Failed to renew certificate

Brankili · April 29, 2024, 10:55am

I ran this command:
sudo certbot renew

It produced this output:
Failed to renew certificate with error: 'utf-8' codec can't decode byte 0x8c in position 30: invalid start byte

Ubuntu 22.04.3 LTS
Codename:|jammy|

Osiris · April 29, 2024, 11:16am

Could you please post the entire output, preferably the entire log?

Also, please don't remove any question from the questionnaire. Here is the rest again:

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

It produced this output:

My web server is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

Brankili · April 29, 2024, 11:46am

sudo certbot renew

Renewing an existing certificate for *.m10.onedbdev.com

Encountered exception during recovery: KeyError: KeyAuthorizationAnnotatedChallenge(challb=ChallengeBody(chall=DNS01(token=b'\x17v\xbb\xd2+\xf2\xfcB9*Q\x02:\x14/\xaal[\xc2\x18\xe0\xfb\xe0\x1f%\xa6\x19\xfd\x01,\x87\xbf'), uri='https://acme-v02.api.letsencrypt.org/acme/chall-v3/343812026667/nNr_CQ', status=Status(pending), validated=None, error=None), domain='m10.onedbdev.com', account_key=(key=<ComparableRSAKey(<cryptography.hazmat.backends.openssl.rsa._RSAPrivateKey object at 0x7fba9771b310>)>))

Failed to renew certificate m10.onedbdev.com with error: 'utf-8' codec can't decode byte 0x8c in position 30: invalid start byte

/etc/letsencrypt/live/m10.onedbdev.com/fullchain.pem (failure)

nginx version: nginx/1.18.0 (Ubuntu)
I can login to a root shell on my machine
The version of my client is certbot 2.7.4

rg305 · April 29, 2024, 4:27pm

What shows?:
ls -l /etc/letsencrypt/live/m10.onedbdev.com/fullchain.pem
cat /etc/letsencrypt/live/m10.onedbdev.com/fullchain.pem

Brankili · April 29, 2024, 7:58pm

ls -l /etc/letsencrypt/live/m10.onedbdev.com/fullchain.pem

lrwxrwxrwx 1 root root 45 Jan 22 08:11 /etc/letsencrypt/live/m10.onedbdev.com/fullchain.pem -> ../../archive/m10.onedbdev.com/fullchain2.pem
cat /etc/letsencrypt/live/m10.onedbdev.com/fullchain.pem
i see begin end cert three times

Bruce5051 · April 29, 2024, 8:02pm

@Brankili FYI - the fullchain.pem only contains public information, nothing secret private or needing securing.

Brankili · April 29, 2024, 8:11pm

cat /etc/letsencrypt/live/m10.onedbdev.com/fullchain.pem

Bruce5051 · April 29, 2024, 8:31pm

Using the online tool https://unboundtest.com/
Here is what I see https://unboundtest.com/m/TXT/_acme-challenge.m10.onedbdev.com/RKCNTKXY

_acme-challenge.m10.onedbdev.com. 0 IN TXT "clean"

Query results for TXT _acme-challenge.m10.onedbdev.com

Response:
;; opcode: QUERY, status: NOERROR, id: 28253
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version 0; flags: do; udp: 512

;; QUESTION SECTION:
;_acme-challenge.m10.onedbdev.com.	IN	 TXT

;; ANSWER SECTION:
_acme-challenge.m10.onedbdev.com.	0	IN	TXT	"clean"

----- Unbound logs -----
Apr 29 20:29:51 unbound1.19[1918747:0] debug: creating udp6 socket ::1 1053
Apr 29 20:29:51 unbound1.19[1918747:0] debug: creating tcp6 socket ::1 1053
Apr 29 20:29:51 unbound1.19[1918747:0] debug: creating udp4 socket 127.0.0.1 1053
Apr 29 20:29:51 unbound1.19[1918747:0] debug: creating tcp4 socket 127.0.0.1 1053

Brankili · April 29, 2024, 9:28pm

Do you have some solution for my problem?

Bruce5051 · April 29, 2024, 9:31pm

I was really just suppling supplemental information to assist others and you in debugging.

Also @Brankili I believe you accidently check the solution box on my post; you should be able un-check it too.

Bruce5051 · April 29, 2024, 9:35pm

What DNS Plugin are you using?

And here is a list DNS providers who easily integrate with Let's Encrypt DNS validation

rg305 · April 29, 2024, 11:44pm

The third cert [in that file] is unexpected: