[GH-ISSUE #876] zerossl申请证书，网络通畅，但是一直显示超时

kerem commented

2026-03-03 01:04:34 +03:00

Owner

Originally created by @KeithXZhai on GitHub (Jul 16, 2025).
Original GitHub issue: https://github.com/certimate-go/certimate/issues/876

软件版本 / Release Version

0.3.23

问题描述 / Description

通过ZeroSSL+CF申请证书，已配置好了EAB，CF配置如下：

一直报错如下（已抹去隐私内容）：

error: one or more domains had a problem: [*.xxxx.xxx] Post "https://acme.zerossl.com/v2/DV90/authz/xxxxxxxxxxxx": net/http: timeout awaiting response headers

已经确认该服务器可以正常访问https://acme.zerossl.com/v2/DV90/，curl返回值正常：

其他 / Miscellaneous

No response

Originally created by @KeithXZhai on GitHub (Jul 16, 2025). Original GitHub issue: https://github.com/certimate-go/certimate/issues/876 ### 软件版本 / Release Version 0.3.23 ### 问题描述 / Description 通过ZeroSSL+CF申请证书，已配置好了EAB，CF配置如下： <img width="1474" height="873" alt="Image" src="https://github.com/user-attachments/assets/944ce2ff-9692-468d-8bf6-c19c25a3d6ce" /> 一直报错如下（已抹去隐私内容）： ``` error: one or more domains had a problem: [*.xxxx.xxx] Post "https://acme.zerossl.com/v2/DV90/authz/xxxxxxxxxxxx": net/http: timeout awaiting response headers ``` 已经确认该服务器可以正常访问`https://acme.zerossl.com/v2/DV90/`，curl返回值正常： <img width="1046" height="383" alt="Image" src="https://github.com/user-attachments/assets/90b15bad-ba1a-485f-b426-cc5bd82edccd" /> ### 其他 / Miscellaneous _No response_

kerem

2026-03-03 01:04:34 +03:00

closed this issue
added the
stale
label

kerem commented

2026-03-03 01:04:35 +03:00

Author

Owner

@fudiwei commented on GitHub (Jul 16, 2025):

挂的代理吗？

https://docs.certimate.me/docs/getting-started/configuration#http-proxy

@fudiwei commented on GitHub (Jul 16, 2025): 挂的代理吗？ > https://docs.certimate.me/docs/getting-started/configuration#http-proxy

kerem commented

2026-03-03 01:04:35 +03:00

Author

Owner

@KeithXZhai commented on GitHub (Jul 16, 2025):

挂的代理吗？

https://docs.certimate.me/docs/getting-started/configuration#http-proxy

没有使用代理，机器不在墙内。在配置不变的情况下尝试了许多次然后终于成功了一次……我不太理解是什么原因导致的……
失败的原因90%是net/http: timeout awaiting response headers

@KeithXZhai commented on GitHub (Jul 16, 2025): > 挂的代理吗？ > > > https://docs.certimate.me/docs/getting-started/configuration#http-proxy 没有使用代理，机器不在墙内。在配置不变的情况下尝试了许多次然后终于成功了一次……我不太理解是什么原因导致的…… 失败的原因90%是`net/http: timeout awaiting response headers` <img width="1540" height="680" alt="Image" src="https://github.com/user-attachments/assets/e7e33ee6-0474-4c55-9da1-0a6537b5b990" />

kerem commented

2026-03-03 01:04:35 +03:00

Author

Owner

@fudiwei commented on GitHub (Jul 16, 2025):

说实话这类网络问题基本无法排查，绝大部分情况都与应用无关 😕

Issue 先开着吧，看看有没有有其他人有类似情况。

@fudiwei commented on GitHub (Jul 16, 2025): 说实话这类网络问题基本无法排查，绝大部分情况都与应用无关 😕 Issue 先开着吧，看看有没有有其他人有类似情况。

kerem commented

2026-03-03 01:04:35 +03:00

Author

Owner

@FarrelF commented on GitHub (Jul 16, 2025):

Sorry I'm joining here, but just now I'm having the same issue.

