# TLS-SNI-01 client update

**URL:** <https://community.letsencrypt.org/t/tls-sni-01-client-update/83017>\
**Category:** Help\
**Created:** [January 18, 2019, 1:19pm UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017 "2019-01-18T13:19:57Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![rbottoni](https://avatars.discourse-cdn.com/v4/letter/r/a88e4f/32.png) [@rbottoni](https://community.letsencrypt.org/u/rbottoni)\
**Post date:** [January 18, 2019, 1:19pm UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/1 "2019-01-18T13:19:57Z")

</div>

I received an email to update my validation method…

My domain is: [webtracking.tramaco.net](http://webtracking.tramaco.net)  
My web server is (include version): Apache 2 on Debian  
certbot version : 0.10.2  
I ran this command:certbot renew --dry-run  
It produced this output:

certbot renew --dry-run  
Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

## Processing /etc/letsencrypt/renewal/webtracking.spediamar.it.conf

Cert not due for renewal, but simulating renewal for dry run  
Renewing an existing certificate  
Performing the following challenges:  
http-01 challenge for webtracking.spediamar.it  
Waiting for verification…  
Cleaning up challenges  
Generating key (2048 bits): /etc/letsencrypt/keys/0019\_key-certbot.pem  
Creating CSR: /etc/letsencrypt/csr/0019\_csr-certbot.pem

* * *

## Processing /etc/letsencrypt/renewal/webtracking.tramaco.net.conf

Cert not due for renewal, but simulating renewal for dry run  
Renewing an existing certificate  
Performing the following challenges:  
tls-sni-01 challenge for [webtracking.tramaco.net](http://webtracking.tramaco.net)  
Waiting for verification…  
Cleaning up challenges  
Generating key (2048 bits): /etc/letsencrypt/keys/0020\_key-certbot.pem  
Creating CSR: /etc/letsencrypt/csr/0020\_csr-certbot.pem  
\*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry  
\*\* (The test certificates below have not been saved.)

Congratulations, all renewals succeeded. The following certs have been renewed:  
/etc/letsencrypt/live/webtracking.spediamar.it/fullchain.pem (success)  
/etc/letsencrypt/live/webtracking.tramaco.net/fullchain.pem (success)  
\*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry  
\*\* (The test certificates above have not been saved.)

No warning aboutTLS … but the line “tls-sni-01 challenge for [webtracking.tramaco.net](http://webtracking.tramaco.net)” seems to say otherwise … What can i do now?  
Thanks!

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [January 18, 2019, 1:50pm UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/2 "2019-01-18T13:50:27Z")

</div>

Which version of Debian are you using?

---

<div class="post-metadata">

**Author:** ![rbottoni](https://avatars.discourse-cdn.com/v4/letter/r/a88e4f/32.png) [@rbottoni](https://community.letsencrypt.org/u/rbottoni)\
**Post date:** [January 18, 2019, 2:04pm UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/3 "2019-01-18T14:04:31Z")

</div>

i have debian version 9

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [January 18, 2019, 2:35pm UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/4 "2019-01-18T14:35:30Z")

</div>

You have a few options.

You can upgrade to Certbot 0.28.0 from the stretch-backports repository.

---

<div class="post-metadata">

**Author:** ![rbottoni](https://avatars.discourse-cdn.com/v4/letter/r/a88e4f/32.png) [@rbottoni](https://community.letsencrypt.org/u/rbottoni)\
**Post date:** [January 18, 2019, 4:18pm UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/5 "2019-01-18T16:18:58Z")

</div>

i have already stretch-backports repository in my apt source list… but no update is proposed… how can i force it? (deb [http://ftp.debian.org/debian](http://ftp.debian.org/debian) stretch-backports main)

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [January 18, 2019, 5:01pm UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/6 "2019-01-18T17:01:22Z")

</div>

Have you tried `certbot-auto` ?

---

<div class="post-metadata">

**Author:** ![miki](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@miki](https://community.letsencrypt.org/u/miki)\
**Post date:** [January 18, 2019, 5:50pm UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/7 "2019-01-18T17:50:54Z")

</div>

According to this [Debian Backports](https://backports.debian.org/Instructions/), backports are disabled by default.

I executed (as stated on that site)

> sudo apt-get -t stretch-backports install certbot

to update to version 0.28.0.

---

<div class="post-metadata">

**Author:** ![rbottoni](https://avatars.discourse-cdn.com/v4/letter/r/a88e4f/32.png) [@rbottoni](https://community.letsencrypt.org/u/rbottoni)\
**Post date:** [January 21, 2019, 9:58am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/8 "2019-01-21T09:58:52Z")

</div>

ok … I installed certbot-auto and I ran ./certbot-auto renew --dry-run … and I got the updates successfully …

1. ./certbot-auto --version gives me version 0.30.0 but … certbot --version keeps showing 0.10 (the old version) … why ??
2. ./certbot-auto renew --dry-run Produced this output

Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

Processing /etc/letsencrypt/renewal/webtracking.spediamar.it.conf

* * *

Cert not due for renewal, but simulating renewal for dry run  
Plugins selected: Authenticator webroot, Installer apache  
Renewing an existing certificate  
Performing the following challenges:  
http-01 challenge for webtracking.spediamar.it  
Waiting for verification…  
Cleaning up challenges

* * *

new certificate deployed with reload of apache server; fullchain is  
/etc/letsencrypt/live/webtracking.spediamar.it/fullchain.pem

* * *

* * *

Processing /etc/letsencrypt/renewal/webtracking.tramaco.net.conf

* * *

Cert not due for renewal, but simulating renewal for dry run  
Plugins selected: Authenticator apache, Installer apache  
Renewing an existing certificate  
Performing the following challenges:  
http-01 challenge for [webtracking.tramaco.net](http://webtracking.tramaco.net)  
Waiting for verification…  
Cleaning up challenges  
Attempting to renew cert ([webtracking.tramaco.net](http://webtracking.tramaco.net)) from /etc/letsencrypt/renewal/webtracking.tramaco.net.conf produced an unexpected error: Failed authorization procedure. [webtracking.tramaco.net](http://webtracking.tramaco.net) (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://webtracking.tramaco.net/.well-known/acme-challenge/FzZSbqvcoduwT-ygFMXGM5vA3PRsxRoU1vhzTWXMZSg:](http://webtracking.tramaco.net/.well-known/acme-challenge/FzZSbqvcoduwT-ygFMXGM5vA3PRsxRoU1vhzTWXMZSg:) “\n\<html xml:lang=“en”\>\<head id=“j\_idt2”\>\<link type=“text/css” rel=“stylesheet” href=”/javax.faces.resource/fa/font". Skipping.  
The following certs could not be renewed:  
/etc/letsencrypt/live/webtracking.tramaco.net/fullchain.pem (failure)

* * *

\*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry  
\*\* (The test certificates below have not been saved.)

The following certs were successfully renewed:  
/etc/letsencrypt/live/webtracking.spediamar.it/fullchain.pem (success)

The following certs could not be renewed:  
/etc/letsencrypt/live/webtracking.tramaco.net/fullchain.pem (failure)  
\*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry  
\*\* (The test certificates above have not been saved.)

