# None of the preferred challenges are supported by the selected plugin **URL:** \ **Category:** Help\ **Created:** [March 1, 2021, 6:40am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392 "2021-03-01T06:40:36Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 1, 2021, 6:40am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/1 "2021-03-01T06:40:37Z")
Dear Team, We have setup the auto renewal using letsencrypt. It was working fine when we test. It is a DNS Challange It is now failed after two months when we execute below command. Command: certbot renew --force-renewal Error: unexpected error: None of the preferred challenges are supported by the selected plugin. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/work.xxxxx.com/fullchain.pem (failure) * * * All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/work.xxxxxx.com/fullchain.pem (failure) * * * 1 renew failure(s), 0 parse failure(s) Kindly advise how to fix this issue Thanks ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [March 1, 2021, 7:00am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/2 "2021-03-01T07:00:50Z")
Hi @kumar.argentra > [@kumar.argentra](#): > > Command: certbot renew --force-renewal your **complete setup** is required, not only some parts. * * * Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: I ran this command: It produced this output: My web server is (include version): The operating system my web server runs on is (include version): My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): I'm using a control panel to manage my site (no, or provide the name and version of the control panel): The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): ---
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 1, 2021, 7:12am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/3 "2021-03-01T07:12:32Z")
Dear JuergenAuer Here is required details. I ran this command:certbot renew --force-renewal It produced this output: unexpected error: None of the preferred challenges are supported by the selected plugin. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/work.xxxxx.com/fullchain.pem (failure) All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/work.xxxxxx.com/fullchain.pem (failure) 1 renew failure(s), 0 parse failure(s) My web server is (include version):apache server The operating system my web server runs on is (include version):"CentOS Linux 7 My hosting provider, if applicable, is:hostrocket I can login to a root shell on my machine (yes or no, or I don't know):yes The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):certbot 1.9.0 Thanks ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [March 1, 2021, 1:48pm UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/4 "2021-03-01T13:48:03Z")
Can we have a look at?: `/etc/letsencrypt/renewal/work.xxxxx.com.conf` And using "`--force`" is hardly ever the answer to any conflict. ---
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 2, 2021, 6:42am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/5 "2021-03-02T06:42:01Z")
Dear rg305 Thanks for the response. If the certificate is already expired, shall we call "certbot renew" command? In my case, cert has been expired , when renewing the certificate by calling "certbot renew" command Kindly advise us , how to call cert renew command for expired certs Thanks ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 2, 2021, 6:51am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/6 "2021-03-02T06:51:49Z")
Hi @kumar.argentra, The `--force-renewal` option means that Certbot should try to renew even if the certificate has more than 30 days of validity left. If the certificate has fewer than 30 days of validity, including if it's already expired, `--force-renewal` has no effect because the renewal attempt will happen anyway. The only purpose and effect of `--force-renewal` is that it can make Certbot renew certificates in circumstances that it considers to be premature. I agree that it would be useful to see the contents of the renewal configuration file from `/etc/letsencrypt/renewal` in order to figure out which Certbot plugin is being used. You can learn more about the details of the underlying issues that can result in this error from > **[Challenge Types - Let's Encrypt - Free SSL/TLS Certificates](https://letsencrypt.org/docs/challenge-types/)** > > Last updated: Dec 8, 2020 | See all Documentation When you get a certificate from Let’s Encrypt, our servers validate that you control the domain names in that certificate using “challenges,” as defined by the ACME standard. Most of the time, this... and > **[User Guide — Certbot 1.11.0.dev0 documentation](https://certbot.eff.org/docs/using.html#getting-certificates-and-choosing-plugins)** > > Automatically enable HTTPS on your website with EFF's Certbot, deploying Let's Encrypt certificates. ---
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 3, 2021, 1:23am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/7 "2021-03-03T01:23:59Z")
Dear schoen, Thanks for your response. Below are configuration from etc/letsencrypt/renewal # renew\_before\_expiry = 30 days version = 1.10.1 archive\_dir = /etc/letsencrypt/archive/xxxx.com cert = /etc/letsencrypt/live/xxxxx/cert.pem privkey = /etc/letsencrypt/live/xxxx/privkey.pem chain = /etc/letsencrypt/live/xxxxx/chain.pem fullchain = /etc/letsencrypt/live/xxxxx/fullchain.pem # Options used in the renewal process [renewalparams] authenticator = standalone account = ccaca391a26d218f4f3250bbe05d79a1 pref\_challs = dns-01, manual\_public\_ip\_logging\_ok = None server = [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory) Please help us to solve the issue Thanks ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 3, 2021, 1:47am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/8 "2021-03-03T01:47:07Z")
