Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 85 replies
  • Answers 5 answers
  • Subscribers 32 subscribers
  • Views 39662 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM 9.707-5 - Let’s Encrypt failed: Failed to retrieve the current Terms of Service link

lms87

Hello, 

I appear to be having issues trying to renew LE Certificates. This started a few days ago (when due for renewal) and initially I did come to this forum for answers and found that one post suggested to update to the latest UTM version. I'm now up to 9.707-5 but still have the same issue. 

Patterns also up to date:

Current pattern version: 204063
Latest available pattern version: 204063

It appears to be related to being unable to find the TOS but all links it shows resolve fine. The certificates I have are used for UTM Management and WAF.

Looking at the logs I see the following after turning the service off and back on...

2021:10:10-09:15:14 utm letsencrypt[9881]: I Create account: creating new Let's Encrypt acccount
2021:10:10-09:15:15 utm letsencrypt[9881]: E Create account: Incorrect response code from ACME server: 500
2021:10:10-09:15:15 utm letsencrypt[9881]: E Create account: URL was: acme-v02.api.letsencrypt.org/directory
2021:10:10-09:15:15 utm letsencrypt[9881]: E Create account: TOS_UNAVAILABLE: Failed to retrieve the current Terms of Service URL
2021:10:10-09:15:15 utm letsencrypt[9881]: E Create account: failed to create account

Prior to that, an attempt at renewing:

2021:10:10-08:44:02 utm letsencrypt[1020]: E Renew certificate: Incorrect response code from ACME server: 500
2021:10:10-08:44:02 utm letsencrypt[1020]: E Renew certificate: URL was: acme-v02.api.letsencrypt.org/directory
2021:10:10-08:44:02 utm letsencrypt[1020]: I Renew certificate: handling CSR REF_CaCsrXXXXLetsEncry for domain set [DOMAINS]
2021:10:10-08:44:02 utm letsencrypt[1020]: E Renew certificate: TOS_UNAVAILABLE: Could not obtain the current version of the Let's Encrypt Terms of Service
2021:10:10-08:44:02 utm letsencrypt[1020]: I Renew certificate: sending notification WARN-603
2021:10:10-08:44:02 utm letsencrypt[1020]: [WARN-603] Let's Encrypt certificate renewal failed accessing Let's Encrypt service
2021:10:10-08:44:02 utm letsencrypt[1020]: I Renew certificate: execution failed

The UTM has been rebooted, no change. I've turned off Web protection, no change...

Any ideas appreciated.

Thanks!


This thread was automatically locked due to age.
Parents
  • 0

    My case:

    Sophos UTM version: 9.712-13

    I already had this problem in the past. The correct X1 certificate was present, and let's encrypt was working fine.
    Today I couldn't renew some certificate and Let's Encrypt account was disabled.

    Deleting the X1 certificate warned me about other certificate (the one which I use for WebAdmin). Only when I deleted this certificate also, Let's encrypt account was created again.

  • 0 in reply to Alejandro Sanchez

    Same problem on my utm.
    2022:09:27-10:09:22 letsencrypt[12209]: I Create account: creating new Let's Encrypt acccount
    2022:09:27-10:09:24 letsencrypt[12209]: E Create account: Incorrect response code from ACME server: 500
    2022:09:27-10:09:24 letsencrypt[12209]: E Create account: URL was: acme-v02.api.letsencrypt.org/directory
    2022:09:27-10:09:24 letsencrypt[12209]: E Create account: TOS_UNAVAILABLE: Failed to retrieve the current Terms of Service URL
    2022:09:27-10:09:24 letsencrypt[12209]: E Create account: failed to create account

    I disabled Let's Encrypt option and reset it.
    A cannot enable it again:
    The previous attempt to enable Let’s Encrypt failed: Failed to retrieve the current Terms of Service link. Please try again or check the Internet connection if the problem persists.

  • +1 in reply to Michael Zickwolf

    Same error. Old URL Unavailable: This is what helped me. Seems to be Important to disable the Webfilter/Webproxy and reenable it again but i dont know the order as first or after the first apply of the LE apply button. Apply LE without selecting the the LE checkbox. After the red failure Text disappears set the LE checkbox active and apply. Shortly after this order LE was set again. It seems the first apply accepted the new EULA and with the second apply of the same button and the LE checkbox activates LE again. 

    The enbedded Link for the EULA first was from 2017 after the first apply push the EULA was from 2022 and the LE was able to activate.

     

    Not easy to monitor when LE changed its eula and this deactivates the LE function of the Sophos without knowing it. Only was aknowledged by O365 Mail Bounce Messages and in subinformations for expired certificates.

  • 0 in reply to Stefan Weiss1

    Hallo Stefan and welcome to the UTM Community!

    Do I understand correctly that you simply pressed [Übernehmen] three times before you selected 'Let's Encrypt Zertifikate zulassen' and then [Übernehmen] a fourth time?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hello

    Try to disable IPv6, don't know why but it failed to resolve with it (and also from some websites with wget on ssh)

    Here result, before selected with IPV6, after selected without IPv6

    Cheers

  • 0 in reply to Stefan Weiss1

    Had this happen recently too with several certs coming up on renewal.  It actually seems to throw the system into a bizarre loop with tons of log entries in the system log.

    Re-enabling allow LE certs on the advanced page seems to do the trick.

Reply Children
No Data
Unfiltered HTML