In Plesk, “Let’s Encrypt not renewing” is a regular problem that may be easily fixable using a few methods in this article. At Bobcares, with our Plesk Hosting Support Services, we can handle your Plesk Let’s Encrypt renewal issues.

Plesk: Let’s Encrypt Not Renewing Error

While we renew the Let’s Encrypt certificate, we may sometimes encounter an error message. The Let’s Encrypt Not Renewing Error in Plesk occurs due to many reasons. Considering those reasons, we should decide on the solution. In this article, we will look into some of the reasons and solutions to fix it.

Reasons For The Error

Reason 1

When we initiate the process of renewing the Let’s Encrypt certificate in Home > Domains > Domain.com > SSL/TLS Certificates > Reissue Certificate, the error may happen. The error occurs as the Plesk and the domain is secured by the same certificate and the certificate cannot be deleted. The error message looks like this:

Error: Let's Encrypt SSL/TLS certificate installation failed:
Remove certificate failure: One of the certificates you are going to delete is used for securing Plesk.

Solution:

The most appropriate solution is by securing Plesk with a unique certificate. Therefore, we have to use separate certificates to secure Plesk with the mail server and domain. To secure Plesk, follow the below steps:

1. Firstly, login to Plesk.
2. Then navigate to Home > Tools & Settings > SSL/TLS Certificates > Let’s Encrypt.
3. Now set the server hostname as the Domain name.
4. Click the Renew button
5. Then go to Home > Tools & Settings > SSL/TLS Certificate
6. lastly, change the Certificate for securing mail to Let’s Encrypt certificate.

To secure the domain, we can follow the below steps:

1. Firstly, login to Plesk.
2. Then navigate to Home > Domains > example.com > SSL/TLS Certificates.
3. Finally, click the Reissue Certificate button.

Reason 2

The Local DNS service stops in Tools & Settings > Services Management. We cannot create a new Let’s Encrypt SSL/TLS certificate or renew an existing one in Plesk. A message sent to the user’s Plesk displays the following error:

Error: Could not issue a Let's Encrypt SSL/TLS certificate for example.com.
Authorization for the domain failed.
Details Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz/9_fD4pJYnd6o4DNUxbG0WNtYOOm-G6TeHcz8TN1K9f4. Details: Type: urn:ietf:params:acme:error:unauthorized
Status: 403
Detail: Incorrect TXT record "Rq5AN5tnNTHnUNfh2byBWzDZNePjIOcSJDMJYK0ku6A" found at _acme-challenge.example.com

Solution:

1. Firstly, Login to Plesk
2. Then start the DNS service in Tools & Settings > Services Management.
3. Navigate to Domains > example.com > SSL/TLS Certificates.
4. Now click on Reissue certificate.
5. An image follows up. Then double-check if the TXT record resolves externally. This can be checked via ssh using the command dig TXT _acme-challenge.example.com +short.
6. If it does not resolve, add the record to the external DNS server, removing other existing acme-challenge records from there.
7. Finally, go back to the Plesk screen and click Reload button.

Reason 3

The product issue: #EXTLETSENC-573 “Decreased the possibility of rare issues when IDN domains could not be secured with SSL/TLS certificates from Let’s Encrypt.” is the reason for the error. Automatic Let’s Encrypt Certificate renewal for securing Plesk fails and the following error message can be found in /var/log/plesk/panel.log file:

# egrep “ILLEGAL_ARGUMENT” /var/log/plesk/panel.log
…
ERR [extension/letsencrypt] Failed to renew Panel certificate: idn_to_ascii: empty domain name: U_ILLEGAL_ARGUMENT_ERROR.
…

Solution:

Updating the server is the best solution. If the update isn’t possible, renewing manually Let’s Encrypt Certificate for securing Plesk going to Tools & Settings > SSL/TLS Certificates > Let’s Encrypt > Renew works successfully.

Reason 4

Let’s Encrypt auto-renew task is not working for Plesk or a domain if we rename it previously. This is because the Let’s Encrypt auto-renew feature relies on certificate names and does not recognize certificate names other than Let’s Encrypt example.com.

Solution:

Renewing the certificate manually in Tools & Settings > SSL/TLS Certificates > Let’s Encrypt > Renew is the available to secure Plesk. Also, to secure the domain, renew this certificate manually from Domains > example.com > SSL/TLS Certificates > Get it free.

Reason 5

The module runAllManagedModulesForAllRequests is enabled in the domain’s web .config file. So Let’s Encrypt certificate for a particular domain in Plesk can not be renewed automatically with the error message below:

Failed to renew certificate of domain 'example.com': Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/13769068820.
Details:
Type: urn:ietf:params:acme:error:connection
Status: 400
Detail: Fetching https://acme-challenge.localhost:443/.well-known/acme-challenge/jhpl_titvpnxqcffch5s9semwhzx1ytmjnhnngeyqek:
Invalid hostname in redirect target, must end in IANA registered TLD

Solution:

1. Firstly, login to Plesk.
2. Then go to Domains > example.com > File Manager page.
3. Now click on the file named web.config to open it for editing.
4. Disable the runAllManagedModulesForAllRequests module by modifying the below lines:

   <modules

   runAllManagedModulesForAllRequests=“true”>

   …

   </modules>

   Modified to:

   <modules

   runAllManagedModulesForAllRequests=“false”>

   …

   </modules>
5. Finally, click the Save button to apply changes.

[Looking for a solution to another query? We are just a click away.]

Conclusion

To conclude, we provide different solutions from our Support team for various causes of the error in Plesk, Let’s Encrypt not renewing.