I see that some certificates that I created still use acme-v01 (160 on 222 certificates)
below you have two renewal files, one using acme-v02, the other using acme-v01. I renew the certificates with ‘certbot renew’
what should i do to make all certificates use acme-v02 (Beginning June 1, 2020, letsencrypt stop allowing new domains to validate using the ACMEv1 protocol)
first exemple:
-rw-r–r-- 1 root root 676 Jan 31 13:52 renewal/lessouhesmes.pikoloco.com.conf
# renew_before_expiry = 30 days
version = 0.31.0
archive_dir = /etc/letsencrypt/archive/lessouhesmes.pikoloco.com
cert = /etc/letsencrypt/live/lessouhesmes.pikoloco.com/cert.pem
privkey = /etc/letsencrypt/live/lessouhesmes.pikoloco.com/privkey.pem
chain = /etc/letsencrypt/live/lessouhesmes.pikoloco.com/chain.pem
fullchain = /etc/letsencrypt/live/lessouhesmes.pikoloco.com/fullchain.pem
# Options used in the renewal process
[renewalparams]
authenticator = webroot
account = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
server = https://acme-v02.api.letsencrypt.org/directory
[[webroot_map]]
catalogue.lessouhesmes.pikoloco.com = /var/www/html
lessouhesmes.pikoloco.com = /var/www/html
Second exemple :
-rwxr-xr-x 1 root root 713 Mar 14 21:05 renewal/sulpissy.biblibre.com.conf
# renew_before_expiry = 30 days
cert = /etc/letsencrypt/live/sulpissy.biblibre.com/cert.pem
privkey = /etc/letsencrypt/live/sulpissy.biblibre.com/privkey.pem
chain = /etc/letsencrypt/live/sulpissy.biblibre.com/chain.pem
fullchain = /etc/letsencrypt/live/sulpissy.biblibre.com/fullchain.pem
version = 0.31.0
archive_dir = /etc/letsencrypt/archive/sulpissy.biblibre.com
# Options and defaults used in the renewal process
[renewalparams]
authenticator = webroot
account = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
server = https://acme-v01.api.letsencrypt.org/directory
standalone_supported_challenges = "tls-sni-01,http-01"
[[webroot_map]]
sulpissy.biblibre.com = /var/www/html/
koha.sulpissy.biblibre.com = /var/www/html/
ok i will make this substitution as quickly as possible
Do you have any idea why some are acme-v01.api and others are acme-v01.api ?
the version of acme at the time of the creation of the certificate perhaps?
Yes, probably. When you first created the certificates, Certbot would have used its default ACME server, and then saved it in the renewal configuration file. Even though the default has changed from acme-v01 to acme-v02 since then, it doesn't automatically switch it when renewing certificates.
You could still have forced it to use acme-v01 more recently by using a command line argument or configuration file, though.
Another sign that the sulpissy.biblibre.com certificate might have been created with an old version of Certbot is the standalone_supported_challenges setting: It was renamed to something else (--preferred-challenges on the command line, or pref_challs in the renewal files) a long time ago. Not to mention the fact that Let's Encrypt has removed the TLS-SNI-01 challenge type.
Again, it's probably still possible to set that in Certbot 0.31.0, but it would have displayed a deprecation warning, so you would probably have stopped doing so after one or two more certificates.
I wrote this little bash script to convert the old acme-v01 entries. Does that sound right to you?
#! /usr/bin/bash
cd /etc/letsencrypt/renewal
for i in $(grep -rl acme-v01 *.conf)
do
echo "[CERBOT CONF] : update $i"
sed -i 's_https://acme-v01.api.letsencrypt.org/directory_https://acme-v02.api.letsencrypt.org/directory_ ; /standalone_supported_challenges/d ; /authenticator/iwebroot_path = /var/www/html,' $i
done
effectively, the r in grep is totally useless in this case
I noticed ‘webroot_path = /var/www/html,’ in the certificates that I have generated in recent days. The comma at the end of’ webroot_path=/var/www/html’ is strange isn’t it?
Hello
So I modified all the configuration files.
The problem is that it does not seem to work since I still have the entry http-01 challenge in the logs despite the new configuration below
It’s possible there could still be corner cases – like if there is a forgotten script somewhere that uses the --server argument for some reason – but if the logs show that it’s always using the new API, it sounds like everything’s taken care of.
