Lost my "Create a file containing just this data"

I created a cert using

sudo certbot certonly --manual --preferred-challenges dns --domains '*.mydomain.com' --agree-tos --email myemail@example.com -v

However, I closed my terminal after successfully making the DNS TXT challenge. Therefore I lost the message that had the name and the contents of the .well-know file that I need to place on my server.

Can I get that back?

Sure, just repeat the command you ran earlier. A few things to note though:

  • the options --agree-tos and --email are only used for registering the ACME account. Once that's done, you won't need those two options any more on the command line.
  • it's NOT recommended to use the --manual authenticator as it cannot be automated. We HIGHLY recommend to use a different authenticator, depending on your needs and what's possible:
    • do you really require a wildcard certificate? Because if you don't, you might not need the dns-01 challenge and thus possibly could also use a way easier method of authentication
    • if you DO need a wildcard certificate, it might be possible to use a dedicated authenticator for your DNS provider to automate the challenge
  • putting a file in the .well-known directory is NOT part of the dns-01 challenge, but for the http-01 challenge, which is NOT the command you're currently showing. So that's at odds with each other.. Confusing?
6 Likes

Hello @runbmp, welcome to the Let's Encrypt community. :slightly_smiling_face:

No, that instance of the message is gone; unless your terminal program has an undo to being closed or retains its history upon reopening then.

2 Likes

When I rerun the command, I get a successfull output, but the issue is that it doesn't spit out the well-known contents again

These files will be updated when the certificate renews.

NEXT STEPS:
- This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date.

Yes, this has to be a manual wildcard cert. I understand it only lasts 3 months.

Wait, I don't need to do the well-known file if I do the dns one?

Why would you care about the .well-known contents if it was successful already?

Correct. Unless you're mixing the dns-01 and http-01 challenge.

Note that your current certificate for *.example.com is NOT valid for just example.com.

5 Likes

Even if you "got it back", how would you "hit enter to continue" [once the file/TXT entry was readied]?

That session is dead, all you can do [should do] is redo the step(s).
And pay closer attention.
As @Osiris pointed out: DNS TXT records are not to be placed in the web servers' /.well-known/ directory.

5 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.