew certificate: Incorrect response code from ACME server: 500
2022:05:30-07:27:02 gateway letsencrypt[23352]: E Renew certificate: URL was: acme-v02.api.letsencrypt.org/directory
2022:05:30-07:27:02 gateway letsencrypt[23352]: I Renew certificate: handling CSR REF_CaCsrBwservutec for domain set [sub.domain.tld]
2022:05:30-07:27:02 gateway letsencrypt[23352]: E Renew certificate: TOS_UNAVAILABLE: Could not obtain the current version of the Let's Encrypt Terms of Service

    Once again, I tried deleting/re-uping the correct X1 cert and restarting httpproxy but that did not help. I then tried unticking/ticking the Allow Let’s Encrypt certificates checkbox on the advanced page but then I got "Failed to create account" errors.

    What ended up working was removing ALL Let's Encrypt certs on the CA tab, rebooting the UTM and manually uploading only the R3 cert (https://letsencrypt.org/certs/lets-encrypt-r3.pem). I was then able to re-tick the Allow Let’s Encrypt certificates checkbox and the account was created. Subsequently, all LE certs were updated.

    Hope this is not a normal reoccuring event that needs to be handled every couple of months.

    ------------------------------------------------------------------
    9.711-5 Sophos UTM Software Home Edition
    Installed on a Dell OptiPlex XE SFF:
       • Intel® Core™2 Duo Processor E8600
       • 6M Cache, 3.33 GHz, 1333 MHz FSB
       • 8GB RAM
    ------------------------------------------------------------------



    Clearify
    [edited by: jeffshead at 1:52 PM (GMT -7) on 30 May 2022]
Reply
  • 0

    I just ran into this again, today. Months ago, I replaced the 93:­3C:­6D... cert with the CA:­BD:­2A... cert and it worked for a while.

    Today, I got these errors:

    2022:05:30-07:14:02 gateway letsencrypt[21106]: I Renew certificate: sending notification WARN-603
2022:05:30-07:14:02 gateway letsencrypt[21106]: [WARN-603] Let's Encrypt certificate renewal failed accessing Let's Encrypt service
2022:05:30-07:14:02 gateway letsencrypt[21106]: I Renew certificate: execution failed
2022:05:30-07:27:02 gateway letsencrypt[23352]: E Renew certificate: Incorrect response code from ACME server: 500
2022:05:30-07:27:02 gateway letsencrypt[23352]: E Renew certificate: URL was: acme-v02.api.letsencrypt.org/directory
2022:05:30-07:27:02 gateway letsencrypt[23352]: I Renew certificate: handling CSR REF_CaCsrBwservutec for domain set [sub.domain.tld]
2022:05:30-07:27:02 gateway letsencrypt[23352]: E Renew certificate: TOS_UNAVAILABLE: Could not obtain the current version of the Let's Encrypt Terms of Service

    Once again, I tried deleting/re-uping the correct X1 cert and restarting httpproxy but that did not help. I then tried unticking/ticking the Allow Let’s Encrypt certificates checkbox on the advanced page but then I got "Failed to create account" errors.

    What ended up working was removing ALL Let's Encrypt certs on the CA tab, rebooting the UTM and manually uploading only the R3 cert (https://letsencrypt.org/certs/lets-encrypt-r3.pem). I was then able to re-tick the Allow Let’s Encrypt certificates checkbox and the account was created. Subsequently, all LE certs were updated.

    Hope this is not a normal reoccuring event that needs to be handled every couple of months.

    ------------------------------------------------------------------
    9.711-5 Sophos UTM Software Home Edition
    Installed on a Dell OptiPlex XE SFF:
       • Intel® Core™2 Duo Processor E8600
       • 6M Cache, 3.33 GHz, 1333 MHz FSB
       • 8GB RAM
    ------------------------------------------------------------------



    Clearify
    [edited by: jeffshead at 1:52 PM (GMT -7) on 30 May 2022]
Children
No Data
Unfiltered HTML