Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: paulo-sc.com
I ran this command: certbot renew
It produced this output:
certbot renew --cert-name octoworld.fr
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/octoworld.fr.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Renewing an existing certificate for octoworld.fr and 5 more
Waiting 60 seconds for DNS changes to propagate
Certbot failed to authenticate some domains (authenticator: dns-rfc2136). The Certificate Authority reported these problems:
Identifier: paulo-sc.com
Type: dns
Detail: During secondary validation: DNS problem: SERVFAIL looking up TXT for _acme-challenge.paulo-sc.com - the domain's nameservers may be malfunctioning
Identifier: paulo-sc.com
Type: dns
Detail: During secondary validation: DNS problem: SERVFAIL looking up TXT for _acme-challenge.paulo-sc.com - the domain's nameservers may be malfunctioning
Hint: The Certificate Authority failed to verify the DNS TXT records created by --dns-rfc2136. Ensure the above domains are hosted by this DNS provider, or try increasing --dns-rfc2136-propagation-seconds (currently 60 seconds).
Failed to renew certificate octoworld.fr with error: Some challenges have failed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/octoworld.fr/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version): nginx 1.24.0
The operating system my web server runs on is (include version): Ubuntu Server 24.04
My hosting provider, if applicable, is: MilkyWAN
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 5.4.0
Hello all,
I've got a problem with my cert renewal. My setup is the following:
- 3 PowerDNS servers
- Datacenter or fibre optic access with IPv6 and IPv4 connectivity
- MariaDB zone replication
- Functional TSIG key
- Functional DNSSEC on all zones
- Functional GLUE records
- Renewal with Certbot using systemd timers
This architecture, bar some minor changes and updates, has been working flawlessly for more than 8 years. All of a sudden, renewal for this zone won't succeed. I noticed that oddly enough, it only happens with .com domains:
- .fr-only cert: OK
- .fr containing .com names as auxiliary objects: NOK
- .com-only cert: NOK
Because my hardware proved to be reliable enough, I've kept for a long time a propagation time of 15s. I increased it to 1 then 5 minutes, which made no difference. The credential file is known to be good and TXT records are indeed published during a renewal attempt:
paul@nevera:~$ dig TXT _acme-challenge.paulo-sc.com @ns1-auth.octoworld.fr +short
"SqMKdUR6wl5nWEgzECU-z90dsEmOrHasEkJ0Ey0lumA"
"vIk4fBiNSsgEhLMw0--PUiMspd37CdFfaRbB0laYbkA"
paul@nevera:~$ dig TXT _acme-challenge.paulo-sc.com @ns2-auth.octoworld.fr +short
"SqMKdUR6wl5nWEgzECU-z90dsEmOrHasEkJ0Ey0lumA"
"vIk4fBiNSsgEhLMw0--PUiMspd37CdFfaRbB0laYbkA"
paul@nevera:~$ dig TXT _acme-challenge.paulo-sc.com @ns3-auth.octoworld.fr +short
"SqMKdUR6wl5nWEgzECU-z90dsEmOrHasEkJ0Ey0lumA"
"vIk4fBiNSsgEhLMw0--PUiMspd37CdFfaRbB0laYbkA"
On a Debian 13 machine with only a .fr cert, which also produced errors, I traced it back to an old version of Certbot (2.9.0), which was kept back by apt for some reason. I updated it to version 4. It solved the problem and seeing that led me to believe that the cause was the same on this server, combined with finding out that Certbot was even older (2.8.0). I removed it and installed the snap version, only to find out that it wasn't responsable for the failures either.
So, why would .com domains only fail and where could Let's Encrypt could play a role in this?
Thank you by advance
