I ran this command:
/home/ubuntu/letsencrypt/letsencrypt-auto certonly --dry-run --manual
–manual-public-ip-logging-ok
–manual-auth-hook /home/ubuntu/.bin/authenticator.sh
–manual-cleanup-hook /home/ubuntu/.bin/cleanup.sh
–agree-tos
–domain australianassetaggregation.com.au
–rsa-key-size 2048
It produced this output:
The dry run was successful
My web server is (include version): apache
The operating system my web server runs on is (include version): ubuntu 16
My hosting provider, if applicable, is: AWS ubuntu
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): 0.36.0
After several tries on one domain, --dry-run stopped doing anything without any error? Switching to new domain thing will be back to normal but it stops again after few runs?
Wondering if --dry-run flag has hidden limit as I checked the rate-limit which says staging env provides a very generous limit for testing.
Hmm, I doubt that I have hit the limit as I’ve run only a few times. Would you mind giving me instruction on how to I check my limit on a particular domain under staging env?
The Certificates per Registered Domain limit is 30,000 per week.
The Duplicate Certificate limit is 30,000 per week.
The Failed Validations limit is 60 per hour.
The Accounts per IP Address limit is 50 accounts per 3 hour period per IP.
For ACME v2, the New Orders limit is 1,500 new orders per 3 hour period per account.
Were you able to figure out your problem? I see in the staging environment logs that there was successful certificate issuance for this domain in the past 3d.
It looked like previous to the successful attempts there were some HTTP-01 challenge failure errors related to your server returning an HTML document instead of the expected HTTP-01 challenge response.
Hmm, I couldn’t run --dry-run so I tried prod anyway and it worked. But it’s scary that I couldn’t test it properly before hand. Don’t know if my command is somehow wrong as right after one success of --dry-run, I can’t rerun the same command again. It keeps showing dry-run was successful although I expect my authenticator.sh script to be triggered.
Your hook won’t be triggered if your ACME account already has a valid authorization for the name. (Valid authorizations are currently cached for 30 days.)
This is a somewhat recent change in Certbot – it used to execute the hook even when there was no need to.
(The Let’s Encrypt production and staging environments have separate accounts and separate challenges and authorizations.)