# How to set preferred-challenge in renewal conf **URL:** \ **Category:** Help\ **Created:** [December 11, 2018, 8:31am UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787 "2018-12-11T08:31:53Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![bitinn](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bitinn/32/10021_2.png) [@bitinn](https://community.letsencrypt.org/u/bitinn)\ **Post date:** [December 11, 2018, 8:31am UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/1 "2018-12-11T08:31:54Z")
So I have a problem where my site is now behind Cloudflare and hence could not renew using `tls-sni-01` challenge, fair, I should use `http-01` instead. Problem is, I don’t know how to set it up properly in renewal config. ```auto authenticator = nginx installer = nginx ``` is my current setup, it works without Cloudflare. And I have ran both of these commands successfully when behind Cloudflare: ```auto sudo certbot renew --dry-run --webroot --webroot-path /path/to/server/root sudo certbot renew --dry-run --preferred-challenge http-01 ``` **TL;DR; Questions** - Should I use `webroot` for authenticator instead? - Can I keep `nginx` authenticator but enable `preferred-challenge` in renewal conf? (Note that I was using `preferred-challenge`, not `preferred-challenges`, don’t know if it’s a legacy flag, but it works…) (I edited the title to better reflect my question) ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [December 11, 2018, 8:38am UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/2 "2018-12-11T08:38:26Z")
If `authenticator = nginx` works, that’s great. It supports the `http-01` challenge. I think `webroot` is usually combined with `certonly`/`installer = none`, so that Certbot can run without modifying your nginx configuration. But if you’re using the nginx installer, you may as well use the authenticator as well. ---
**Author:** ![bitinn](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bitinn/32/10021_2.png) [@bitinn](https://community.letsencrypt.org/u/bitinn)\ **Post date:** [December 11, 2018, 8:41am UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/3 "2018-12-11T08:41:42Z")
> [@\_az](#): > > If `authenticator = nginx` works, that’s great. It supports the `http-01` challenge. To be clear, my problem is: - `sudo certbot renew --dry-run` doesn't work, as it default to `tls-sni-01` - `sudo certbot renew --dry-run --webroot --webroot-path /path/to/server/root` works, but it uses `webroot`, which is not what I want. - `sudo certbot renew --dry-run --preferred-challenge http-01` works, but I don't know how to set it up in renewal conf. **I don't want to modify the cron job itself, there must be a way to set a preferred challenge in conf?** ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [December 11, 2018, 8:48am UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/4 "2018-12-11T08:48:17Z")
> [@bitinn](#): > > **I don’t want to modify the cron job itself, there must be a way to set a preferred challenge in conf?** Somewhat unintuitively, the key name is `pref_challs`. I tried it out in Certbot 0.29 and it's still working in `/etc/letsencrypt/renewal/*.conf`. > > > Fixes #4105. > > I changed how we represented \`--preferred-challenges\` internally… to stop it being stored in a configuration file like: > \`\`\` > pref\_challs = \ > \`\`\` > Alternatively, I could have written some kind of export function, but I think changing the internal value is easier and less error prone. As off writing this, no third party plugin uses the value (which isn't surprising since we don't make it clear they can). > > The same value now looks like: > \`\`\` > pref\_challs = http-01, > \`\`\` ---
**Author:** ![bitinn](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bitinn/32/10021_2.png) [@bitinn](https://community.letsencrypt.org/u/bitinn)\ **Post date:** [December 11, 2018, 8:53am UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/5 "2018-12-11T08:53:19Z")
Thx, confirm that it works ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [December 11, 2018, 9:10am UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/6 "2018-12-11T09:10:40Z")
I believe if this works, it will automatically update the renewal conf files: `sudo certbot renew --preferred-challenge http-01` ---
**Author:** ![bitinn](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bitinn/32/10021_2.png) [@bitinn](https://community.letsencrypt.org/u/bitinn)\ **Post date:** [December 11, 2018, 4:41pm UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/7 "2018-12-11T16:41:01Z")
> [@rg305](#): > > I believe if this works, it will automatically update the renewal conf files: > `sudo certbot renew --preferred-challenge http-01` Here is the thing, you might be right, because after running this line my next attempt to `sudo certbot renew --dry-run` did work. BUT the renewal conf wasn't updated, I don't know what was changed, but something has been changed for sure. Even though the output still contains a line like: `tls-sni-01 challenge for mydomain.com` The dry-run passed, which is not possible because `tls-sni-01` challenge would fail when you are behind Cloudflare. So there is a possible issue here: - Somehow `--preferred-challenge http-01` did change some config in certbot, but certbot still report the `http-01` challenge incorrectly as `tls-sni-01` Either way, I decide it's for the best I just change renewal conf manually and add `pref_challs = http-01` for my own sanity. Thx all. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [December 11, 2018, 5:45pm UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/8 "2018-12-11T17:45:44Z")
An authorization can be reused for a certain amount of time -- in other words, validations are cached. (They're attached to your ACME server account, and the production environment and staging environment have separate databases.) However, Certbot doesn't know that. Even if it gets back an older, valid authorization, it goes through the motions of validating it again. Certbot will configure the challenge and its output will be normal, but Let's Encrypt won't actually try to validate it again. I think what happened is: > [@bitinn](#): > > - `sudo certbot renew --dry-run --preferred-challenge http-01` works, but I don’t know how to set it up in renewal conf. That created valid authorizations for all applicable hostnames, using HTTP-01. Then you did: > [@bitinn](#): > > `sudo certbot renew --dry-run` did work. > > BUT the renewal conf wasn’t updated, I don’t know what was changed, but something has been changed for sure. Even though the output still contains a line like: > > `tls-sni-01 challenge for mydomain.com` > > The dry-run passed, which is not possible because `tls-sni-01` challenge would fail when you are behind Cloudflare. It probably reused all of the valid authorizations from before. Certbot set up a TLS-SNI-01 challenge, but Let's Encrypt probably never actually tried to access it. You can confirm it by carefully examining the voluminous logs in `/var/log/letsencrypt/`. > [@bitinn](#): > > BUT the renewal conf wasn’t updated, "`sudo certbot renew --preferred-challenge http-01`" should update the renewal configuration files for any certificates that were renewed, but "`sudo certbot renew --dry-run --preferred-challenge http-01`" wouldn't. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [December 12, 2018, 1:11am UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/9 "2018-12-12T01:11:54Z")
That’s correct; `--dry-run` is never meant to modify your configuration, only to see whether your existing (or proposed) configuration works properly. Without `--dry-run`, Certbot can save the renewal parameters you specified into your renewal configuration file if the certificate issuance succeeds. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 11, 2019, 1:11am UTC](https://community.letsencrypt.org/t/how-to-set-preferred-challenge-in-renewal-conf/79787/10 "2019-01-11T01:11:58Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.