dah... I even discussed that the other day. My fault.
sudo certbot certonly --cert-name tipvote --nginx -d "tipvote.com,www.tipvote.com" --dry-run
$ sudo certbot certonly --cert-name tipvote --nginx -d "tipvote.com,www.tipvote.com" --dry-run
[sudo] password for droid:
Sorry, try again.
[sudo] password for droid:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for tipvote.com
http-01 challenge for www.tipvote.com
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. www.tipvote.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from https://www.tipvote.com/.well-known/acme-challenge/duEMKrrI4WsoKqYKlTKUZ20maKLzEEyJebN0KWwFwSE [45.55.126.39]: "<html>\n<head>\n <style>\n\n body {\n margin: 0;\n font-family: Arial, Helvetica, sans-serif;\n ", tipvote.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from https://www.tipvote.com/.well-known/acme-challenge/DHQ7PsC--lAkqgf50MJstEaWHb7iAg-28LphMYM86HU [45.55.126.39]: "<html>\n<head>\n <style>\n\n body {\n margin: 0;\n font-family: Arial, Helvetica, sans-serif;\n "
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: www.tipvote.com
Type: unauthorized
Detail: Invalid response from
https://www.tipvote.com/.well-known/acme-challenge/duEMKrrI4WsoKqYKlTKUZ20maKLzEEyJebN0KWwFwSE
[45.55.126.39]: "<html>\n<head>\n <style>\n\n body {\n
margin: 0;\n font-family: Arial, Helvetica,
sans-serif;\n "
Domain: tipvote.com
Type: unauthorized
Detail: Invalid response from
https://www.tipvote.com/.well-known/acme-challenge/DHQ7PsC--lAkqgf50MJstEaWHb7iAg-28LphMYM86HU
[45.55.126.39]: "<html>\n<head>\n <style>\n\n body {\n
margin: 0;\n font-family: Arial, Helvetica,
sans-serif;\n "
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.that is just due to not adding the dns txt?
Nope.
There are two primary types of challenges:
- dns-01 uses a TXT record
- http-01 uses a file
Usually the latter is preferred since automated dns updates can be tricky.
Do you usually manually add TXT records?
its weird. them failed attempts before where from figuring out how to best add the txt manually. Today when doing it, it didnt ask me for it. I think its because i changed to --nginx?
I would strongly prefer the easier method
The reason it didn't ask you is because Let's Encrypt already has dns-01 challenge authorizations cached for your ACME account. Are your VMs images of one another? What I'm asking is: did you install certbot separately on each VM so they have different ACME accounts?
seperatly. I added them over time.
So it looks like for now using dns challenges is probably wise because of the load balancing. We might be able to get some kind of automation going with something like acme-dns in the future.
We need to get some organization going to keep you from getting rate-limited.
Do your VMs have names you use (electronically or otherwise) that you care to share?
That would be bad! The rate limit will reset if I dont touch till christmas though?
d01 d02 d03(currently being worked on)
It is 5 duplicate certificates in a rolling 7-day period.
Does the name d01.tipvote.com have any impact on your setup? I don't see any dns records, but I can't see inside your network.
I believe I set the DNS for the load balancer which redirects it to the vms. Using a digital ocean load balancer. I dont have a d01.tipvote.com dns record.
This might be worth looking over at a point:
For now though, would it do harm to temporarily take d01 and d02 out of the mix to try something?
I can do that ill take down vm d01