> [@kumar.argentra](#): > > authenticator = standalone > account = ccaca391a26d218f4f3250bbe05d79a1 > pref\_challs = dns-01, This combination of `authenticator = standalone` and `pref_challs = dns-01` is indeed inconsistent. Do you have any recollection of how it got that way? Do you know how you, or someone else, selected either or both of those options? (The standalone authenticator and/or the DNS challenge type) ---
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 3, 2021, 1:57am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/9 "2021-03-03T01:57:10Z")
Dear schoen We have setup auto ssl by following below commands 1. sudo certbot certonly --manual --preferred-challenges dns -d xxxxxx 2. sudo certbot certonly --standalone --preferred-challenges dns -d xxxxx the renew command was fine, when we run after setup was completed(certbot renew --force-renewal) But renew is now failed with the error ( [None of the preferred challenges are supported by the selected plugin]) Thanks ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 3, 2021, 3:04am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/10 "2021-03-03T03:04:46Z")
Hi @kumar.argentra, Thanks for the explanation. It seems to me that you've found a subtle bug in Certbot, which I can understand as a former Certbot developer but which is not at all obvious from a user's perspective. `sudo certbot certonly --manual --preferred-challenges dns -d xxxxxx` This command succeeds because you manually completed the steps that Certbot instructed you to perform (by creating DNS TXT records). `sudo certbot certonly --standalone --preferred-challenges dns -d xxxxx` This command would normally _not_ succeed, because `--standalone` is incompatible with `--preferred-challenges dns`. However, Certbot failed to detect this condition, probably because of something called a cached authorization (where the certificate authority is willing to give out a duplicate certificate _within a short period of time after the original certificate_ without repeating the validation). Therefore, Certbot succeeded in getting this certificate, too, even though the command-line options you used would normally be inconsistent and unsuccessful (under other circumstances). Unfortunately, since this request succeeded due to the cached authorizations, I expect that Certbot concluded that the `--standalone` and `--preferred-challenges dns` options "worked" (since the certificate was successfully issued) and therefore saved them into the file in `/etc/letsencrypt/renewal` to be used in the future. But once the cached authorization expired on the certificate authority side, the renewal could no longer succeed. Nonetheless, the `/etc/letsencrypt/renewal` file had an unhelpful set of non-working defaults saved because they _appeared_ to have worked before. My short-term recommendations would be: (1) If you just need to perform the renewal right away, repeat this command `sudo certbot certonly --manual --preferred-challenges dns -d xxxxxx` Note that it will require you to create new DNS TXT records. This is always the case after cached authorizations expire, which is why this form of the `certbot` command doesn't work for setting up automated, unattended renewals. However, it will still work manually. (2) Decide whether `--preferred-challenges dns` is really what you want. Normally this is only useful if you're requesting a wildcard certificate, or running Certbot on a machine that can't receive incoming connections from the public Internet, or running Certbot on a machine that isn't authoritative for one or more of the names on the certificate, at least as seen by the public Internet. (3) If you need `--preferred-challenges dns`, you'll need an `--auth-hook` shell script or a DNS API plugin for Certbot in order to get automated renewals. The TXT records that must be posted for domain ownership confirmation are different for every renewal, so it must be possible to create them purely from software. (4) If you don't need `--preferred-challenges dns`, you can switch to a different authentication method, including `--standalone`, `--webroot`, or whichever method is most suitable for your environment. In that case, you can delete the preferred challenges line from the file in `/etc/letsencrypt/renewal`. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 3, 2021, 3:06am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/11 "2021-03-03T03:06:09Z")
@_az, do you think my diagnosis is plausible, and do you happen to know if this is a known bug? I'm a little unsure conceptually about what the right Certbot behavior would be in this case (since people might sometimes _intentionally_ force an early renewal using cached authorizations, with the goal of changing the renewal configuration file). ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 3, 2021, 3:09am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/12 "2021-03-03T03:09:22Z")
> [@schoen](#): > > `--standalone` is incompatible with `--preferred-challenges dns` @kumar.argentra if you don't understand why this is so, the pair of documentation links that I posted above (beginning "You can learn more about the details of the underlying issues") will explain it. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [March 3, 2021, 5:31am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/13 "2021-03-03T05:31:58Z")
