# Cannot create/renew ACME certificate: "Cannot get ACME client get directory"

**URL:** <https://community.traefik.io/t/cannot-create-renew-acme-certificate-cannot-get-acme-client-get-directory/2469>\
**Category:** Traefik v1\
**Tags:** letsencrypt-acme\
**Created:** [October 19, 2019, 9:27am UTC](https://community.traefik.io/t/cannot-create-renew-acme-certificate-cannot-get-acme-client-get-directory/2469 "2019-10-19T09:27:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![peperunas](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/peperunas/32/1011_2.png) [@peperunas](https://community.traefik.io/u/peperunas)\
**Post date:** [October 19, 2019, 9:27am UTC](https://community.traefik.io/t/cannot-create-renew-acme-certificate-cannot-get-acme-client-get-directory/2469/1 "2019-10-19T09:27:42Z")

</div>

Hello everyone.

One of my domain's ACME certificates expired and I noticed I wasn't able to connect to my service anymore.

I took a look at the logs and it seems that this is the culprit:

`cannot get ACME client get directory at 'https://acme-v02.api.letsencrypt.org/directory': Get https://acme-v02.api.letsencrypt.org/directory: dial tcp 172.65.32.248:443: i/o timeout"`

I want to note that I haven't changed my configuration.

This is my `traefik.toml`:

```auto
logLevel= "DEBUG"
# defaultEntryPoints must be at the top because it should not be in any table below
defaultEntryPoints = ["http", "https"]

[web]
# Port for the status page
address = ":8080"

# Entrypoints, http and https
[entryPoints]

# http should be redirected to https
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"

# https is the default
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]

# Enable ACME (Let's Encrypt): automatic SSL
[acme]
# caServer = "https://acme-staging.api.letsencrypt.org/directory"
email = "test@example.com"
storage = "/etc/traefik/acme/acme.json" # or "traefik/acme/account" if using KV store
entryPoint = "https"
OnHostRule = true
onDemand = false

[acme.httpChallenge]
entryPoint = "http"

[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "example.com"
watch = true
exposedbydefault = false

```

I have also tried to use `tlsChallenge` to no avail. It seems that traefik's container is not able to connect to the internet for some reason.

Thank you very much!

---

<div class="post-metadata">

**Author:** ![dduportal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dduportal/32/4_2.png) [@dduportal](https://community.traefik.io/u/dduportal)\
**Post date:** [October 20, 2019, 3:19pm UTC](https://community.traefik.io/t/cannot-create-renew-acme-certificate-cannot-get-acme-client-get-directory/2469/2 "2019-10-20T15:19:41Z")

</div>

Hi @peperunas, as you guessed, Traefik container is not able to reach the internet. This problem is related to your infrastructure, not to Traefik, as the error message `i/o timeout` comes from your kernel (Traefik asked to kernel to establish a connection, and the kernel answered `i/O timeout`).

You need to provide more elements, as trying to analysis partial configuration is not really doable 😉  
What is the "container" system you are using? On which kind of machine? With which OS? etc.  
What does your network look like? Is there a proxy or a network firewall?

Some clues:

- Try to restart the Docker Engine, which will reset any iptables rules (assuming you are using Docker on Linux)
- Try to restart your whole machine
- Try to disable (temporarly) the firewall of your machine to verify that it fixes the issue

Hope it helps

---

<div class="post-metadata">

**Author:** ![peperunas](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/peperunas/32/1011_2.png) [@peperunas](https://community.traefik.io/u/peperunas)\
**Post date:** [October 28, 2019, 10:50am UTC](https://community.traefik.io/t/cannot-create-renew-acme-certificate-cannot-get-acme-client-get-directory/2469/3 "2019-10-28T10:50:42Z")

</div>

I had to reset all the docker networks to solve this problem. I noticed that every container on my system wasn't connected to the internet. I have no idea what could have caused this!

Thank you for your support!

---

<div class="post-metadata">

**Author:** ![hils](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/hils/32/6553_2.png) [@hils](https://community.traefik.io/u/hils)\
**Post date:** [January 26, 2023, 3:19am UTC](https://community.traefik.io/t/cannot-create-renew-acme-certificate-cannot-get-acme-client-get-directory/2469/4 "2023-01-26T03:19:15Z")

</div>

Hi @peperunas do you mind to explain what's exact step by step you did to solve this issue

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [January 29, 2023, 3:19am UTC](https://community.traefik.io/t/cannot-create-renew-acme-certificate-cannot-get-acme-client-get-directory/2469/5 "2023-01-29T03:19:57Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.