Hi all!
My letsencrypt certificate suddenly was no longer renewed after working without issues for a very long time. I checked and got the error, that the acme-0x... servers are not reachable. I read through the forum and found that I should check traceroute:
traceroute acme-v01.api.letsencrypt.org
traceroute to acme-v01.api.letsencrypt.org (172.65.32.248), 30 hops max, 60 byte packets
1 fritz.box (192.168.10.1) 0.420 ms 0.469 ms 0.784 ms
2 62.155.246.182 (62.155.246.182) 8.232 ms 10.989 ms 11.017 ms
...
8 * * *
9 * * *
...
30 * * *
So it ends in stars.
Using my Notebook connected to the internet via my phone traces the same IP but even it sends the packet through different routers it ends up in stars.
And I found that I should try again with curl:
curl https://acme-v01.api.letsencrypt.org/directory
{
"LKblUkqa_oE": "Adding random entries to the directory",
"key-change": "https://acme-v01.api.letsencrypt.org/acme/key-change",
"meta": {
"caaIdentities": [
"letsencrypt.org"
],
"terms-of-service": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",
"website": "https://letsencrypt.org"
},
"new-authz": "https://acme-v01.api.letsencrypt.org/acme/new-authz",
"new-cert": "https://acme-v01.api.letsencrypt.org/acme/new-cert",
"new-reg": "https://acme-v01.api.letsencrypt.org/acme/new-reg",
"revoke-cert": "https://acme-v01.api.letsencrypt.org/acme/revoke-cert"
So this looks like I can address something on the other side, even I cannot traceroute it?
I have no extra firewall hardware running, ports 80 and 443 are forwarded to the server and there were no configuration changes since letsencrypt had successfully updated it's certificates last time. But I have to admit that I regularly install updates on that platform as they are provided by the OMV team.
There where some reports like mine in the forums, unfortunately they end in "I got it solved!" without proper description or they where running on a totally different platform through real firewalls and such. I just have a home-router.
My domain is: astralix.mooo.com
I ran this command: sudo certbot renew
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/omv.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Cert is due for renewal, auto-renewing... Plugins selected: Authenticator webroot, Installer None Renewing an existing certificate Performing the following challenges: http-01 challenge for astralix.mooo.com Waiting for verification... Challenge failed for domain astralix.mooo.com Cleaning up challenges Attempting to renew cert (omv) from /etc/letsencrypt/renewal/omv.conf produced an unexpected error: Challenges failed for all domains. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/omv/fullchain.pem (failure) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/omv/fullchain.pem (failure) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 renew failure(s), 0 parse failure(s)
I do have the full log, but I am not sure which parts have to be crossed out to not to expose my certificates or keys. But the only error that is repeated I copy this part:
2019-10-27 21:46:17,126:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2019-10-27 21:46:17,129:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2019-10-27 21:46:17,131:WARNING:certbot.renewal:Attempting to renew cert (omv) from /etc/letsencrypt/renewal/omv.conf produced an unexpected error: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fcefccee550>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution',)). Skipping.
2019-10-27 21:46:17,140:DEBUG:certbot.renewal:Traceback was:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 159, in _new_conn
(self._dns_host, self.port), self.timeout, **extra_kw)
File "/usr/lib/python3/dist-packages/urllib3/util/connection.py", line 57, in create_connection
for res in socket.getaddrinfo(host, port, family, socket.SOCK_STREAM):
File "/usr/lib/python3.5/socket.py", line 733, in getaddrinfo
for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
socket.gaierror: [Errno -3] Temporary failure in name resolutionDuring handling of the above exception, another exception occurred:
My web server is (include version):
nginx 1.10.3-1+deb9u3
The operating system my web server runs on is (include version):
openmediavault 4.1.26-1 (Arrakis)
based on Debian Stretch amd64
My hosting provider, if applicable, is:
n/a dynamic IP service
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
command line and openmediavault control panel
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 0.28.0