Renewing wildcard domain on multiple servers

[Krambox]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: ordertree.io

I ran this command:

certbot certonly --cert-name "ordertree.io" --server https://acme-v02.api.letsencrypt.org/directory --manual --preferred-challenges dns -d 'ordertree.io,*.ordertree.io'

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for ordertree.io
dns-01 challenge for ordertree.io

---

NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?

---

(Y)es/(N)o: Y

---

Please deploy a DNS TXT record under the name
_acme-challenge.ordertree.io with the following value:

yxYl7qzplqJB7VDxDHeXR8e_DM5izUZdD--1dyGfAaE

Before continuing, verify the record is deployed.

---

Press Enter to Continue

---

Please deploy a DNS TXT record under the name
_acme-challenge.ordertree.io with the following value:

1okcwxgH5-E_EzgdzVOpzfgSyZSqvf77nrNfSYIvsn0

Before continuing, verify the record is deployed.
(This must be set up in addition to the previous challenges; do not remove,
replace, or undo the previous challenge tasks yet. Note that you might be
asked to create multiple distinct TXT records with the same name. This is
permitted by DNS standards.)

---

Press Enter to Continue
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. ordertree.io (dns-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: No TXT record found at _acme-challenge.ordertree.io, ordertree.io (dns-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: No TXT record found at _acme-challenge.ordertree.io

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: ordertree.io
  Type: unauthorized
  Detail: No TXT record found at _acme-challenge.ordertree.io

  Domain: ordertree.io
  Type: unauthorized
  Detail: No TXT record found at _acme-challenge.ordertree.io

  To fix these errors, please make sure that your domain name was
  entered correctly and the DNS A/AAAA record(s) for that domain
  contain(s) the right IP address.

My web server is (include version):

Server version: Apache/2.4.38 (Debian)
Server built: 2020-08-25T20:08:29

The operating system my web server runs on is (include version):

Distributor ID: Debian
Description: Debian GNU/Linux 10 (buster)
Release: 10
Codename: buster

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): NO

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot 0.31.0

[MikeMcQ]

Two things, you have far too many TXT record values for Let's Encrypt. You need to remove the older values

Second, you should update that very old Certbot version. See below for snap install

Certbot

dig +noall +answer TXT _acme-challenge.ordertree.io
_acme-challenge.ordertree.io. 59 IN     TXT     "6c4SQdelJxnIwJbDa9aomWw7g4zdapw1QwmkxFH9OCk"
_acme-challenge.ordertree.io. 59 IN     TXT     "6-ohUc-SqhPt_ZeNbKo4rLzBIW6YMz42sk5OAs4BJB0"
_acme-challenge.ordertree.io. 59 IN     TXT     "aSuYMmqq-aarKeTWro6FgIgTt_VXrnOLbAbCUbH9toQ"
_acme-challenge.ordertree.io. 59 IN     TXT     "UM7H5qxrrs2uWqkFutoSYyvkLPYSi7tBLW6mVw66ocE"
_acme-challenge.ordertree.io. 59 IN     TXT     "jIN-o7NW4nF-40puRGSh0SlT3kGa4dAQR8W5ppHDHJw"
(numerous others omitted)

[Krambox]

Thanks a lot @MikeMcQ , that fixed it!

[Osiris]

You should probably consider using acme-dns. Ideally you would host your own instance for security reasons, but it's also possible to use joohoi's public acme-dns instance. It would only require a single CNAME RR added to your DNS zone manually and afterwards the dns-01 challenge could be automated using one of the three methods listed at " Authentication hooks" if Certbot is used.

That way no manual adding/removing of TXT RRs is necessary, but is fully automated renewal possible.