I'm trying to renew my letsencrypt certs and getting the following error:

remote error: tls: handshake failure

How do I fix this?


I had Cloudflare running on the site, once I paused it I could renew the certs.


Consider specifying the http-01 method. For example,

sudo certbot renew --preferred-challenges http-01

The http-01 challenge works by generating a file at a specific web-accessible location under the domain under consideration. The challenge relies on HTTP (port 80) rather than HTTPS (e.g., the tls-sni-01 challenge method). Avoiding reliance on TLS can be a step forward in addressing the error you encounter.

The --preferred-challenges, perhaps self-evidently, cues certbot, for plugins which can handle more than one challenge method.

  • In light of the answer posted by the OP and in general you may want to explain what that option does and why that work-around may solve the problem. For instance “by renewing over plain http on port 80 rather than over https on port 443, you can avoid TLS warnings.” BTW when you redirect http to https you will still get an error unless you exclude the /.well-known/acme-challenge path from such a redirect – HBruijn Nov 19 '18 at 22:21
  • @HBruijn Thanks for the cues for additional elaboration. – user45793 Nov 20 '18 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.