# Renew Let´s Encrypt Certificate (AWS Lightsail + Route 53) **URL:** \ **Category:** Help\ **Created:** [November 19, 2019, 1:00pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729 "2019-11-19T13:00:53Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![dmkwke](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dmkwke/32/35401_2.png) [@dmkwke](https://community.letsencrypt.org/u/dmkwke)\ **Post date:** [November 19, 2019, 1:00pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/1 "2019-11-19T13:00:53Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: dmkwke.at **I ran this command:** ~ DOMAIN=dmkwke.at ~ WILDCARD=\*.DOMAIN ~ echo $DOMAIN && echo WILDCARD dmkwke.at \*.dmkwke.at ~ sudo certbot -d $DOMAIN -d $WILDCARD --manual --preferred-chal lenges dns certonly Are you OK with your IP being logged? (Y)es/(N)o: y I deployed the DNS TXT records. **It produced this output:** Press Enter to Continue Waiting for verification… Resetting dropped connection: [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org) Cleaning up challenges Failed authorization procedure. dmkwke.at (dns-01): urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up TXT for \_acme-challenge.dmkwke.at, dmkwke.at (dns-01): urn:ie tf:params:acme:error:dns :: DNS problem: SERVFAIL looking up TXT for \_acme-challenge.dmkwk e.at IMPORTANT NOTES: - The following errors were reported by the server: My web server is (include version): AWS Lightsail + Route 53 The operating system my web server runs on is (include version): Apache/Ubuntu My hosting provider, if applicable, is: AWS Lightsail I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): yes The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [November 19, 2019, 3:26pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/2 "2019-11-19T15:26:53Z")
Hi @dmkwke > [@dmkwke](#): > > Domain: dmkwke.at > Type: None > Detail: DNS problem: SERVFAIL looking up TXT for > \_acme-challenge.dmkwke.at checking your domain you use DNSSEC - and your DNSSEC is broken - [https://check-your-website.server-daten.de/?q=dmkwke.at#dnssec](https://check-your-website.server-daten.de/?q=dmkwke.at#dnssec) ![at](https://global.discourse-cdn.com/letsencrypt/original/3X/a/5/a5b43b3bef9cd5456a16affced4b0d8db197ec4b.png) There are 3 DS RR in the parent zone, so your parent zone says: Your zone must be signed. But your zone isn't signed, there is no DNSKEY RR -\> no chain of trust is created. Looks like you have changed your dns provider. Old - with DNSSEC, new - without DNSSEC. So you have two options: - remove the DS RR in your parent zone (your dns provider must do that) (or, better) - add a correct DNSKEY and change your DS in your parent zone so your zone is signed. PS: Rechecked with [DNSSEC Analyzer - dmkwke.at](https://dnssec-analyzer.verisignlabs.com/dmkwke.at) to see if my tool is correct - same result - DS in the parent zone, no DNSKEY in your zone ---
**Author:** ![dmkwke](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dmkwke/32/35401_2.png) [@dmkwke](https://community.letsencrypt.org/u/dmkwke)\ **Post date:** [November 19, 2019, 7:36pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/3 "2019-11-19T19:36:50Z")
Hi @JuergenAuer thanks for your feedback! Where can I find the correct DNSKEY and how can I change DS in my parent zone? ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [November 20, 2019, 2:29pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/4 "2019-11-20T14:29:34Z")
> [@dmkwke](#): > > how can I change DS in my parent zone? For most TLDs, `DS` records are managed via your domain registrar. Their control panel should have an area for it. > [@dmkwke](#): > > Where can I find the correct DNSKEY There is none. Amazon Route 53's DNS service does not support DNSSEC. You have to delete the `DS` records, or switch to another DNS service. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [November 20, 2019, 2:30pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/5 "2019-11-20T14:30:51Z")