* * *

1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

- The following errors were reported by the server:

so what can i do?  
thanks.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 21, 2019, 10:06am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/9 "2019-01-21T10:06:20Z")

</div>

Hi @rbottoni

> [@rbottoni](#):
>
> Domain: [webtracking.tramaco.net](http://webtracking.tramaco.net)

looks like you have a terrible error ( [https://check-your-website.server-daten.de/?q=webtracking.tramaco.net](https://check-your-website.server-daten.de/?q=webtracking.tramaco.net) ):

| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://webtracking.tramaco.net/](http://webtracking.tramaco.net/) | | | | |
| 78.47.140.152 | 301 | [https://webtracking.tramaco.net/](https://webtracking.tramaco.net/) | 0.043 | A |
| | | | | |
| • [https://webtracking.tramaco.net/](https://webtracking.tramaco.net/) | | | | |
| 78.47.140.152 | 302 | [DCS Tramaco WebTracking -](https://webtracking.tramaco.net/login.xhtml;jsessionid=56A13A26F4E681F260CBEA07A6D900A9) | 1.346 | B |
| | | | | |
| • [DCS Tramaco WebTracking -](https://webtracking.tramaco.net/login.xhtml;jsessionid=56A13A26F4E681F260CBEA07A6D900A9) | 200 | | 1.506 | B |
| | | | | |
| • [http://webtracking.tramaco.net/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://webtracking.tramaco.net/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 78.47.140.152 | 301 | [https://webtracking.tramaco.net/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](https://webtracking.tramaco.net/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | 0.043 | A |
| | | | | |
| • [https://webtracking.tramaco.net/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](https://webtracking.tramaco.net/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | 404 | | 1.260 | A |
| 404 | | | | |
| | | | | |

If you want to use http-validation, a file in /.well-known/acme-challenge is checked.

The redirect http -\> https is ok, Letsencrypt follows these redirects. But then the tool reports a http status 404 - not found. Normally, this is ok, because the test file doesn't exist.

But open this url manual:

```nohighlight
HTTP Status 404 - Access is denied
You are not authorized to view this page
Error Code: 404
Error Description: /.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
Exception Type: n.d.
Exception Class: n.d.
Request URI : /.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 

```

"Access is denied" is status 401 or 403, not 404, this is a wrong server configuration.

Solution: Allow anonymous access to /.well-known/acme-challenge. And fix your server. But this is only a problem testing your site.

---

<div class="post-metadata">

**Author:** ![rbottoni](https://avatars.discourse-cdn.com/v4/letter/r/a88e4f/32.png) [@rbottoni](https://community.letsencrypt.org/u/rbottoni)\
**Post date:** [January 21, 2019, 10:42am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/10 "2019-01-21T10:42:04Z")

</div>

> [@JuergenAuer](#):
>
> Solution: Allow anonymous access to /.well-known/acme-challenge. And fix your server. But this is only a problem testing your site.

Hi,  
the "/.well-known" folder does not really exist .. should I create it?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 21, 2019, 10:46am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/11 "2019-01-21T10:46:05Z")

</div>

> [@rbottoni](#):
>
> should I create it?

Yes, that's always a good idea.

Create

```nohighlight
/.well-known/acme-challenge

```

in your root directory and allow access, so

```nohighlight
http://webtracking.tramaco.net/.well-known/acme-challenge/1234

```

or the redirect gets a correct 404 - not found.

---

<div class="post-metadata">

**Author:** ![rbottoni](https://avatars.discourse-cdn.com/v4/letter/r/a88e4f/32.png) [@rbottoni](https://community.letsencrypt.org/u/rbottoni)\
**Post date:** [January 21, 2019, 11:29am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/12 "2019-01-21T11:29:46Z")

</div>

ok… this is my new output for : ./certbot-auto renew --dry-run

Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

Processing /etc/letsencrypt/renewal/webtracking.spediamar.it.conf

* * *

Cert not due for renewal, but simulating renewal for dry run  
Plugins selected: Authenticator webroot, Installer apache  
Renewing an existing certificate  
Performing the following challenges:  
http-01 challenge for webtracking.spediamar.it  
Waiting for verification…  
Cleaning up challenges

* * *

new certificate deployed with reload of apache server; fullchain is  
/etc/letsencrypt/live/webtracking.spediamar.it/fullchain.pem

