Cannot add 36th SAN for certificate

[Guuske]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: netwerk.nivon.nl,template-afdeling.nivon.nl,rotterdam.nivon.nl,enschede.nivon.nl,groenehartpad.nivon.nl,drenthepad.nivon.nl,pikafestival-nieuw.nivon.nl,emmen-nieuw.nivon.nl,groningenassen.nivon.nl,drechtsteden.nivon.nl,fryslan-nieuw.nivon.nl,brabantsvennenpad.nivon.nl,noaberpad-nieuw.nivon.nl,vcw.nivon.nl,stellingenpad.nivon.nl,maartenvanrossumpad.nivon.nl,utrechtpad.nivon.nl,zangenmuziekgilde-nieuw.nivon.nl,arnhem-nieuw.nivon.nl,template-accommodatie.nivon.nl,zwolle-nieuw.nivon.nl,purmerend-nieuw.nivon.nl,krikkenhaar-nieuw.nivon.nl,dekleinerug-nieuw.nivon.nl,lettelbert-nieuw.nivon.nl,denbroam-nieuw.nivon.nl,hethallsehull-nieuw.nivon.nl,abkhuis-nieuw.nivon.nl,bosbeek-nieuw.nivon.nl,dekleinerug.nivon.nl,allardsoog-nieuw.nivon.nl,100jaar.nivon.nl,amsterdam-nieuw.nivon.nl,template-reizen.nivon.nl,overijsselshavezatenpad.nivon.nl

I ran this command: I wanted to add one more domain.

It produced this output:
HTTP/2 400
server: nginx
date: Tue, 05 Dec 2023 09:42:44 GMT
content-type: application/problem+json
content-length: 177
boulder-requester: 1449151366
cache-control: public, max-age=0, no-cache
link: https://acme-v02.api.letsencrypt.org/directory;;rel="index"
replay-nonce: V03LKs9TFvBPTphz8UsRU_Jut6QV5-xUEfzg4ewDDbXCwEyLG3Y

{
"type": "urn:ietf:params:acme:error:badNonce",
"detail": "JWS has an invalid anti-replay nonce: "MGOHGLivtLXTjBaNWpEgVsnSh7oWw8V92NP9iSdoR_sXgx2Zp2s"",
"status": 400
}

EXPECTED value GOT EOF

My web server is (include version): nginx / 1.22.1

The operating system my web server runs on is (include version): Ubuntu 20.04.5

My hosting provider, if applicable, is:DigitalOcean, provisioned by Laravel Forge.

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Laravel Forge

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Using dehydrated.io

[9peppe]

@Guuske

JWS has an invalid anti-replay nonce

This sounds pretty clear to me.

As for why dehydrated is doing this, I have no idea.

[petercooperjr]

Yeah, that's usually an error that the ACME client just retries and all is well.

Have you gotten this problem more than once? Have you tried in the staging environment?

[rg305]

Are you getting all those names on one single cert?
If so, do you really need to use one single cert?

[Osiris]

Dehydrated should automatically try again when encountering an invalid anti-replay nonce error. Maybe you're running an outdated version of dehydrated? Unfortunately you didn't specify the version you're using.

You also might consider using a wildcard certificate for *.nivon.nl with all those subdomains. It would require using the dns-01 challenge though and I'm not sure if LinQhost has an API to add and remove the required TXT records automatically. Otherwise you might be able to run your own intstance of acme-dns, which would only require a static CNAME in the nivon.nl zone.