Major Cert issue/delete problem

After deleting a cert from the server, it remained active on the www.  Deleting the cert from the addon domain removed it from the server but all online ssl tests indicated that the cert was active for another 71 days.  That was 12 hours ago.  This morning still listed as active.  But it is absent from the CP.  And a new on throws a dns error.

I had to restore my entire server from a linode back up to get my site back.

Bad very bad.

I just tried adding a new addon domain.  Then I tried adding a cert.  Getting the same error ....dns domain doesnt point to this server.  And of course it does point to my server.

Changed the hostname to the same hostname thinking that might resolve issues.  Now admin GUI has no cert.  What is the problem with certs?

https://community.letsencrypt.org/t/issue-from-multiple-intermediates-during-a-scheduled-transition-period/142054

Cannot resolve cert problem on my server.  So I spun up another server on Linode (this time with cent7) and tried to generate a cert.  No go.   Same error stating DNS does not point to this server.   The dns does point to the server.  Is this a LE problem or a CWP problem?  I have lots of certs that are coming up for renewal and its not going to happen.

I cannot delete the certs either.  When I try to delete one, it disappears from the list of certs but remains active on the web.  PLEASE PLEASE will someone look into this problem.

I suppose there is a small chance that Linode is the problem but I dont think that is possible.

OK, some developments.

If I create a new domain and cert at the same time.......cert is generate.  hurray!

BUT

If I create a domain with no cert and then try to create a cert AutoSSL (FREE), I get the DNS not pointing error.

So, this now is looking like at web panel problem. 

I just discovered that I have websites that never renewed on Dec 21.   So this problem goes back as far as Dec 21 and most likely even earlier.  This problem exists on all 3 of my servers.

So here is the reason why......firewall was enabled with filtering for USA only.  Great, I knew that once before but forgot.

BUT.  There is a hole in the firewall that allows cert creation at the time of domain addon.   BUT that hole is closed in any subsequent attempts to create/renew a cert on an existing domain.

So.......this seems to be a HUGE inconsistency that needs to be explored.  It ought to be one way or the other but not both.  Either no certs possible or both cert creations allowed. 

Just my humble opinion.

It's a PITA but Let'sEncrypt uses dynamic IP/CDN locations for cert renewal. They even use servers that are notorious for harbouring scammers/hackers/scanners, such as AWS, Digital Ocean, Hetzner and Contabo (to name a few). On some of my VPS, I need to temporarily disable CSF to renew certs. The downside of choosing a free SSL cert provider.

It's a PITA but Let'sEncrypt uses dynamic IP/CDN locations for cert renewal. They even use servers that are notorious for harbouring scammers/hackers/scanners, such as AWS, Digital Ocean, Hetzner and Contabo (to name a few). On some of my VPS, I need to temporarily disable CSF to renew certs. The downside of choosing a free SSL cert provider.

It seems that LE changes their server IPs regularly.  Therefore it cannot be white listed.  As long as anyone has no LE country blocks, the certs will renew or create. 

The thing that I dont get is that if I create a new addon domain I can create a new cert at the same time WITHOUT DISABLING THE FIREWALL.   But if I want to renew I get the dns doesn not point error. 

We need to investigate this:

So you have to open your firewall.

But you can restrict the access to the folder /.well-known/acme-challenge/

There your ACME-Client creats a special file which Letsencrypt loads.

It seems that LE changes their server IPs regularly.

This is the key issue.
If they would publish up-to-date IPs that are used, then it becomes nearly trivial to whitelist them, even if changed regularly.