A certificate request fails or the browser warns about the certificate
What you see
Section titled “What you see”- A message starting “Certificate issuance failed:” when you create a site or click Issue HTTPS certificate.
- “DNS pre-check failed for example.com: …”.
- “acme contact email “…” is invalid or a placeholder. Edit /etc/hyperion/agent.toml [acme] contact_email and restart hyperion-agent.”
- Browsers warn that the site’s certificate is not trusted, or has expired.
- A notification that a renewal failed.
1. The domain does not point at this node
Section titled “1. The domain does not point at this node”The most common cause. Hyperion checks DNS first and refuses to ask Let’s Encrypt for a domain that does not resolve to the node. The message ends with the checker’s note, for example what the domain resolves to instead.
Check: on the site’s Domains & SSL tab, click Check DNS. A green DNS OK line is good. A yellow DNS mismatch line shows what the domain resolves to and this node’s addresses. From a shell:
dig +short example.com Adig +short example.com AAAAFix: correct the records, wait for DNS to propagate, then issue again. A site created before its DNS points here keeps the self-signed certificate until you do.
2. The contact address is empty or a placeholder
Section titled “2. The contact address is empty or a placeholder”Issuance stops at the start for an empty address, one that does not contain @, or one ending in @example.com, @example.org, @example.net or @hyperion.invalid.
Check: Settings, HTTPS & previews, Let’s Encrypt contact.
Fix: enter a real address and save. A site can carry its own address, see Issue an HTTPS certificate.
3. Let’s Encrypt cannot reach the site
Section titled “3. Let’s Encrypt cannot reach the site”Validation requests http://<domain>/.well-known/acme-challenge/… on port 80. A firewall, a block at the provider, or a proxy in front of the site stops it. With Cloudflare in front and Full (strict) set while the site still has the self-signed certificate, validation cannot pass. Set Full, issue, then switch back; the site page shows “Behind Cloudflare with a self-signed origin certificate.” in this case.
Check: from another network, curl -I http://example.com/.well-known/acme-challenge/test answers from the node, even with a 404. The Firewall page shows whether port 80 is open, see Manage a node’s firewall.
4. A wildcard certificate is waiting for DNS records
Section titled “4. A wildcard certificate is waiting for DNS records”A wildcard certificate is validated by DNS records, not by port 80. Each name needs its own _acme-challenge TXT record. “Not validated yet” means the records are not visible yet. Follow Issue a wildcard certificate.
5. An alias is missing from the certificate
Section titled “5. An alias is missing from the certificate”After you add an alias, the existing certificate does not cover it. The site page shows “The certificate does not cover …”. Issue again.
6. Renewal fails
Section titled “6. Renewal fails”A daily check renews certificates that expire within 30 days. It does not run the DNS check. A failure raises a notification every day until it is renewed. The usual causes are 1 and 3 above, a domain that moved to another server, or a DNS record that changed.
Fix the cause, then follow Issue an HTTPS certificate. To renew every certificate on a node at once:
sudo hctl cert renew-allCheck that it is fixed
Section titled “Check that it is fixed”echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -enddateThe issuer names Let’s Encrypt and notAfter is about 90 days away.