Hello,
I am running a manual certbot DNS challenge since a year with zero issues. It asked me to update DNS records and I did it, even if in theory I could automate the process with plugins.
Since a week ago or so, as soon as I launch the command, I am getting:
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.
I don’t have a web server. I am not using obsolete TLS challenge (lots of similiar questions one year ago were about Certbot abandoning TLS challenge).
I did not change a comma in the command I use to refresh the certificates, but it stopped working.
I tried updating certbot using the PPA but the error still persists.
I am going to attach the log at the end of this post.
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
kv.fleurworld.com
I ran this command:
certbot certonly --manual --preferred-challenges dns -d kv.fleurworld.com -d kv01.fleurworld.com -d fleurworld.com
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.
My web server is (include version):
None, this is a server that only runs its own daemons
The operating system my web server runs on is (include version):
Ubuntu Linux 18.04 LTS
My hosting provider, if applicable, is:
Digital Ocean, manually updating records on Cloudflare
I can login to a root shell on my machine (yes or no, or I don’t know):
Yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
certbot 0.27.0
There are other entries with other host names but they end successfully, so I am skipping them.
2020-02-03 01:05:56,631:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 “POST /acme/authz-v3/2488473085 HTTP/1.1” 200 458
2020-02-03 01:05:56,632:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Mon, 03 Feb 2020 01:05:56 GMT
Content-Type: application/json
Content-Length: 458
Connection: keep-alive
Boulder-Requester: 40745988
Cache-Control: public, max-age=0, no-cache
Link: https://acme-v02.api.letsencrypt.org/directory;rel=“index”
Replay-Nonce: 0001q9VRhfBESJRFWW_Kvhlcr9rrM30Bwr5WYO2X3x8SIAE
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
“identifier”: {
“type”: “dns”,
“value”: “fleurworld.com”
},
“status”: “valid”,
“expires”: “2020-02-25T22:29:53Z”,
“challenges”: [
{
“type”: “dns-01”,
“status”: “valid”,
“url”: “https://acme-v02.api.letsencrypt.org/acme/chall-v3/2488473085/aJTgCg”,
“token”: “eV_D8KuwWWDKHZssq7LhryW5ms6AR3h36PARZAmsb58”,
“validationRecord”: [
{
“hostname”: “fleurworld.com”
}
]
}
]
}
2020-02-03 01:05:56,632:DEBUG:acme.client:Storing nonce: 0001q9VRhfBESJRFWW_Kvhlcr9rrM30Bwr5WYO2X3x8SIAE
2020-02-03 01:05:56,633:INFO:certbot.auth_handler:Performing the following challenges:
2020-02-03 01:05:56,633:CRITICAL:certbot.auth_handler:Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.
2020-02-03 01:05:56,633:DEBUG:certbot.log:Exiting abnormally:
Traceback (most recent call last):
File “/usr/bin/certbot”, line 11, in
load_entry_point(‘certbot==0.27.0’, ‘console_scripts’, ‘certbot’)()
File “/usr/lib/python3/dist-packages/certbot/main.py”, line 1364, in main
return config.func(config, plugins)
File “/usr/lib/python3/dist-packages/certbot/main.py”, line 1254, in certonly
lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
File “/usr/lib/python3/dist-packages/certbot/main.py”, line 115, in _get_and_save_cert
renewal.renew_cert(config, domains, le_client, lineage)
File “/usr/lib/python3/dist-packages/certbot/renewal.py”, line 305, in renew_cert
new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)
File “/usr/lib/python3/dist-packages/certbot/client.py”, line 334, in obtain_certificate
orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
File “/usr/lib/python3/dist-packages/certbot/client.py”, line 370, in _get_order_and_authorizations
authzr = self.auth_handler.handle_authorizations(orderr, best_effort)
File “/usr/lib/python3/dist-packages/certbot/auth_handler.py”, line 68, in handle_authorizations
self._choose_challenges(aauthzrs)
File “/usr/lib/python3/dist-packages/certbot/auth_handler.py”, line 110, in _choose_challenges
combinations)
File “/usr/lib/python3/dist-packages/certbot/auth_handler.py”, line 409, in gen_challenge_path
return _find_smart_path(challbs, preferences, combinations)
File “/usr/lib/python3/dist-packages/certbot/auth_handler.py”, line 446, in _find_smart_path
_report_no_chall_path(challbs)
File “/usr/lib/python3/dist-packages/certbot/auth_handler.py”, line 485, in _report_no_chall_path
raise errors.AuthorizationError(msg)
certbot.errors.AuthorizationError: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.