ZeroSSL's ACME servers are terribly unstable, seems nothing change since a long time ago until now, so I'm not too surprised that issue like this often arise and I myself using Google Trust Services instead.

Is there any way option to increase/set up the timeout limit here? I know this is not a solution since the problem is from their side, but at least it minimise the timeout error because problem like this and open up the possibility of users being able to get their certificates from ZeroSSL.

Lego seems have a feature to set timeout limit (see lego help), but I don't know if this will have any effect on this timeout issue case.

@FarrelF commented on GitHub (Jul 16, 2025): Sorry I'm joining here, but just now I'm having the same issue. ZeroSSL's ACME servers are terribly unstable, seems nothing change since a long time ago until now, so I'm not too surprised that issue like this often arise and I myself using Google Trust Services instead. Is there any way option to increase/set up the timeout limit here? I know this is not a solution since the problem is from their side, but at least it minimise the timeout error because problem like this and open up the possibility of users being able to get their certificates from ZeroSSL. Lego seems have a feature to set timeout limit (see `lego help`), but I don't know if this will have any effect on this timeout issue case. <img width="1920" height="926" alt="Image" src="https://github.com/user-attachments/assets/5f21f47a-3917-4a54-b1e4-5654437adf08" />

kerem commented

2026-03-03 01:04:35 +03:00

Author

Owner

@fudiwei commented on GitHub (Jul 17, 2025):

Sorry I'm joining here, but just now I'm having the same issue.

ZeroSSL's ACME servers are terribly unstable, seems nothing change since a long time ago until now, so I'm not too surprised that issue like this often arise and I myself using Google Trust Services instead.

Is there any way option to increase/set up the timeout limit here? I know this is not a solution since the problem is from their side, but at least it minimise the timeout error because problem like this and open up the possibility of users being able to get their certificates from ZeroSSL.

Lego seems have a feature to set timeout limit (see lego help), but I don't know if this will have any effect on this timeout issue case.

Thanks for your feedback.

But I'm afraid it won't be helpful if you're referring to the --http-timeout option.

In Golang, there are many parameters related to HTTP timeouts, such as Timeout, TLSHandshakeTimeout, ResponseHeaderTimeout, IdleConnTimeout, ExpectContinueTimeout, etc. The --http-timeout option only controls Timeout but doesn't affect ResponseHeaderTimeout. However, the error mentioned above, net/http: timeout awaiting response headers, is precisely influenced by ResponseHeaderTimeout.

Of course, I can increase this parameter programmatically. As you said, the problem is from their side. The parameter's already set to 120 seconds as default now, and I don't believe increasing it further would work.

@fudiwei commented on GitHub (Jul 17, 2025): > Sorry I'm joining here, but just now I'm having the same issue. > > ZeroSSL's ACME servers are terribly unstable, seems nothing change since a long time ago until now, so I'm not too surprised that issue like this often arise and I myself using Google Trust Services instead. > > Is there any way option to increase/set up the timeout limit here? I know this is not a solution since the problem is from their side, but at least it minimise the timeout error because problem like this and open up the possibility of users being able to get their certificates from ZeroSSL. > > Lego seems have a feature to set timeout limit (see `lego help`), but I don't know if this will have any effect on this timeout issue case. Thanks for your feedback. But I'm afraid it won't be helpful if you're referring to the `--http-timeout` option. In Golang, there are many parameters related to HTTP timeouts, such as `Timeout`, `TLSHandshakeTimeout`, `ResponseHeaderTimeout`, `IdleConnTimeout`, `ExpectContinueTimeout`, etc. The `--http-timeout` option only controls `Timeout` but doesn't affect `ResponseHeaderTimeout`. However, the error mentioned above, `net/http: timeout awaiting response headers`, is precisely influenced by `ResponseHeaderTimeout`. Of course, I can increase this parameter programmatically. As you said, the problem is from their side. The parameter's already set to 120 seconds as default now, and I don't believe increasing it further would work.

