Hello, I'm new to working on renewing a certificate. The person who was in charge of it before only provided me with the basics. Any help is appreciated.
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: ascella.bio
I ran this command: sudo certbot renew
It produced this output: Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.')
My web server is (include version): Ubuntu 20.04
The operating system my web server runs on is (include version): macOs 12.2.1
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know): Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
This message means that, when you originally obtained your cert, you used manual mode. As the name suggests, manual mode isn't automatic, and automatic is what certbot expects to do for renewal. You'll need to reissue the cert the same way you originally issued it.
Hello @number, welcome to the Let's Encrypt community.
Using this online tool https://crt.sh/ here is a list of issued certificates for the domain name crt.sh | ascella.bio.
Recent issued certificates have been from C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA. 2022-09-22 was the last time a certificate for the domain was issued from Let's Encrypt.
We are here to help you, it does not matter that the recent certificates are not from Let's Encrypt.
Actually that is the Operating System that the web server is running on.
We are looking for something like Apache or nginx or one of the many other web servers.
Yeah that is correct. The last one issued was from 2022-09-22, which is our domain. It just expired two weeks ago while we were on Christmas break. I think we are using nginx.
I have tried this command
sudo certbot certonly --manual -d ascella.bio -d *.ascella.bio --preferred-challenges=dns
but I got this output
Challenge failed for domain ascella.bio
Challenge failed for domain ascella.bio
dns-01 challenge for ascella.bio
dns-01 challenge for ascella.bio
Cleaning up challenges
Some challenges have failed.
IMPORTANT NOTES:
The following errors were reported by the server:
Domain: ascella.bio
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for
_acme-challenge.ascella.bio - check that a DNS record exists for
this domain
Domain: ascella.bio
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for
_acme-challenge.ascella.bio - check that a DNS record exists for
this domain
I don't know if this helps, but the person who did this before told me to use this command to renew the certificate. Apparently we are using amazon aws for it.
No, I am looking at your website. It is using the Sectigo cert that was issued Dec19.
What you are referring to is a cert. But, it is not currently being used by your website as far as I can tell. Use a site like this SSL Checker to see the cert your site is using:
Further, when I look at the HTTP response headers from your site it shows you are using a complex infrastructure. Even if you could get a new cert do you have any idea how you would update this infrastructure to use it?
I include this not for your benefit but for other volunteers so they are aware
curl -I https://www.ascella.bio
(numerous headers removed to focus on key parts)
HTTP/2 200
x-wix-request-id: 1672799835.955871817885619094
server-timing: cache;desc=hit, varnish;desc=hit, dc;desc=use1_g
server: Pepyaka/1.19.10
via: 1.1 google
$ nmap ascella.bio
Starting Nmap 7.80 ( https://nmap.org ) at 2023-01-04 03:46 UTC
Nmap scan report for ascella.bio (185.230.63.171)
Host is up (0.019s latency).
Other addresses for ascella.bio (not scanned): 185.230.63.107 185.230.63.186
rDNS record for 185.230.63.171: unalocated.63.wixsite.com
Not shown: 992 closed ports
PORT STATE SERVICE
25/tcp filtered smtp
80/tcp open http
82/tcp open xfer
83/tcp open mit-ml-dev
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
443/tcp open https
445/tcp filtered microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 1.44 seconds
$ nmap www.ascella.bio
Starting Nmap 7.80 ( https://nmap.org ) at 2023-01-04 03:46 UTC
Nmap scan report for www.ascella.bio (199.15.163.148)
Host is up (0.016s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 5.92 seconds