> [@schoen](#): > > do you think my diagnosis is plausible, and do you happen to know if this is a known bug Yes, I recall something similar with a user believing `--standalone` would succeed while their webserver was still running, due to the same behavior. Fixing [#5342](https://github.com/certbot/certbot/issues/5342) may have exacerbated this problem. At least before, Certbot's (pointless) effort to fulfill the challenge served as a basic sanity check of the authenticator setup. > [@schoen](#): > > I'm a little unsure conceptually about what the right Certbot behavior would be in this case (since people might sometimes _intentionally_ force an early renewal using cached authorizations, with the goal of changing the renewal configuration file). It's hard to know what to do about this, but to me it seems to largely fall into a broader "provide an better way to modify existing lineages" project. Having to re-issue the certificate (or modify what is an internal file) is too much. Perhaps this would lead to something like "you are changing the authenticator, do you want to test this change with a dry-run first?". (Dry-runs force fresh authorizations). That said, > [@kumar.argentra](#): > > - sudo certbot certonly --manual --preferred-challenges dns -d xxxxxx > - sudo certbot certonly --standalone --preferred-challenges dns -d xxxxx I would love to understand why @kumar.argentra landed on this pair of commands. Why two different certificates? What do the `xxxxx` represent? Could you restate this by using `example.com` instead of totally obscuring the domain? ---
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 3, 2021, 5:50am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/14 "2021-03-03T05:50:17Z")
Dear schoen and \_az Thanks for your responses. It is more valuable to me to understand the concept of letsencrypt Thanks ---
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 5, 2021, 7:44am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/15 "2021-03-05T07:44:32Z")
Dear \_az We have setup auto ssl by following below commands 1. sudo certbot certonly --manual --preferred-challenges dns -d [work.argentra.com](http://work.argentra.com) 2. sudo certbot certonly --standalone --preferred-challenges dns -d [work.argentra.com](http://work.argentra.com) the renew command was fine, when we run after setup was completed(certbot renew --force-renewal) But renew is now failed with the error ( [None of the preferred challenges are supported by the selected plugin]) Thanks ---
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 5, 2021, 8:09am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/16 "2021-03-05T08:09:37Z")
Dear \_az, Please take a note that our [work.argentra.com](http://work.argentra.com) is internal and commands are being called in private virtual machine and [work.argentra.com](http://work.argentra.com) online is just dummy site which is available from internet for dns challenges . Kindly advise, how we can automate Thanks ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [March 5, 2021, 11:50am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/17 "2021-03-05T11:50:18Z")
When speaking directly with other community members you need to use the @ symbol in front of the name. Like: @_az @kumar.argentra Not just the name: \_az kumar.argentra ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [March 5, 2021, 12:10pm UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/18 "2021-03-05T12:10:56Z")
The best way to test renewal is with ``` certbot renew --dry-run ``` This will be a more accurate test than `--force-renewal`, as it's not subject to cached authorizations. > [@kumar.argentra](#): > > - sudo certbot certonly --manual --preferred-challenges dns -d [work.argentra.com](http://work.argentra.com) > - sudo certbot certonly --standalone --preferred-challenges dns -d [work.argentra.com](http://work.argentra.com) I see. Are you running these commands on different servers? One on the internal server, one on the dummy site? > [@kumar.argentra](#): > > Kindly advise, how we can automate Yes, I think this is the right question to ask. For DNS challenges, the idea is usually to find an ACME client that supports your DNS host. I'm not familiar with `hrnoc.net`, are those your own self-hosted nameservers? Can you use `nsupdate`/RFC2136 to automatically create TXT records on it? You might also be able to automate HTTP challenge instead, if you can copy files to the dummy site under `/.well-known/acme-challenge/`. For example, by using a script from the internal server to connect to the dummy site. ---
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 8, 2021, 1:06am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/19 "2021-03-08T01:06:06Z")
@_az Thanks for response. For manual http challange, we have to call below command and followed the instructions such as uploading http challange file to complete the process sudo certbot certonly --manual --preferred-challenges http -d [work.argentra.com](http://work.argentra.com) For Auto HTTP Challenge, where do we need to call the script to copy file under /.well-known/acme-challenge/. Kindly advise Thanks ---
**Author:** ![kumar.argentra](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kumar.argentra](https://community.letsencrypt.org/u/kumar.argentra)\ **Post date:** [March 8, 2021, 1:09am UTC](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392/20 "2021-03-08T01:09:05Z")
@_az , Please find my answer below for your question Question: I see. Are you running these commands on different servers? One on the internal server, one on the dummy site? Answer: We are running on different internal server. not on the dummy site or server Thanks [Next page](https://community.letsencrypt.org/t/none-of-the-preferred-challenges-are-supported-by-the-selected-plugin/146392.md?page=2)