# Existing certs from TLS-SNI-01 to HTTP-01 manually- or automatically done
**URL:** https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964
**Category:** Help
**Created:** [February 13, 2018, 8:58am UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964 "2018-02-13T08:58:16Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@ametad](https://community.letsencrypt.org/u/ametad)
#### Post date: [February 13, 2018, 8:58am UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/1 "2018-02-13T08:58:16Z")
My question is about renewal. Since we have to move away from tls-sni-01 we want to use http-01.
In the changelog of the certbot client it says:
> [@Certbot 0.21.0 Release](https://community.letsencrypt.org/t/certbot-0-21-0-release/50725/1):
>
> Our Apache and Nginx plugins will automatically switch to use HTTP-01 so no changes need to be made to your Certbot configuration,
I thought this meant that all my existing certs would be renewed with the new default method: http-01. But it does not! In my logs (/var/logs/letsencrypt) I see that version 0.21.1 is renewing with the old method tls-sni-01 it was creating certificates in the first place.
**Do all existing certs be renewed automatically with the http-01 method?** With (perhaps a newer version of) certbot upon the renewal cronjob?
---
### Author:  [@jmorahan](https://community.letsencrypt.org/u/jmorahan)
#### Post date: [February 13, 2018, 1:36pm UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/2 "2018-02-13T13:36:07Z")
The tls-sni-01 method is still available in some special cases, one of which is renewals from the same account. Certbot 0.21 will automatically switch to http-01 in other cases. If you want to explicitly choose http-01 you can use the `-- preferred-challenges` option.
---
### Author:  [@ametad](https://community.letsencrypt.org/u/ametad)
#### Post date: [February 13, 2018, 2:02pm UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/3 "2018-02-13T14:02:34Z")
Thank you jmorahan for your reply,
If I understand correctly this `--prefered-challenge` option could be added to the cronjob line. Can this also be set in de .ini settings file?
I know the tls-sni-01 method is e.g. available for existing certs that are created with this method, for a to-be-determined period of time. And there is an whitelist of clients that can use this method for as long as they are on that list. But how about the majority of clients that will not be able to use the `sni` method in the future, will the certbot app perhaps fallback and try at least the `http-01` method?
---
### Author:  [@jmorahan](https://community.letsencrypt.org/u/jmorahan)
#### Post date: [February 13, 2018, 2:18pm UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/4 "2018-02-13T14:18:59Z")
> [@ametad](#):
>
> If I understand correctly this --prefered-challenge option could be added to the cronjob line. Can this also be set in de .ini settings file?
Yes, and I believe it can also be set in the individual renewal configuration files for each certificate.
> [@ametad](#):
>
> But how about the majority of clients that will not be able to use the sni method in the future, will the certbot app perhaps fallback and try at least the http-01 method?
Yes, from version 0.21.0 it should already be doing this.
---
### Author:  [@ametad](https://community.letsencrypt.org/u/ametad)
#### Post date: [February 13, 2018, 2:50pm UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/5 "2018-02-13T14:50:07Z")
Okay thanks, I will try the preferred method options!
And you’re right about the new version is using the http-01 method as default. For creation, not for renewal. Can you confirm this?
---
### Author:  [@jmorahan](https://community.letsencrypt.org/u/jmorahan)
#### Post date: [February 13, 2018, 2:57pm UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/6 "2018-02-13T14:57:38Z")
Yes, I believe the exception allows you to re- validate a domain that you previously validated using the same account, so that wouldn’t apply to a totally new certificate.
The CA tells the client (certbot) which challenges it’s willing to accept for each domain, and the client chooses one it can support from that list. So it falls back to http-01 when the CA doesn’t give tls-sni-01 as an option.
---
### Author:  [@ametad](https://community.letsencrypt.org/u/ametad)
#### Post date: [February 13, 2018, 3:02pm UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/7 "2018-02-13T15:02:07Z")
That last sentence of yours that is information I was searching for, thank you very much!!
Is this info somewhere written down in human (English) readable documentation? Or you know this because you know the programming code… or?
---
### Author:  [@jmorahan](https://community.letsencrypt.org/u/jmorahan)
#### Post date: [February 13, 2018, 3:03pm UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/8 "2018-02-13T15:03:56Z")
I personally know it from reading certbot’s logs 🙂 I don’t know if it’s explicitly documented anywhere other than the ACME spec though.
---
### Author:  [@ametad](https://community.letsencrypt.org/u/ametad)
#### Post date: [February 13, 2018, 3:06pm UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/9 "2018-02-13T15:06:32Z")
You helped me out 🙂 !
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [March 15, 2018, 3:06pm UTC](https://community.letsencrypt.org/t/existing-certs-from-tls-sni-01-to-http-01-manually-or-automatically-done/52964/10 "2018-03-15T15:06:46Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.