Lets Encrypt renewal problem

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:w3resource.com

I ran this command:certbot renew --dry-run

It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/w3resource.com.conf

Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for w3resource.com
tls-sni-01 challenge for www.w3resource.com
Waiting for verification…
Cleaning up challenges
Attempting to renew cert (w3resource.com) from /etc/letsencrypt/renewal/w3resource.com.conf produced an unexpected error: Failed authorization procedure. www.w3resource.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested d8cd479ecd522dcd15a8945140ae2add.c56da03b53295f0632e5c9ef5279371f.acme.invalid from [2400:cb00:2048:1::6819:6210]:443. Received 3 certificate(s), first certificate had names “*.3ho.org, *.alluremedia.net.au, *.cappitech.com, *.digitalempire.io, *.hardrock.gl, *.ikyta.org, *.imprensafalsa.com, *.l2i.ru, *.vanityisland.it, .w3resource.com, 3ho.org, alluremedia.net.au, cappitech.com, digitalempire.io, hardrock.gl, ikyta.org, imprensafalsa.com, l2i.ru, ssl378181.cloudflaressl.com, vanityisland.it, w3resource.com", w3resource.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 6aa6cb1b2638330f3e5050cb337cad90.d9c3c2bed8a2e6617743d43c76896dd6.acme.invalid from [2400:cb00:2048:1::6819:6310]:443. Received 3 certificate(s), first certificate had names ".3ho.org, *.alluremedia.net.au, *.cappitech.com, *.digitalempire.io, *.hardrock.gl, *.ikyta.org, *.imprensafalsa.com, *.l2i.ru, *.vanityisland.it, *.w3resource.com, 3ho.org, alluremedia.net.au, cappitech.com, digitalempire.io, hardrock.gl, ikyta.org, imprensafalsa.com, l2i.ru, ssl378181.cloudflaressl.com, vanityisland.it, w3resource.com”. Skipping.
** DRY RUN: simulating ‘certbot renew’ close to cert expiry
** (The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/w3resource.com/fullchain.pem (failure)
** DRY RUN: simulating ‘certbot renew’ close to cert expiry
** (The test certificates above have not been saved.)
1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

My web server is (include version): Apache 2

The operating system my web server runs on is (include version): Ubuntu 16.04 64 bit

My hosting provider, if applicable, is: Digital Ocean

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No

My renewal file in /etc/letsencrypt/renewal/w3resource.com.conf looks like following :

renew_before_expiry = 30 days

version = 0.17.0
archive_dir = /etc/letsencrypt/archive/w3resource.com
cert = /etc/letsencrypt/live/w3resource.com/cert.pem
privkey = /etc/letsencrypt/live/w3resource.com/privkey.pem
chain = /etc/letsencrypt/live/w3resource.com/chain.pem
fullchain = /etc/letsencrypt/live/w3resource.com/fullchain.pem

Options used in the renewal process

[renewalparams]
authenticator = apache
installer = apache
account = ff1d8862d4522d39651cb9e3813dedf2

I have also configured a cron task :
00 8 * * * /usr/bin/certbot renew --quiet

My site is running on HTTPS now. I am using Cloudfare also. Any suggestion to fix the renewal issue would be appreciated.

2

The tls-sni-01 challenge doesn't work when the Let's Encrypt servers can't directly connect to your server (e.g., when behind Cloudflare).

You should use the webroot plugin as authenticator (which uses port 80 and only requires access to a simpel file on your webserver, and as such does work behind Cloudflare) to get a certificate in the first place. After that, renew will work fine.

It might be possible to "hack" the above into your [renewalparams], just change the authenticator to webroot and add the following two parameters to the same section:

webroot_path = /path/to/your/webroot
[[webroot_map]]
w3resource.com = /path/to/your/webroot
www.w3resource.com = /path/to/your/webroot/probably/the/same/as/above/but/might/be/different/although/I/dont/think/it/will/be/different/for/the/www/subdomain
1 Like
3

Thanks. It worked. Now what I need to do when I need a real renewal? My certificate is going to be expired on 8th Of December 2017.

4

Just omit the flag --dry-run :slight_smile:

5

Thanks. Shall I stop the server when I run that command and then after renewal is complete start it?

6

No, you're using the apache installer plugin, which needs a running Apache and automatically reloads your Apache webserver when the renewed certificate is installed.

You should add a (twice) daily cronjob with certbot renew if your Linux distribution didn't already install one.

1 Like
7

Okay. Thanks. I will do so may be on 7th of December.

8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.