Certificate Failed to Renew - authorizations for these names not found or expired

[yurik]

Some certificates were renewing before, but started failing to renew.
The error that we started seeing is:

Acme::Client::Error::Unauthorized: Error creating new cert :: authorizations for these names not found or expired

The documentation is a little vague and I would like to get some clarity on how the authorization object behaves.

1. If the domain has been authorized, how long does it stay valid for?
2. Is there a way to automate renewals without the need to re-authrorize the domain longterm (5 years)?

[cpu]

Hi @yurik,

Apologies about the failed renewals. That sounds frustrating.

@yurik

If the domain has been authorized, how long does it stay valid for?

Currently an authorization for a domain is valid for 30 days from the time it is validated.

Is there a way to automate renewals without the need to re-authrorize the domain longterm (5 years)?

There is not. The intention of the ACME protocol is that the domain challenge portion of issuance be automated by your ACME client. E.g. Certbot or another client should be able to provision a webroot for the HTTP-01 challenge, or a server for the TLS-SNI-01 challenge, or a TXT record in your DNS zone for DNS-01 challenges.

Let's Encrypt is also bound by the CA/Browser Forum's baseline requirements on how long "cached" validation data can be used for new certificates. Section 4.2.1 "Performing Identification and Authentication Functions" says:

Section 6.3.2 limits the validity period of Subscriber Certificates. The CA MAY use the documents and data provided in Section 3.2 to verify certificate information, provided that the CA obtained the data or document from a source specified under Section 3.2 no more than 825 days prior to issuing the Certificate.

That means there aren't any trusted CAs participating in the web PKI that can issue you a certificate without re-validating over a period of 5 years, at most you would have to re-validate every ~2.2 years.

Hope that helps!