I have an API server for mobile apps hosted on Hetzner (for 2 years). This week suddenly I'm getting error:
Failed to retrieve verification certificates: Your client does not have permission to get URL /oauth2/v3/certs from this server. 403 Forbiden.
Server is running on PHP. For Google Sing In from mobile app server API has to process and verify Google id_token. For token verification API is fetching Google public keys from https://www.googleapis.com/oauth2/v3/certs and there is thrown this error. Also server can't access to any "Google" website. Every request will be rejected.
Error body:
Failed to retrieve verification certificates: "\n\n \n <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">\n <title>Error 403 (Forbidden)!!1</titlez>\n <stylez>\n {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}\n </style>\n <span id=logo aria-label=Google></span></a>\n
403.</b> <ins>That's an error.</ins>\n <p>Your client does not have permission to get URL <code>/oauth2/v3/certs</code> from this server. <ins>That's all we know.</ins>\n"."
From localhost or other server is everything working fine. Have you any ideas what's wrong?
I've tried lookup if my IP address is no at blacklist using Spamhaus or MXToolbox, but I was not helpful.