The server experienced an internal error :: ACMEv1 Brownout in Progress

[skeddles]

I dont know what this means or how to fix it, and the link you provided in the error doesn't help at all, please my website is completely offline for thousands of users.

[Osiris]

For us not getting such an error: what's the link provided in the error message?

[skeddles]

Attempting to renew cert from /etc/letsencrypt/renewal/lospec.com.conf produced an unexpected error: urn:acme:error:serverInternal :: The server experienced an internal error :: ACMEv1 Brownout in Progress. ACMEv1 will fully turn off on June 1, 2021. Check https://letsencrypt.status.io/ for more details.. Skipping.

[griffin]

Welcome Back to the Let's Encrypt Community

This might help:

End of Life Plan for ACMEv1

T…

[Osiris]

@skeddles

Check https://letsencrypt.status.io/ for more details.

That link shows some more info, including a link to:

End of Life Plan for ACMEv1

I…

Please read that thread

Note: this change has been coming for over many months (if not years) now.. Also, if you're affected by this brown-out, you're probably not renewing soon enough: Let's Encrypt recommends renewing after 60 days, so you have a 30 days "window" if anything goes wrong. This brown out is only 48 hours long. No offence, but if your site is offline for thousands of users due to a brown out of 1/15th of the recommended renewal window, you might have to rethink your renewal process.

[skeddles]

I've read that thread. I understand it. I still don't understand how to fix it.

[Osiris]

@skeddles

I still don't understand how to fix it.

That's ACME client specific. You need to change the endpoint in your ACME client from the ACMEv1 to the ACMEv2 endpoint. And we can't give a generic advice for that, please see the documentation of the ACME client you're using.

[skeddles]

I finally found it on another website. It still would be nice if letsencrypt offered the slightest bit of guidance on how to fix it rather than intentionally locking me out.

For anyone else that's frantically googling trying to bring their site back up and getting no help:

sudo apt-get install --only-upgrade certbot

[griffin]

@Osiris

You need to change the endpoint in your ACME client from the ACMEv1 to the ACMEv2 endpoint.

@skeddles

You can find the information here about the endpoints:

ACME Protocol Updates - Let's Encrypt - Free SSL/TLS Certificates

[Osiris]

@skeddles

It still would be nice if letsencrypt offered the slightest bit of guidance on how to fix it rather than intentionally locking me out.

I would recommend to subscribe to the API Announcements section: #api-announcements That way you get an e-mail (from your Community account) if a thread is opened there. Many announcements regarding this issue have been made.

Also, regarding getting help: if you'd followed the questionnaire you were given when you started your thread, you would have been given the option of mentioning the ACME client used. In this case it apparently was certbot. If you'd said so, we might have given you more direct help. Without knowing the ACME client, no specific help CAN be given

Also, I would like to remind you again to the Let's Encrypt recommendation of renewing 30 days before your certificate expires, so you have ample time to fix issues such as this. Let's Encrypt does not lock you out intentionally. If you follow the recommendations, nothing like this would have happened. The timing and duration of the brown outs are especially meant for users such as yourself: get a warning without the user experiencing any downtime. The brownout is 2 days. The recommended renewal window is 30 days. More than enough time to renew after the brownout subsides. If you adhere to the recommendation that is.

[schoen]

@skeddles

It still would be nice if letsencrypt offered the slightest bit of guidance on how to fix it rather than intentionally locking me out.

This continues to be really tricky because there are dozens of different tools that people might be using to get their certificates from Let's Encrypt:

ACME Client Implementations - Let's Encrypt - Free SSL/TLS Certificates

While Certbot is "recommended", the majority of Let's Encrypt users use something other than Certbot.

The documentation about the brownouts is trying to say "you need to upgrade whatever software you use that interacts with Let's Encrypt", yet there's no universal way to describe how to do that. (Even for Certbot users, the commands needed to upgrade depend on things like what Linux distribution you use, and whether your system is still supported by the distribution vendor or not.) This is really unfortunate, and maybe the underlying concepts could be expressed in a more straightforward way. But it's also why @Osiris mentioned—and other people all over this forum are mentioning all the time—that we really need people looking for help here to provide as much information as possible about their individual software environments, so we can best figure out how to give a relevant answer.