kerem commented

2026-03-03 01:04:36 +03:00

Author

Owner

@FarrelF commented on GitHub (Jul 18, 2025):

Sorry I'm joining here, but just now I'm having the same issue.
ZeroSSL's ACME servers are terribly unstable, seems nothing change since a long time ago until now, so I'm not too surprised that issue like this often arise and I myself using Google Trust Services instead.
Is there any way option to increase/set up the timeout limit here? I know this is not a solution since the problem is from their side, but at least it minimise the timeout error because problem like this and open up the possibility of users being able to get their certificates from ZeroSSL.
Lego seems have a feature to set timeout limit (see lego help), but I don't know if this will have any effect on this timeout issue case.

Thanks for your feedback.

But I'm afraid it won't be helpful if you're referring to the --http-timeout option.

In Golang, there are many parameters related to HTTP timeouts, such as Timeout, TLSHandshakeTimeout, ResponseHeaderTimeout, IdleConnTimeout, ExpectContinueTimeout, etc. The --http-timeout option only controls Timeout but doesn't affect ResponseHeaderTimeout. However, the error mentioned above, net/http: timeout awaiting response headers, is precisely influenced by ResponseHeaderTimeout.

Of course, I can increase this parameter programmatically. As you said, the problem is from their side. The parameter's already set to 120 seconds as default now, and I don't believe increasing it further would work.

I'm not just referring to --http-timeout, but there is --cert.timeout and --dns-timeout too.

Especially --cert.timeout, which is only used when obtaining a certificate, which can sometimes be problematic in that area due to their server, but yeah, I don't think it would be useful for the "Response Headers Timeout" issue that randomly appears due to their server and --http-timeout only controls Timeout as you said.

So I think there is no solution to case like this currently yet except waiting for the server to get better, trying again, subscribe the paid plan and then use their REST API (not the ACME one) or not using ZeroSSL at all.

@FarrelF commented on GitHub (Jul 18, 2025): > > Sorry I'm joining here, but just now I'm having the same issue. > > ZeroSSL's ACME servers are terribly unstable, seems nothing change since a long time ago until now, so I'm not too surprised that issue like this often arise and I myself using Google Trust Services instead. > > Is there any way option to increase/set up the timeout limit here? I know this is not a solution since the problem is from their side, but at least it minimise the timeout error because problem like this and open up the possibility of users being able to get their certificates from ZeroSSL. > > Lego seems have a feature to set timeout limit (see `lego help`), but I don't know if this will have any effect on this timeout issue case. > > Thanks for your feedback. > > But I'm afraid it won't be helpful if you're referring to the `--http-timeout` option. > > In Golang, there are many parameters related to HTTP timeouts, such as `Timeout`, `TLSHandshakeTimeout`, `ResponseHeaderTimeout`, `IdleConnTimeout`, `ExpectContinueTimeout`, etc. The `--http-timeout` option only controls `Timeout` but doesn't affect `ResponseHeaderTimeout`. However, the error mentioned above, `net/http: timeout awaiting response headers`, is precisely influenced by `ResponseHeaderTimeout`. > > Of course, I can increase this parameter programmatically. As you said, the problem is from their side. The parameter's already set to 120 seconds as default now, and I don't believe increasing it further would work. I'm not just referring to `--http-timeout`, but there is `--cert.timeout` and `--dns-timeout` too. Especially `--cert.timeout`, which is only used when obtaining a certificate, which can sometimes be problematic in that area due to their server, but yeah, I don't think it would be useful for the "Response Headers Timeout" issue that randomly appears due to their server and `--http-timeout` only controls `Timeout` as you said. So I think there is no solution to case like this currently yet except waiting for the server to get better, trying again, subscribe the paid plan and then use their REST API (not the ACME one) or not using ZeroSSL at all.

kerem referenced this issue

2026-03-03 01:07:10 +03:00

[PR #597] [MERGED] new providers #991

Rows
Columns

[GH-ISSUE #876] zerossl申请证书，网络通畅，但是一直显示超时 #597

软件版本 / Release Version

问题描述 / Description

其他 / Miscellaneous