Renewal failing for 3 configs out of 4 on a single host

[hardly_ted]

My domain is: werranfehtan.org (working) and tedhardy.com (not renewing)

I ran this command: sudo certbot renew --dry-run

It produced this output: Challenge failed for domain tedhardy.com
http-01 challenge for tedhardy.com
Cleaning up challenges
Failed to renew certificate tedhardy.com with error: Some challenges have failed.

My web server is (include version): nginx

The operating system my web server runs on is (include version): Ubuntu 20.04

My hosting provider, if applicable, is: digital ocean

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.13.0

I've got three domains (plus one subdomain) on this host. The first one I set up, werranfehtan.org, is renewing perfectly. The other two domains and the subdomain (of one of the non-working domains), is not renewing. I've looked at the configs and they are different, but I do not know why. The one that is working is using authenticator = nginx and the ones that are not are using authenticator = webroot. The config versions are 1.12.0 and 1.10.1, respectively. I tried modifying the non-working one to be identical to the working one, and still got the failure.

Any suggestions you all have would be greatly appreciated. Thank you!

[JuergenAuer]

Hi @hardly_ted

@hardly_ted

It produced this output: Challenge failed for domain tedhardy.com
http-01 challenge for tedhardy.com

you use DNSSEC, but your DNSSEC is broken, see https://check-your-website.server-daten.de/?q=tedhardy.com

Fatal error: Parent zone has a signed DS RR (Algorithm 13, KeyTag 2371, DigestType 2, Digest I1XnprS9bOQtzcyL7x/D1zQG+vxiFtmvWbzjiKHbk8A=), but the destination DNSKEY doesn't exist or doesn't validate the DNSKEY RR set. No chain of trust created.

May be disable and re-enable DNSSEC or refresh / recalculate your zone.

PS: Your ip configuration looks buggy too - non-www has ipv4 and ipv6, www has only ipv4, http + ipv6 has a timeout, http + ipv4 works, that's a second problem.

[hardly_ted]

Thank you @JuergenAuer! I have a feeling that when I migrated to a new server back in December, I didn't set up DNSSEC at that point. Frankly, I don't remember having ever set this up on the old one, but looks like I did. Thank you for the point in the right direction. Greatly appreciated; I think I can take it from here.