Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
The operating system my web server runs on is (include version): Ubuntu 18.04.4 LTS
My hosting provider, if applicable, is: AWS
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
I have two letsencrypt licences … one for d3.geoffrussell.com.au and one for policy.animaljusticeparty.org … is that what it means by two accounts? In any case, the d3 host is not the same as the policy host so I don’t understand why any files on the policy host have any information on the d3 host. So I’ve no idea what the message means???
I just picked an account at random and the renewal worked …meaning my browser gets the right expiry date!
ACME v1 is indeed redundant, but I do not think it's the cause of this prompt.
I think this prompt might be coming up because you have two ACMEv2 accounts:
97c9, which is your ACME v1 account which has been "upgraded" to ACME v2 via an aliasing/symlink mechanism.
5039, an ACME v2 account which was registered separately.
I'm not sure whether it is intended for Certbot to prompt you in this instance or not. I have a suspicion that it isn't and that it's related to a recent change. So I can look at this further, could you also share the version of Certbot you are using:
@bmw could @_az’s concern be right that there is some sequence of events that can, or could, cause you to automatically get redundant accounts in this case?
The only cases I can immediately think of where people could get this setup are:
If the user had used Certbot 0.22.0 to 0.25.1 with Let’s Encrypt’s ACMEv2 endpoint by manually setting --server on the command line.
Running an old version of Certbot that defaulted to ACMEv1 (or manually setting --server to the ACMEv1 URL) after an ACMEv2 account is created.
Manually combining /etc/letsencrypt directories to do something like copy a setup from another server.
There may be other cases I’m not aware of though.
Once this setup is created, Certbot prompting you about which account to use is expected. The code that does this is very old and people don’t hit it often because Certbot (at least normally) doesn’t let you create multiple accounts for the same server, but the code exists.
|