# Cert Expired, Acmetool Service Failed \[invalid IPv6 record in DNS\]

**URL:** <https://forum.delta.chat/t/cert-expired-acmetool-service-failed-invalid-ipv6-record-in-dns/5610>\
**Category:** Chatmail Relays\
**Tags:** solved, chatmail\
**Created:** [August 2, 2026, 3:17pm UTC](https://forum.delta.chat/t/cert-expired-acmetool-service-failed-invalid-ipv6-record-in-dns/5610 "2026-08-02T15:17:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![untoasted-duvet](https://forum.delta.chat/user_avatar/forum.delta.chat/untoasted-duvet/32/3379_2.png) [@untoasted-duvet](https://forum.delta.chat/u/untoasted-duvet)\
**Post date:** [August 2, 2026, 3:17pm UTC](https://forum.delta.chat/t/cert-expired-acmetool-service-failed-invalid-ipv6-record-in-dns/5610/1 "2026-08-02T15:17:12Z")

</div>

Hello,

My certificate expired and it seems that the failing service `acmetool-reconcile` is to blame. The redacted output from `journalctl` is,

```auto
error satisfying Target(chat.example.com,mta-sts.chat.example.com,www.chat.example.com;https://acme-v02.api.letsencrypt.org/directory;0): the following errors occurred:
exhausted all possible challenges in authorization "https://acme-v02.api.letsencrypt.org/acme/authz/1234/5678" [due to inner error: the following errors occurred:
could not install DNS challenge, no hooks succeeded;
challenge type not supported];

```

I checked with `cmdeploy dns` and the CAA record that it is providing, Namecheap does not think is valid. This is the first time the certificate has attempted to be renewed, so I am not certain if this DNS record is the issue.

Can I use `acmetool` to manually renew the cert somehow?

Thank you!

---

<div class="post-metadata">

**Author:** ![untoasted-duvet](https://forum.delta.chat/user_avatar/forum.delta.chat/untoasted-duvet/32/3379_2.png) [@untoasted-duvet](https://forum.delta.chat/u/untoasted-duvet)\
**Post date:** [August 2, 2026, 4:35pm UTC](https://forum.delta.chat/t/cert-expired-acmetool-service-failed-invalid-ipv6-record-in-dns/5610/2 "2026-08-02T16:35:57Z")

</div>

I tried removing the CAA record I had in my domain settings, but that did not change anything.

~~I do not see any challenges in `/var/www/html/.well-known/acme-challenge` so that might line up with the message that it could not install the challenge.~~

~~I noticed that `/var/www/html` was owned by my non-priviledged user, probably an error on my part when I was messing around with adding another site to the same VPS. I’ve changed the owner and group to `root` with no success unfortunately. Should that be owned by a different user?~~

Running `acmetool --xlog.severity=debug reconcile` shows that it was able to create the challenge, but when it failed, it deleted the files afterwards. It seems I’m getting rate limited now too, so will have to try again later.

---

<div class="post-metadata">

**Author:** ![untoasted-duvet](https://forum.delta.chat/user_avatar/forum.delta.chat/untoasted-duvet/32/3379_2.png) [@untoasted-duvet](https://forum.delta.chat/u/untoasted-duvet)\
**Post date:** [August 2, 2026, 8:39pm UTC](https://forum.delta.chat/t/cert-expired-acmetool-service-failed-invalid-ipv6-record-in-dns/5610/3 "2026-08-02T20:39:31Z")

</div>

I’ll note that this error: `acmetool.solver: unsuccessful challenge: authorization` only fails for the IPv6 address. Nothing is mentioned about this challenge with the IPv4 address, so I must assume that it is working for that address?

`acmetool` is looking to use ports 402 and 4402, as port 80 is already in use, so I’ve opened those in the firewall to no avail.

---

<div class="post-metadata">

**Author:** ![untoasted-duvet](https://forum.delta.chat/user_avatar/forum.delta.chat/untoasted-duvet/32/3379_2.png) [@untoasted-duvet](https://forum.delta.chat/u/untoasted-duvet)\
**Post date:** [August 2, 2026, 9:29pm UTC](https://forum.delta.chat/t/cert-expired-acmetool-service-failed-invalid-ipv6-record-in-dns/5610/4 "2026-08-02T21:29:04Z")

</div>

It turns out that my VPS had an IPv6 address assigned to it like 1234:3456:4578:6789::2 and my DNS records were set up like 1234:3456:4578:6789::

Adjusting the record has fixed the issue. 🙏

EDIT: Adding a link here that was quite helpful in figuring this all out: [https://letsdebug.net/](https://letsdebug.net/)

---

<div class="post-metadata">

**Author:** ![link2xt](https://forum.delta.chat/user_avatar/forum.delta.chat/link2xt/32/1971_2.png) [@link2xt](https://forum.delta.chat/u/link2xt)\
**Post date:** [August 3, 2026, 4:52am UTC](https://forum.delta.chat/t/cert-expired-acmetool-service-failed-invalid-ipv6-record-in-dns/5610/5 "2026-08-03T04:52:38Z")

</div>

Similar thread with incorrectly configured IPv6 resulting in failure to get certificates even with IPv4 working: [My relay has expired certificate and cmdeploy run fails](https://support.delta.chat/t/my-relay-has-expired-certificate-and-cmdeploy-run-fails/5571)

---

<div class="post-metadata">

**Author:** ![r10s](https://forum.delta.chat/user_avatar/forum.delta.chat/r10s/32/1513_2.png) [@r10s](https://forum.delta.chat/u/r10s)\
**Post date:** [October 6, 2026, 3:41pm UTC](https://forum.delta.chat/t/cert-expired-acmetool-service-failed-invalid-ipv6-record-in-dns/5610/6 "2026-10-06T15:41:01Z")

</div>