Failure to renew

Help
1

My domain is: sma-inc.us

I ran this command: (maybe certbot_dns_rfc2136?)
I have completely forgotten how I got this to work.

It produced this output: (see below)

My web server is (include version): firefox 154.0

$ named -V
BIND 9.20.26 (Stable Release) <id:>
running on Linux x86_64 6.12.0-160000.37-default #1 SMP PREEMPT_DYNAMIC Thu Aug  6 15:43:26 UTC 2026 (cf8ec7a) (openSUSE Leap 16.0)

The operating system my web server runs on is (include version): opensuse (linux) LEAP 16.0

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): yast

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

Your system is not supported by certbot-auto anymore.
certbot-auto and its Certbot installation will no longer receive updates.
You will not receive any bug fixes including those fixing server compatibility
or security problems.
Please visit https://certbot.eff.org/ to check for other alternatives.
/opt/eff.org/certbot/venv/bin/python2.7: error while loading shared libraries: libpython2.7.so.1.0: cannot open shared object file: No such file or directory

I have been using certbot_dns_rfc2136 for years without issue, until today. This is in the system journal:

2026-09-11T10:20:21-07:00 sma-server3.sma.com certbot.renew[828046]: Failed to renew certificate sma-inc.us with error: Some challenges have failed.
2026-09-11T10:20:21-07:00 sma-server3.sma.com certbot.renew[828046]: All renewals failed. The following certificates could not be renewed:
2026-09-11T10:20:21-07:00 sma-server3.sma.com certbot.renew[828046]:   /etc/letsencrypt/live/sma-inc.us/fullchain.pem (failure)
2026-09-11T10:20:21-07:00 sma-server3.sma.com certbot.renew[828046]: 1 renew failure(s), 0 parse failure(s)
2026-09-11T10:20:21-07:00 sma-server3.sma.com systemd[1]: snap.certbot.renew.service: Main process exited, code=exited, status=1/FAILURE
2026-09-11T10:20:21-07:00 sma-server3.sma.com systemd[1]: snap.certbot.renew.service: Failed with result 'exit-code'.
2026-09-11T10:20:21-07:00 sma-server3.sma.com systemd[1]: Failed to start Service for snap application certbot.renew.

Is there a log file somewhere that provides more details about what the actual failure is?

2

A Certbot log is in /var/log/letsencrypt directory. Should have more details than you show but that may just point to issues in the dns-rfc plugin but good place to start.

The bottom of that Certbot log is just the python trace of where the error occurred. Rarely helpful. You want to start at the top of the log and look for the first errors. Post it here if you need help.

You might be able to see more info just running: sudo certbot renew --dry-run
from a command prompt.

Looks like you are using the snap install for Certbot. Can you confirm by showing output of:
sudo certbot --version

Where did you see that error about certbot-auto. That has been gone for a very long time. Was that just something you tried to run for this report?

3

It looks like you might have multiple versions of certbot installed.

4

I finally found where certbot is.

$ /snap/bin/certbot --version
certbot 5.8.0

The log file shows this as the first of a list of errors:

{
  "identifier": {
    "type": "dns",
    "value": "sma-inc.us"
  },
  "status": "invalid",
  "expires": "2026-09-18T17:19:19Z",
  "challenges": [
    {
      "type": "dns-01",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall/6260243/777949772086/Bxk--A",
      "status": "invalid",
      "validated": "2026-09-11T17:20:19Z",
      "error": {
        "type": "urn:ietf:params:acme:error:dns",
        "detail": "DNS problem: looking up TXT for _acme-challenge.sma-inc.us: DNSSEC: DNSKEY Missing: validation failure \u003c_acme-challenge.sma-inc.us. TXT IN\u003e: No DNSKEY record [misc failure] from 172.64.52.250 for key sma-inc.us. while building chain of trust",
        "status": 400
      },
      "token": "KGpgzgRAs_g_y5KAP0NuHfS4zXqcZdZYhypGZA-Fk7c"
    }
  ]
}

The issue is a missing DNSKEY at the domain registrar's site (network solutions).
(Sigh.) Now I get to experience the joy of their tech support again. Trying to explain a DNSSEC issue when I barely understand it myself is always a challenge, and rarely resolved by the first level techs.

This demonstrates the problem:
https://dnssec-debugger.verisignlabs.com/sma-inc.us