I had a working setup until about a week ago. Something changed but I’m unable to point to it: $ sudo certbot renew --dry-run Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renew…

new certificate deployed with reload of nginx server; :grinning: The issue was that ipv6only=on can be set only once and that we were doing on bubblin's configuration already. It cannot be applied again on a single installation of nginx, even for another domain. Here's what bookiza's nginx.conf o…

[image] Osiris: tls-sni-01 I remember running sudo certbot --nginx --preferred-challenges http a few weeks ago to not use tls-sni-01, but it appears that older installations are still lying around. This server is mainly to host https://bubblin.io (a rails application handling www, root and o…

The redirections are messed up: http://www.bookiza.io/.well-known/acme-challenge/test redirects to: https://www.bookiza.io/.well-known/acme-challenge/test/.well-known/acme-challenge/test

How to fix it? I wonder why would redirections be messed up at all, I used the certbot through and through since the very beginning.

please show the vhost config for bookiza.io or wherever the redrection is being done.

[image] rg305: The redirections are messed up: http://www.bookiza.io/.well-known/acme-challenge/test redirects to: https://www.bookiza.io/.well-known/acme-challenge/test/.well-known/acme-challenge/test I can't find these redirects. Checked with my own tool bookiza.io - Make your website be…

I’m using nginx for bookiza. It has the following configuration: server { if ($host = www.bookiza.io) { return 301 https://$host$request_uri; } # managed by Certbot if ($host = bookiza.io) { return 301 https://$host$request_uri; } # managed by Certbot #listen…

I now see the name resolves to IPv4 and IPv6 addresses. LE will prefer IPv6 when present. You must ensure that IPV6 is working or remove the AAAA record from DNS: Name: www.bookiza.io Addresses: 2600:3c00::f03c:91ff:fe56:3901 50.116.16.25 IPv4 returns: wget http://www.bookiza.io/.well-kno…

It would seem that your tool doesn’t check both IPv4 and IPv6 independently when present. Or the misdirection is only related to IPv6 and the acme-challenge folder…

Interesting. So IPv6 appears to be configured correctly on my DNS manager. I have a quad-A record for Bookiza that’s mapped to the ipv6-ip provided by Linode. This is working fine for the other domain bubblin.io ! To experiment I just added a blank quad-A record for bookiza (apart from *, www and @) …

The IPv6 may be pointing to the correct system. The problem is in how the redirection is being handled for IPv6. Which is different than how it is being handled for IPv4. Please find and show the vhost that listens to IPv6 (::80 or [::]:80). start with: grep -r '::' /etc/nginx/

Renewal is failing

Server

Topic		Replies	Views
Renewal 404 fail Help	28	1234	February 24, 2019
Renewing an existing certificate: The client lacks sufficient authorization 404 Help	18	3120	February 3, 2019
Certbot renew fails Help	13	4381	May 27, 2021
Certificate renewal Help	103	8900	September 6, 2020
Certbot --nginx success but certbot renew fail Help	8	3501	February 16, 2018

Renewal is failing

Related topics