others-how to solve Connection to ocsp.int-x3.letsencrypt.org timed out error

Oct 8, 2020

Problem

When we renew letencrypt certificates like this:

letsencrypt-auto renew --no-self-upgrade

we get this error:

Traceback (most recent call last):
  File "/opt/eff.org/certbot/venv/lib64/python3.6/site-packages/certbot/ocsp.py", line 188, in _check_ocsp_cryptography
    timeout=timeout)
  File "/opt/eff.org/certbot/venv/lib64/python3.6/site-packages/requests/api.py", line 119, in post
    return request('post', url, data=data, json=json, **kwargs)
  File "/opt/eff.org/certbot/venv/lib64/python3.6/site-packages/requests/api.py", line 61, in request
    return session.request(method=method, url=url, **kwargs)
  File "/opt/eff.org/certbot/venv/lib64/python3.6/site-packages/requests/sessions.py", line 530, in request
    resp = self.send(prep, **send_kwargs)
  File "/opt/eff.org/certbot/venv/lib64/python3.6/site-packages/requests/sessions.py", line 643, in send
    r = adapter.send(request, **kwargs)
  File "/opt/eff.org/certbot/venv/lib64/python3.6/site-packages/requests/adapters.py", line 504, in send
    raise ConnectTimeout(e, request=request)
requests.exceptions.ConnectTimeout: HTTPConnectionPool(host='ocsp.int-x3.letsencrypt.org', port=80): Max retries exceeded with url: / (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7fb70561e908>, 'Connection to ocsp.int-x3.letsencrypt.org timed out. (connect timeout=10)'))
Cert not yet due for renewal

Solution

The basics

Let’s Encrypt is a free, automated, and open certificate authority (CA) that provides domain-validated (DV) SSL/TLS certificates. It was initiated by the nonprofit Internet Security Research Group (ISRG) to help secure the entire web by making it easier for websites to obtain and use SSL/TLS certificates. These certificates are used to encrypt the communication between a user’s browser and the website, ensuring that the data transferred is secure and private.

The certificates provided by Let’s Encrypt are valid for 90 days, which means that you need to renew them every three months to maintain the security of your website. The renewal process is designed to be straightforward and can be automated to ensure that your certificates are always up-to-date.

Here’s a step-by-step guide on how to renew a Let’s Encrypt certificate:

Install Certbot: Certbot is a client that interfaces with Let’s Encrypt’s CA to obtain and renew certificates. If you haven’t already installed it, you can do so using your system’s package manager. For example, on Ubuntu, you might use the following command:
```
sudo apt-get update
sudo apt-get install certbot
```
Choose a Plugin: Certbot supports different plugins depending on the web server you’re using. For example, if you’re using Nginx, you would use the Nginx plugin.
Run the Renewal Command: To manually renew the certificate, you can use the following command:
```
sudo certbot renew --nginx
```
This command will prompt you through the renewal process. If there are no issues, it will successfully renew your certificate.
Automate Renewal: The recommended way to renew certificates is to run certbot renew automatically at least once per day. This can be done by setting up a cron job. Certbot itself provides a post-install script that can set up this cron job for you. If it didn’t run, you can manually add it with the following command:
```
sudo certbot renew --quiet
```
Check the Renewal Status: You can check the status of your certificates and their renewal by looking in the /etc/letsencrypt/renewal folder. Each certificate has its own directory with a renewal.conf file that stores the command options and profiles used for the certificate.
Web Server Integration: If you’re using a web server, you’ll need to ensure that it’s configured to use the certificates provided by Let’s Encrypt. Certbot can typically do this for you during the initial certificate generation or renewal process.
Follow Best Practices: It’s important to follow the best practices for security and to keep your server and Certbot up to date to ensure the smoothest operation of your SSL/TLS certificates.

Remember, the renewal process is designed to be non-disruptive, so your website should continue to operate normally while the certificate is being renewed.

For more detailed instructions or if you encounter any issues, you can refer to the official Let’s Encrypt documentation or community forums for help.

The solution

You can just ignore this error , just do as follows:

service nginx restart

Start a web browser , navigate to your website, check your certificate. Everything should be ok now.