# Let's Encrypt cron error **URL:** \ **Category:** Uncategorized\ **Created:** [January 7, 2021, 5:49pm UTC](https://forum.hestiacp.com/t/lets-encrypt-cron-error/2483 "2021-01-07T17:49:15Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jlguerrero](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/jlguerrero/32/954_2.png) [@jlguerrero](https://forum.hestiacp.com/u/jlguerrero)\ **Post date:** [January 7, 2021, 5:49pm UTC](https://forum.hestiacp.com/t/lets-encrypt-cron-error/2483/1 "2021-01-07T17:49:15Z")
Everynight since January 4th, I get this error email: > [root@srv1.mydomain.com](mailto:root@srv1.mydomain.com) > cron [admin@srv1](mailto:admin@srv1) sudo /usr/local/hestia/bin/v-update-letsencrypt-ssl > Error: Let’s Encrypt validation status 400. Details: Unable to update challenge :: authorization must be pending I have already checked: - [Let's Encrypt 400 Problem](https://forum.hestiacp.com/t/lets-encrypt-400-problem/1870) → No solution - [Error: Let's Encrypt acc registration failed - #6 by Raphael](https://forum.hestiacp.com/t/error-lets-encrypt-acc-registration-failed/206/6) → Too old - [Error: Let's Encrypt nonce request status](https://forum.hestiacp.com/t/error-lets-encrypt-nonce-request-status/209) → Tried. Didn’t work - [V-add-letsencrypt-domain cron job error - #2 by eris](https://forum.hestiacp.com/t/v-add-letsencrypt-domain-cron-job-error/1740/2) → Nothing in the pipe - [DNS for Let's Encrypt](https://forum.hestiacp.com/t/dns-for-lets-encrypt/439) → Does not apply I have run the command /usr/local/hestia/bin/v-update-letsencrypt-ssl - It tries to get let’s encrypt certificates for 137 domains. - Some of them fail but I don’t know which of them - the exit status if the command is 0 /usr/local/hestia/bin/v-update-letsencrypt-ssl Questions: - Where does the script store the log? - How can I get to know which domain is failing otherwise? - I am concerned about the certificate for the machine’s name itself. How can I make sure it is not failing to renew? Feature request: - Configure error to show which domains / subdomains are failing and why. ---
**Author:** ![eris](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/eris/32/1241_2.png) [@eris](https://forum.hestiacp.com/u/eris)\ **Post date:** [January 7, 2021, 6:00pm UTC](https://forum.hestiacp.com/t/lets-encrypt-cron-error/2483/2 "2021-01-07T18:00:19Z")
/var/log/hestia/ And there is an file created user-domain-date.log ---
**Author:** ![jlguerrero](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/jlguerrero/32/954_2.png) [@jlguerrero](https://forum.hestiacp.com/u/jlguerrero)\ **Post date:** [January 8, 2021, 11:06am UTC](https://forum.hestiacp.com/t/lets-encrypt-cron-error/2483/3 "2021-01-08T11:06:24Z")
Thank you very much @eris for your time. /usr/local/hestia/bin/v-add-letsencrypt-domain admin [c02.mydomain.com](http://c02.mydomain.com) Fails: Exit code 15 AND root@c02:/usr/local/hestia/bin# ./v-list-dns-domains admin DOMAIN IP TPL TTL REC SPND DATE * * * I get an **empty response**. No domains under admin ??? ![image](https://forum.hestiacp.com/uploads/default/original/2X/0/070fc62ac573cebd1252e54bd75dffca89894693.png) ---
**Author:** ![jlguerrero](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/jlguerrero/32/954_2.png) [@jlguerrero](https://forum.hestiacp.com/u/jlguerrero)\ **Post date:** [January 8, 2021, 11:54am UTC](https://forum.hestiacp.com/t/lets-encrypt-cron-error/2483/4 "2021-01-08T11:54:39Z")
**Disabling completely SSL Support for the website in subdomain:** **[c02.mydomain.com](http://c02.mydomain.com) and enabling it back again renewed the certificate.** To test if it is solved I manually executed the command /usr/local/hestia/bin/v-add-letsencrypt-domain admin [c02.mydomain.com](http://c02.mydomain.com) The certificate was renewed again. Problem solved. ---
**Author:** ![eris](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/eris/32/1241_2.png) [@eris](https://forum.hestiacp.com/u/eris)\ **Post date:** [January 8, 2021, 12:29pm UTC](https://forum.hestiacp.com/t/lets-encrypt-cron-error/2483/5 "2021-01-08T12:29:31Z")
Disableing SSL and renewing is no real option. For one domain it is maybe fine but 100 takes way to long… ---
