Articles in this section

See more

[FIXED BUG] Unable to install a Let's Encrypt certificate: Order's status ("pending") is not acceptable for finalization or No order for ID

Avatar
George Alibegashvili
Updated
Follow

Applicable to:

  • Plesk for Linux
  • Plesk for Windows

Symptoms

  • A Let's Encrypt certificate installation fails with one of the following error messages:

    PLESK_ERROR: Error: Could not issue a Let's Encrypt SSL/TLS certificate for example.com.
    ...
    Details:
    Type: urn:ietf:params:acme:error:orderNotReady
    Status: 403
    Detail: Order's status ("pending") is not acceptable for finalization

    PLESK_ERROR: Error: Could not issue a Let's Encrypt SSL/TLS certificate for example.com.
    Details
    Invalid response from https://acme-v02.api.letsencrypt.org/acme/order/63114583/905220149.
    Details:
    Type: urn:ietf:params:acme:error:malformed
    Status: 404
    Detail: No order for ID 905220149

  • Previously, there was an attempt to install a Let's Encrypt certificate on the same domain, but it failed.

Cause

Product issue:

  • #EXTLETSENC-765 "If users face the “No order for ID” error when they renew their SSL/TLS certificates, the extension fixes the error in the background and the users are asked to issue an SSL/TLS certificate once again, which helps in most cases."
    Fixed in:

Resolution

Please consider updating your server:

Workaround

Click on a section to expand

Plesk for Linux

  1. Connect to the Plesk server via SSH

  2. Search for the JSON file which contains the Let's Encrypt order in the /usr/local/psa/var/modules/letsencrypt/orders folder:

    # egrep -Ril example.com /usr/local/psa/var/modules/letsencrypt/orders
    /usr/local/psa/var/modules/letsencrypt/orders/c92788fed3b07d20e4ad823731285d30f0c88dcb.json

    Note: replace the example.com with the name of the affected domain.

  3. Remove the JSON file retrieved with the previous command:

    # rm /usr/local/psa/var/modules/letsencrypt/orders/c92788fed3b07d20e4ad823731285d30f0c88dcb.json

  4. Reissue the Let's Encrypt certificate

Plesk for Windows

  1. Connect to the Plesk server via RDP

  2. Start a command prompt as Administrator

  3. Search for the JSON file which contains the Let's Encrypt order in the %plesk_dir%var\modules\letsencrypt\orders folder:

    C:\> findstr /M example.com "%plesk_dir%var\modules\letsencrypt\orders\*"
    C:\Program Files (x86)\Plesk\var\modules\letsencrypt\orders\1eda6b4e824a9ddcf4d0f43b6b3b9600b76344b6.json

    Note: replace the example.com with the name of the affected domain.

  4. Remove the JSON file retrieved with the previous command:

    C:\> del "%plesk_dir%var\modules\letsencrypt\orders\1eda6b4e824a9ddcf4d0f43b6b3b9600b76344b6.json"

  5. Reissue the Let's Encrypt certificate

Comments

9 comments

Sort by Date Votes
  • Avatar
    Tom Heuts (Edited )

    This bug is really annoying.
    I've got several certificates that are (about to) expire.
    Running CentOS 7 and resolution doesn't work.

    0
    Comment actions Permalink
  • Avatar
    Ivan Postnikov

    Hello @Tom,

    Usually, this workaround works without issues.

    If possible, consider creating a support request to us or to our partner, depending on where the license was purchased to check the issue deeper:

    https://support.plesk.com/hc/en-us/articles/213608509-How-to-submit-a-request-to-Plesk-support-

     

    0
    Comment actions Permalink
  • Avatar
    Tom Heuts (Edited )

    Hi Ivan Postnikov, thank you for your response!

    Unfortunately Plesk is purchased via a partner (TransIP).

    They can't help me either...

     

    I solved it now by removing and reinstalling Let's Encrypt AND SSL It!

    0
    Comment actions Permalink
  • Avatar
    Ivan Postnikov

    Hello Tom Heuts

    Glad to hear it's solved.

    Also, there's a way to contact Plesk Support directly with licenses purchased from our partners: https://support.plesk.com/hc/en-us/articles/213953025-How-to-get-support-directly-from-Plesk-

    0
    Comment actions Permalink
  • Avatar
    Eva Tarín

    ¿Como se sabe que fichero json es el que tiene problemas? me salen muchos....

    1
    Comment actions Permalink
  • Avatar
    Shawn K. Hall

    Deleting the existing JSON request didn't work for me, and being concerned about uninstalling the extension I opted to simply disable and reenable the LetsEncrypt extension. Tried reissuing a troublesome certificate afterwards and it worked again.

    0
    Comment actions Permalink
  • Avatar
    Ivan Postnikov

    Hello Shawn K. Hall,

    Thank you for sharing, it may be useful for other Pleskians.

    0
    Comment actions Permalink
  • Avatar
    Ivan Postnikov

    Hello Eva Tarín,

    The workaround is for domains one by one.

    The workaround is to be applied for each domain with such an error.

    The search for .json is described in "Resolution" section

     

    0
    Comment actions Permalink
  • Avatar
    Aitor Forner Cotillas

    Hola Eva Tarín

    igual ya lo has resuelto, pero por si acaso, con el comando

    # egrep -Ril [example.com] /usr/local/psa/var/modules/letsencrypt/orders

    donde [example.com] debe ser tu dominio, apuntará a un .json.

    Después para borrarlo copia la línea que te dió como resultado y ejecuta el comando:

    # rm [pegas la línea con el .json]

    0
    Comment actions Permalink

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles