Articles in this section

Unable to issue the Let's Encrypt certificate in Plesk: Detail: Order's status ("pending") is not acceptable for finalization

Rangel Sardinha
Updated
kb: bug Plesk for Linux ext: le

Symptoms

Unable to issue the Let's Encrypt certificate: 

CONFIG_TEXT: Detail: Order's status ("pending") is not acceptable for finalization

Cause

This is a Plesk bug with the ID EXTPLESK-10225, which will be fixed in future updates.

Resolution

Until the bug is fixed, the following steps can be applied as a workaround:

  1. Log into the server via SSH

  2. Search for the file under/usr/local/psa/var/modules/letsencrypt/ordersusing the domain name:

    # grep -r "example.com" /usr/local/psa/var/modules/letsencrypt/orders
    /usr/local/psa/var/modules/letsencrypt/orders/73e9346c3fc065d13305183342f962c17b0bed5c.json

  3. Remove the JSON files found in the output of the command on step 2:

    # rm -f /usr/local/psa/var/modules/letsencrypt/orders/73e9346c3fc065d13305183342f962c17b0bed5c.json

  4. Log into Plesk
  5. Reissue the Let's Encrypt SSL certificate at Domains > example.com > SSL/TLS Certificates
Was this article helpful?

Comments

1 comment
Date Votes
  • Avatar
    Paul Daly
    (Edited )

    I am experiencing this issue on Plesk Obsidian with SSL It! 1.23.0 and Let's Encrypt 3.5.0.

    This is a mail-only domain. The website is hosted elsewhere and the authoritative DNS is hosted by Cloudflare, so I need to use DNS-01 to secure:

    mail.mydomain.com
    webmail.mydomain.com

    SSL It! successfully creates the DNS-01 challenges, but after the required TXT records have been added and are publicly resolvable, the order remains permanently in pending status.

    I confirmed the TXT records were visible from:

    • Cloudflare's authoritative nameservers
    • 1.1.1.1
    • 8.8.8.8
    • the Plesk server's own configured DNS resolvers

    Despite this, running:

    plesk ext sslit --certificate -issue -domain mydomain.com -continue

    repeatedly returned:

    status: pending

    Inspection of the Let's Encrypt order JSON showed both DNS challenges remained:

    "isPerformed": true
    "isConfirmed": false

    I completely cancelled and removed the original order, cleared the stale order data and created a brand-new certificate order. Plesk generated new DNS-01 TXT values, which were again added to Cloudflare and verified as publicly resolvable. The new order exhibited exactly the same behaviour and remained pending with isConfirmed:false.

    To rule out Cloudflare, DNS propagation and Let's Encrypt itself, I then installed Certbot on the same Plesk server and requested a certificate for exactly the same two hostnames using a manual DNS-01 challenge.

    Certbot successfully issued the Let's Encrypt certificate immediately once the TXT records were present.

    I imported that certificate into Plesk and assigned it to the domain. It is now working correctly for both IMAP and webmail.

    This therefore appears to be a reproducible problem with Plesk/SSL It!'s DNS-01 challenge continuation/confirmation rather than an external DNS or Let's Encrypt problem.

    This is particularly problematic for mail-only Plesk servers, where the customer's website is hosted elsewhere and HTTP-01 may not be available. DNS-01 is therefore not an edge case for this type of configuration.

    It would be useful to know when #EXTLETSENC-1169 is expected to be fixed, as the current workaround leaves certificates issued manually outside Plesk and therefore prevents Plesk from handling their normal automatic renewal.

    0

Please sign in to leave a comment.