Solution: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA

[jsha]

@alan.stroop

Is the TLS-SNI challenge essentially dead, from here on forward, for all new issuances?

Yep.

@alan.stroop

I’m pretty sure I read in a different thread it was re-enabled for some of the “Big Boys”.

This is true, though we are working with those large hosting providers to move them to HTTP-01, or to some possible future validation method that uses TLS but is more secure. Discussions about possible future methods are happening on the IETF ACME mailing list.

@alan.stroop

I was under the impression that TLS-SNI challenges were only temporarily disabled.

This was our original plan, but it changed as we learned more about the extent of the problem.

@alan.stroop

Futhermore, if HTTP-01 and DNS challenges are the sole remaining options, if a new issuance is done via HTTP-01, will renews require HTTP-01 or will they default to the TLS-SNI challenge?

Renewals can happen under TLS-SNI, even if the original issuance was via HTTP-01. However, I'd definitely recommend against this as a strategy for long-term maintenance.

@alan.stroop

I’m just trying to determine whether using the DNS challenge is the best fit long term for my situation.

If you have the ability to automatically integrate the DNS challenge, it is generally a great choice. It works for situations where you have multiple servers serving the same hostname. It will also be required if you want to issue wildcard certificates once our v2 API launches.