> [@dmkwke](#): > > Where can I find the correct DNSKEY and how can I change DS in my parent zone? You use ```nohighlight dmkwke.at • ns-1388.awsdns-45.org ``` Is there a one-click solution? If yes, use that. If no, it's bad. DNSSEC configurations are normally one-click solutions. Activate -\> the DNSKEY and the DS is created and deployed. Deactivate -\> DNSKEY is removed, same with the DS in the parent zone. So normally a customer doesn't create these records manual. --\>\> Ask Amazon. PS: > [@mnordhoff](#): > > Amazon Route 53’s DNS service does not support DNSSEC. You have to delete the `DS` records, or switch to another DNS service. Ah, thanks. So @dmkwke - perhaps switch back to your previous domain registrar, then delete the DNSSEC (should remove the DS), then switch back to AWS. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [November 20, 2019, 2:41pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/6 "2019-11-20T14:41:38Z")
Changing the subject somewhat, why do you want to use manual DNS validation, and why do you want to create a wildcard certificate? If you’re following Amazon’s tutorial, it gives bad advice. Let’s Encrypt is intended to be used – where possible – with automated validation, so that it’s easier for you to work with, and so that renewal can be fully automated. And in most circumstances, wildcard certificates aren’t necessary. Do you absolutely need to use wildcards? If not, it should be easy to follow a better tutorial and use HTTP validation and get one or more certificates for the names you need. If so, you should use a DNS service with an appropriate API and an ACME client that can work with it. (The regular AWS version of Route 53 would work, but I don’t know if the Lightsail version of Route 53 includes API access.) ---
**Author:** ![dmkwke](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dmkwke/32/35401_2.png) [@dmkwke](https://community.letsencrypt.org/u/dmkwke)\ **Post date:** [November 20, 2019, 3:35pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/7 "2019-11-20T15:35:50Z")
> [@mnordhoff](#): > > For most TLDs, `DS` records are managed via your domain registrar. Their control panel should have an area for it. Alright, thanks I know. I am using the DNS Zone from AWS Lightsail. > [@mnordhoff](#): > > There is none. Amazon Route 53’s DNS service does not support DNSSEC. You have to delete the `DS` records, or switch to another DNS service. Okay, I see - I gonna switch back to World4You with DNSSEC. Thanks for you feedback! ---
**Author:** ![dmkwke](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dmkwke/32/35401_2.png) [@dmkwke](https://community.letsencrypt.org/u/dmkwke)\ **Post date:** [November 20, 2019, 3:43pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/8 "2019-11-20T15:43:05Z")
> [@JuergenAuer](#): > > Is there a one-click solution? If yes, use that. > > If no, it’s bad. > > DNSSEC configurations are normally one-click solutions. Activate -\> the DNSKEY and the DS is created and deployed. Deactivate -\> DNSKEY is removed, same with the DS in the parent zone. > > So normally a customer doesn’t create these records manual. > > –\>\> Ask Amazon. I gonna switch back to my previous DNS Zone with DNSSEC. ---
**Author:** ![dmkwke](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dmkwke/32/35401_2.png) [@dmkwke](https://community.letsencrypt.org/u/dmkwke)\ **Post date:** [November 20, 2019, 3:50pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/9 "2019-11-20T15:50:09Z")
> [@mnordhoff](#): > > Changing the subject somewhat, why do you want to use manual DNS validation, and why do you want to create a wildcard certificate? I am a newbie and I followed the instruction of the documentation from AWS --\> [https://lightsail.aws.amazon.com/ls/docs/en\_us/articles/amazon-lightsail-using-lets-encrypt-certificates-with-wordpress](https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-using-lets-encrypt-certificates-with-wordpress) I found a documentation from Let´s Encrypt. Do you think that´s a better way how to set up the certificate? - [https://docs.bitnami.com/oci/how-to/generate-install-lets-encrypt-ssl/](https://docs.bitnami.com/oci/how-to/generate-install-lets-encrypt-ssl/) - [https://docs.bitnami.com/oci/how-to/understand-bncert/](https://docs.bitnami.com/oci/how-to/understand-bncert/) > [@mnordhoff](#): > > Do you absolutely need to use wildcards? No. Thanks for your help. Highly appreciated! ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [December 20, 2019, 3:50pm UTC](https://community.letsencrypt.org/t/renew-let-s-encrypt-certificate-aws-lightsail-route-53/106729/10 "2019-12-20T15:50:11Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.