Network is unreachable when trying to retrieve Let's Encrypt certificate

[gbakeman]

I see there are lots of errors regarding certificates that usually end up being a configuration issue, but I haven't seen this particular problem yet so I'm hoping someone can help me out.

I'm trying to setup an LE certificate for my NPM installation (v2.9.21), using both standard and DNS request types. Both times, it fails with the following error:

An unexpected error occurred:
ValueError: Requesting acme-v02.api.letsencrypt.org/directory: Network is unreachable

I would think this means my host cannot reach that requested domain. Sure enough:

curl acme-v02.api.letsencrypt.org/directory
curl: (56) Recv failure: Connection reset by peer

However, if I explicitly add in the HTTPS protocol:

curl https://acme-v02.api.letsencrypt.org/directory

{
  "IIJK8Sh-XN8": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
  "meta": {
    "caaIdentities": [
      "letsencrypt.org"
    ],
    "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf",
    "website": "https://letsencrypt.org"
  },
  "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
  "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
  "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
  "renewalInfo": "https://acme-v02.api.letsencrypt.org/get/draft-ietf-acme-ari-00/renewalInfo/",
  "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"

I'm a bit mystified by this. Is it a certbot issue?

podman run -it --rm certbot/certbot certonly --agree-tos --authenticator webroot --email "my email" --preferred-challenges "dns,http" --domains "my domain"

...

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:

...

So, at least it looks like it's communicating with LE and simply experiencing a different problem that I need to troubleshoot. My question is, is there a problem with the particular version of certbot that NPM is using?

Possibly related:

• SSL duckdns internal error #1955
• https://community.letsencrypt.org/t/certbot-renew-error-network-is-unreachable/77479
• https://superuser.com/questions/1478768/configuring-certbot-for-my-website-network-is-unreachable
• https://community.letsencrypt.org/t/suddenly-network-is-unreachable/40565/3
• ValueError: Requesting acme-v01.api.letsencrypt.org/directory: Network is unreachable certbot/certbot#6987
• https://community.letsencrypt.org/t/certbot-auto-renew-error-network-is-unreacheable/162455
• ... and many more.

[gbakeman]

The problem has magically resolved its self at this point. A few theories as to why:

• Originally, I was running podman as root to get around the privileged port limitation on my host. I've since removed that limitation and redone the container so that it runs as a normal user.
• Updated system packages including the kernel, then rebooted.