**Author:** ![jlguerrero](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/jlguerrero/32/954_2.png) [@jlguerrero](https://forum.hestiacp.com/u/jlguerrero)\ **Post date:** [January 8, 2021, 2:00pm UTC](https://forum.hestiacp.com/t/lets-encrypt-cron-error/2483/6 "2021-01-08T14:00:24Z")
In case it helps you debug the problem. The problem is on a MAIL + DNS server and **only the name of the machine fails for now**. I kept the output of bash -x /usr/local/hestia/bin/v-add-letsencrypt-domain admin [c02.mydomain.com](http://c02.mydomain.com) ``` + echo -e '\n==[Step 5]==\n- status: 400\n- nonce: 0104hu_OuKU0fL9d-JgyVh4pUPZWrSVr5wYto0aAC02XQ3Y\n- validation: \n- details: Unable to update challenge :: authorization must be pending\n- answer: HTTP/2 400 server: nginx date: Fri, 08 Jan 2021 10:50:31 GMT content-type: application/problem+json content-length: 144 boulder-requester: 101121629 cache-control: public, max-age=0, no-cache link: [](https://acme-v02.api.letsencrypt.org/directory);rel="index" replay-nonce: 0104hu_OuKU0fL9d-JgyVh4pUPZWrSVr5wYto0aAC02XQ3Y { "type": "urn:ietf:params:acme:error:malformed", "detail": "Unable to update challenge :: authorization must be pending", "status": 400 }\n' + [[400 -ne 200]] + '[' '!' -z bind9 ']' ++ **/** **usr/local/hestia/bin/v-list-dns-domains admin** ++ grep **c02.mydomain.com** ++ cut '-d ' -f1 + **dns_domain=** ++ **/usr/local/hestia/bin/v-list-dns-records admin c02.mydomain.com** ++ grep -i letsencrypt ++ cut '-d ' -f1 + caa_record= + '[' '' = c02.mydomain.com ']' + debug_log 'Abort Step 5' '=> Wrong status' + echo -e '\n==[Abort Step 5]==\n=> Wrong status\n' + check_result 15 'Let'\''s Encrypt validation status 400. Details: Unable to update challenge :: authorization must be pending' + '[' 15 -ne 0 ']' + echo 'Error: Let'\''s Encrypt validation status 400. Details: Unable to update challenge :: authorization must be pending' Error: Let's Encrypt validation status 400. Details: Unable to update challenge :: authorization must be pending + '[' '!' -z '' ']' + log_event 15 ' '\''admin'\'' '\''c02.mydomain.com'\''' + '[' -z '' ']' ++ date '+%F %T' ++ basename /usr/local/hestia/bin/v-add-letsencrypt-domain + LOG_TIME='2021-01-08 11:50:32 v-add-letsencrypt-domain' + '[' 15 -eq 0 ']' + echo '2021-01-08 11:50:32 v-add-letsencrypt-domain '\''admin'\'' '\''c02.mydomain.com'\'' [Error 15]' + exit 15 ``` ---
**Author:** ![jlguerrero](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/jlguerrero/32/954_2.png) [@jlguerrero](https://forum.hestiacp.com/u/jlguerrero)\ **Post date:** [January 8, 2021, 2:21pm UTC](https://forum.hestiacp.com/t/lets-encrypt-cron-error/2483/7 "2021-01-08T14:21:33Z")
I think it can’t work because it is looking for DNS zones for the admin user. The admin user doesn’t have any DNS zones. Only the ownership of the website of the subdomain with the name of the machine: [c02.mydomain.com](http://c02.mydomain.com) ---
**Author:** ![ivanpos](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/i/bcef8e/32.png) [@ivanpos](https://forum.hestiacp.com/u/ivanpos)\ **Post date:** [January 11, 2021, 4:08pm UTC](https://forum.hestiacp.com/t/lets-encrypt-cron-error/2483/8 "2021-01-11T16:08:05Z")
My errors have been to do with the panel\> domain\> force ssl setting and when I uncheck this the domains then renew SSL cert/.s The script mentioned here is very useful for finding affected error domains. > [@Letsencrypt renewal not working with Force SSL, Bug?](https://forum.hestiacp.com/t/letsencrypt-renewal-not-working-with-force-ssl-bug/2018): > > Ok, so I’ve been troubleshooting this one for a while. I set up a server around three months ago, so this is the first time the SSL certs were renewing. I’ve been getting emails like this from one server Subject: Cron [admin@server](mailto:admin@server) sudo /usr/local/hestia/bin/v-update-letsencrypt-ssl Error: Let’s Encrypt validation status 400. Details: Unable to update challenge :: authorization must be pending The server holds several websites, so I wasn’t sure which one was causing the error. In the end I fou…