I received an email about the deprecation of TLS-SNI-01. It didn’t include instructions on how to switch to ALPN. Can someone please help? My domain is: crawl.project357.org My web server is (include version): nginx version: nginx/1.10.3 (Ubuntu) The operating system my web server runs on is (inc…

What ACME client are you using? You might have to do little more than upgrading it, or it might not support TLS-ALPN validation, and you'd have to consider switching to DNS or HTTP validation, or switching clients. There's a list of clients known to support TLS-ALPN at: [image] W…

I’m currently using certbot 0.26.1. I am happy to switch to DNS or HTTP validation instead. Whatever can be automated I’m fine with.

HTTP validation is probably simpler. But without full knowledge of your specific renewal process and setup that is just an overall statement. So I would try that first.

Thank you. Based on the docs it seems HTTP validation puts a file into my docroot – that would work for me. How do I change to HTTP validation? I can’t see instructions in the docs

You can switch to HTTP validation (though you’re probably already using it (as explained here: Upcoming TLS-SNI Deprecation in Certbot )) by adding flag --preferred-challenges like so: certbot-auto --preferred-challenges http

Recent versions of Certbot use HTTP validation by default, unless you override it. How did you install Certbot? 0.26.1 is newer than what’s available in Ubuntu’s repository but older than the Certbot PPA.

Thanks for the advice. I’m using the PPA but hadn’t updated. I’ve done so now, so running 0.28.0. So would updating my cron entry from certbot renew to certbot renew --preferred-challenges http -w /var/www/webroot/ be the right thing to do? I’m not sure why the validation is not using HTTP. In /et…

[image] alexj: So would updating my cron entry No need to change your cron entry. [image] alexj: -w /var/www/webroot/ Is not necessary when using the nginx authenticator. This is because the nginx authenticator temporarily embeds the challenge response directly into your nginx config,…

Unfortunately it’s printing TLS-SNI: $ sudo certbot renew --dry-run Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/crawl.project357.org.conf - - - - - - - - - - - - - - - -…

OK. grep -RE "(pref_challs|challenges)" /etc/letsencrypt/ doesn’t find anything. certbot renew --dry-run -vvv doesn’t return any reference to pref_challs. The first reference to SNI is: Sending GET request to https://acme-staging-v02.api.letsencrypt.org/acme/authz/xxx. https://acme-staging-v02.ap…

SNI to ALPN migration ubuntu 16.04 nginx

Help

_az January 20, 2019, 10:25pm 11

Okay. Could you try the suggestions I made in the following post to try track down why it's choosing that challenge:

Topic		Replies	Views
TLS-SNI-01 validation is reaching end-of-life Help	12	3970	January 28, 2019
How update ACME client to use an alternative validation method (HTTP-01, DNS-01 or TLS-ALPN-01) Help	11	4096	January 18, 2019
TLS-SNI-01 validation end-of-life: What to do? Help	1	3801	January 18, 2019
Upgrade guide for TLS-SNI-01 validation is reaching end-of-life? Help	37	5181	January 28, 2019
TLS-SNI-01 validation is reaching end-of-life Help	10	4118	January 18, 2019

SNI to ALPN migration ubuntu 16.04 nginx

Related topics