JWS has an invalid anti-replay nonce error in Plesk and wondering what to do? Read on to find out what our experts suggest. 

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Service.

Let’s take a look at how our Support Team is ready to help customers with JWS has an invalid anti-replay nonce error in Plesk.

How to resolve: JWS has an invalid anti-replay nonce error in Plesk

Some of our customers have been running into trouble when they attempt to renew their Let’s Encrypt certificate on Plesk. This often results in the following error message:

Invalid response from https://acme-v02.api.letsencrypt.org/acme/order/85457982/6423753814.
Details:
Type: urn:ietf:params:acme:error:badNonce
Status: 400
Detail: JWS has an invalid anti-replay nonce:

JWS or JSON Web Signatures represents secure content with HMACs or digital signatures via JSON data structures. It involves securing the JWS Header and JWS Payload with cryptography with the help of a JWS Signature.

Let’s Encrypt is a free and automated open certificate authority that allows people and organizations to obtain, renew as well as manage SSL/TLS certificates.

Unfortunately, we run into the error: Cannot renew Let’s Encrypt certificate on Plesk with IPv6 enabled at times. Moreover, we will also notice that the Let’s Encrypt server name is seen in the error resolves to Ipv6 address:

# ping acme-v02.api.letsencrypt.org
PING acme-v02.api.letsencrypt.org(2606:4700:60:0:f53d:5624:85c7:3a2c (2606:4700:60:0:f53d:5624:85c7:3a2c)) 56 data bytes

Another symptom specific to this error is failure to connect to port 443 for Let’s Encrypt server:

# telnet acme-v02.api.letsencrypt.org 443
Trying 2606:4700:60:0:f53d:5624:85c7:3a2c...
telnet: connect to address 2606:4700:60:0:f53d:5624:85c7:3a2c: Connection timed out

Interestingly this error is due to the system firewall blocking outgoing Ipv6 traffic. Fortunately, our Support Team has an easy solution to resolve this issue.

1. First, we will connect to the server with the help of SSH.
2. Then, we will permit outgoing Ipv6 traffic to port 443 with the following command:

   # ip6tables -I OUTPUT 1 -p tcp --dport 443 -j ACCEPT
3. Next, we will save the new rule by running the command below:

   # iptables-save

[Looking for a solution to another query? We are just a click away.]

Conclusion

In essence, our skilled Support Engineers at Bobcares demonstrated how to resolve JWS has an invalid anti-replay nonce error.