Let's Encrypt Failing to Renew

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: wellness.blenderbottle.com

I ran this command: In rancher v1.6.14, we have the service running ‘janeczku/rancher-letsencrypt:v0.5.0’ in it’s own container.

It produced this output: level=fatal msg=“Error saving certificate ‘lets-encrypt-final-certs’: Failed to read certificate expiry date: Pem decode did not yield a valid block. Is the certificate in the right format?”

My web server is (include version): rancher v1.6.14

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know): Yes, but the container continually restarts and tries to renew the certificates, errors out with the error message above, and restarts.

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): Rancher v1.6.14 with ‘janeczku/rancher-letsencrypt:v0.5.0’

1 Like
2

Let’s Encrypt has been running fine for the last year, but we’ve ran into this issue this past month. I was able to get inside the container for a moment, and I can see the following files within the LetsEncrypt folder: privkey.pem, fullchain.pem, and metadata.json. I can’t seem to find much documentation regarding this error message, but from what I’ve been able to find thus far the only person who found a solution was to change the domain name which is something that I would like to avoid if possible.

3

I think this project is dead. It only supports the ACME v1 API, which is EOL: End of Life Plan for ACMEv1

Registrations for the v1 API were disabled in November, which approximately lines up with your timeline. It is probably related.

There are some relevant discussions on the issue tracker:

3 Likes
4

I was able to resolve this issue last night. It appears one of the domains listed under our main domain was no longer valid, and was causing all of the others to fail when it tried to renew. Removing the domain from the list resolved the issue.

1 Like
5

Keep mind that acme v1 will turn off 2020 for new domain so you will need to update it anyway

2 Likes
6

We recently upgraded to Rancher 2 and are migrating over to that. We just needed some additional time to finish that transition. The 3 months from this renewal should be enough for us to finish that. I appreciate everyone’s help and input on this issue.

2 Likes
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.