Error when renew certificate

[valmirse]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: portalwireless.tcu.gov.br

I ran this command:

certbot renew

It produced this output:

Detail: Incorrect TXT record "tlcXEeCASW3m0Wk21jFfvT4EA77YDRLlauFwBPHFXS0" found at _acme-challenge.portalwireless.tcu.gov.br

My web server is (include version): I'm, using DNS Challenge

The operating system my web server runs on is (include version):
Ubuntu 22.04.2

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.10.0

The txt record was not modified, but the command said that is wrong. How can I know who TXT record the command is expecting? Because is not showed on the command output.

[Bruce5051]

Hello @valmirse, welcome to the Let's Encrypt community.

The TXT needed for _acme-challenge.portalwireless.tcu.gov.br changes each time; it is not a constant.

@valmirse

How can I know who TXT record the command is expecting? Because is not showed on the command output.

Try sudo certbot -vv renew and then check the log file;
by default Certbot stores status logs in /var/log/letsencrypt.
See User Guide — Certbot 2.10.0 documentation for details about where the log files are.

[schoen]

Olá @valmirse,

If the token isn't shown in the output, then you probably have a hook script that is receiving it and updating it (probably set with the --manual-auth-hook option in the past). You can check what hook this might be with a command like

grep -r hook /etc/letsencrypt/renewal

and then try to confirm that that script is doing what is expected (for example, that it has access to valid DNS API credentials for your domain).