Hello.
I have two servers with Debian Jessie and Apache. One server is in production and I’ve used certbot to get the certificate. The other is for development and I used letsencrypt first version to get the certificate.
Now in development server I deleted the old certificate and tried to make a new one.
I have an issue that I can’t solve, I’ve read thousand of discussion but any works.
this is the response when I try : Domain: www.domain.com Type: unauthorized Detail: Incorrect validation certificate for tls-sni-01 challenge. Requested xxx.xxx.acme.invalid from [xxx:xxx:xxx:xxx::x]:443. Received 2 certificate(s), first certificate had names "domain.com, www.domain.com"
Sounds like when you try to authorise the dev site, Let’s Encrypt connects to the live site instead. Are you sure you’ve got your DNS properly configured?
It’s not a question of testing, it’s a question of setting the correct DNS records If you’ve just updated them, you are probably going to have to wait for the new records to propagate through the DNS system. That can often take up to 24 hours.
Thanks kitserve, no update. I didn’t change the dns for years I had this problem today when I delete the old working certificate and try to make a new one
This advice is usually true for web development, but it happens that it's a misconception when applied to Let's Encrypt. Differently from a web browser, Let's Encrypt never relies on DNS caching and always goes directly to the authoritative DNS server and gets the most recent version of the DNS records. So, DNS record propagation is not a factor in Let's Encrypt certificate issuance.
There can still be cases where you ask a provider to make DNS changes and they take some time to make the changes (because a human being is applying them or because a script only performs the changes once per hour or something), but these aren't the situations that people are usually referring to when they mention DNS propagation.
My dns entries are ok, development and production are in different ips, and the system worked till yesterday.
I don’t know how to manage this issue.
Misterious stuff is that I have another website dev/prod in two different servers but I haven’t any problems. Same procedure, different results.
The error that you see indicates that Certbot thought it reconfigured your Apache to pass the challenge by serving custom certificates, but nonetheless when the CA connected to verify this, it found a web server that didn’t know about those custom certificates. There are many potential reasons for this, including not running Certbot on the right server, having a middlebox that actually terminates TLS (like a CDN or firewall that has a valid certificate for the site), running an additional web server or reverse proxy that actually terminates TLS, or having an Apache configuration that Certbot can’t parse but thinks that it can.
Maybe you can take a look at your Apache logs to make sure that the connection from the CA was actually received by your Apache, and also whether Certbot successfully made it reload its configuration right before that point.
Yes, I have deleted it.
When I try to reinstall I have “Certificate name mismatch” error.
I have used https://www.ssllabs.com/ssltest/analyze.html to check and I get this error.
So it’s technically my fault, but I don’t know why dns is not well configured. Before it worked and I haven’t made any change.
If you’ve just updated them, you are probably going to have to wait for the new records to propagate through the DNS system. That can often take up to 24 hours.
I had this problem today when I delete the old working certificate and try to make a new one 