Lego letsencrypt 'cloudflare: unexpected response code 'REFUSED'

Answer these questions to help the Community help you with Security questions.

What is the domain name?

Have you searched for an answer?

Please share your search results url:

When you tested your domain, what were the results?
tested what?
Server has existing cert √
Cannot renew√

Describe the issue you are having:
Unable to renew cert using acme client
Another Server with different subdomain is working fine

What error message or number are you receiving?
2023/11/13 15:53:46 [INFO] [] acme: Trying renewal with 296 hours remaining
2023/11/13 15:53:46 [INFO] [] acme: Obtaining bundled SAN certificate
2023/11/13 15:53:47 [INFO] [] AuthURL:
2023/11/13 15:53:47 [INFO] [] acme: Could not find solver for: tls-alpn-01
2023/11/13 15:53:47 [INFO] [] acme: Could not find solver for: http-01
2023/11/13 15:53:47 [INFO] [] acme: use dns-01 solver
2023/11/13 15:53:47 [INFO] [] acme: Preparing to solve DNS-01
2023/11/13 15:53:47 [INFO] [] acme: Cleaning DNS-01 challenge
2023/11/13 15:53:47 [WARN] [] acme: cleaning up failed: cloudflare: unexpected response code ‘REFUSED’ for
2023/11/13 15:53:47 [INFO] Deactivating auth:
2023/11/13 15:53:47 error: one or more domains had a problem:
[] [] acme: error presenting token: cloudflare: unexpected response code ‘REFUSED’ for

What steps have you taken to resolve the issue?

  1. validated script
  2. renewed token, verified token
  3. deleted API setup including token and set up from scratch

Was the site working with SSL prior to adding it to Cloudflare?

What are the steps to reproduce the error:

  1. run /usr/local/bin/ = error
    lego --email --dns cloudflare --domains run = error
  3. tried a bunch of other stuff as well

Have you tried from another browser and/or incognito mode?

Please attach a screenshot of the error:

ok this isn’t getting much traction, so maybe I can make it simpler-

What does this error message mean, or can I get more verbosity to explain it?

It’s a DNS Status Code, generally used when the nameserver cannot/refuses to perform the specific operation. Like if that nameserver can’t answer that query because it doesn’t know about the domain, for example you get refused if you ask Cloudflare Authoritive Nameservers about

There’s a few other cases:

If you are using a DNS Resolver that supports Extended DNS Errors (EDE) and the DNS Client you are using can read and display those, maybe: Dig through SERVFAILs with EDE

This seems more related to Traefik/Lego then Cloudflare though. This has already been talked about before on the forum as well:

It looks like there’s an option to disable that check entirely:

or disable it and force a delay like this user did:

I’m guessing something is going wrong with the check (default dns block, etc). Cloudflare propogates DNS changes so quickly anyway (like ~1-2s globally excluding local/resolver dns cache, which Let’s Encrypt bypasses) that just waiting a static amount of time works.

That error specifically is thrown by here:
Part of the pre-checks for DNS Propogation, which can be disabled as described above

1 Like

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.