* * *

* * *

Processing /etc/letsencrypt/renewal/webtracking.tramaco.net.conf

* * *

Cert not due for renewal, but simulating renewal for dry run  
Plugins selected: Authenticator apache, Installer apache  
Renewing an existing certificate  
Performing the following challenges:  
http-01 challenge for [webtracking.tramaco.net](http://webtracking.tramaco.net)  
Waiting for verification…  
Cleaning up challenges  
Attempting to renew cert ([webtracking.tramaco.net](http://webtracking.tramaco.net)) from /etc/letsencrypt/renewal/webtracking.tramaco.net.conf produced an unexpected error: Failed authorization procedure. [webtracking.tramaco.net](http://webtracking.tramaco.net) (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://webtracking.tramaco.net/.well-known/acme-challenge/nNbXtEXqWHbPEeJb9pVVV614hGpBu4uNoLU\_iMI0Ygo:](http://webtracking.tramaco.net/.well-known/acme-challenge/nNbXtEXqWHbPEeJb9pVVV614hGpBu4uNoLU_iMI0Ygo:) “\n\<html xml:lang=“en”\>\<head id=“j\_idt2”\>\<link type=“text/css” rel=“stylesheet” href=”/javax.faces.resource/fa/font". Skipping.  
The following certs could not be renewed:  
/etc/letsencrypt/live/webtracking.tramaco.net/fullchain.pem (failure)

* * *

\*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry  
\*\* (The test certificates below have not been saved.)

The following certs were successfully renewed:  
/etc/letsencrypt/live/webtracking.spediamar.it/fullchain.pem (success)

The following certs could not be renewed:  
/etc/letsencrypt/live/webtracking.tramaco.net/fullchain.pem (failure)  
\*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry  
\*\* (The test certificates above have not been saved.)

* * *

1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

- The following errors were reported by the server:

is now ok?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 21, 2019, 11:34am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/13 "2019-01-21T11:34:43Z")

</div>

> [@rbottoni](#):
>
> is now ok?

No. Now your server sends a 404, but my browser says:

```nohighlight
HTTP Status 404 - Access is denied
You are not authorized to view this page

```

So Letsencrypt can't check a file.

Create a file under /.well-known/acme-challenge, file name 1234. Then check, if you can load this file via

```nohighlight
https://webtracking.tramaco.net/.well-known/acme-challenge/1234

```

If yes, you have found your correct webroot. So use it:

```nohighlight
certbot-auto run -a webroot -i apache -w yourWebRoot -d yourDomain

```

---

<div class="post-metadata">

**Author:** ![rbottoni](https://avatars.discourse-cdn.com/v4/letter/r/a88e4f/32.png) [@rbottoni](https://community.letsencrypt.org/u/rbottoni)\
**Post date:** [January 21, 2019, 11:49am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/14 "2019-01-21T11:49:49Z")

</div>

Congratulations, all renewals succeeded!!!

Thanks JuergenAuer !!!

just one last question, … but only out of curiosity …

./certbot-auto --version gives me version 0.30.0 but … certbot --version keeps showing 0.10 (the old version) … why ??

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [January 21, 2019, 11:52am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/15 "2019-01-21T11:52:56Z")

</div>

> [@rbottoni](#):
>
> ./certbot-auto --version gives me version 0.30.0 but … certbot --version keeps showing 0.10 (the old version) … why ??

They're separate. `/usr/bin/certbot` was installed and is managed by apt. `certbot-auto` installs itself into `/opt/eff.org/certbot/`. One doesn't overwrite the other.

You can upgrade the Certbot apt packages to 0.28.0 by using the stretch-backports repository.

Edit: They both use your configuration and certificates in `/etc/letsencrypt/` though.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 21, 2019, 11:53am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/16 "2019-01-21T11:53:36Z")

</div>

> [@rbottoni](#):
>
> Congratulations, all renewals succeeded!!!

Yep, now you have a new certificate, valide 21. April 2019.

> [@rbottoni](#):
>
> ./certbot-auto --version gives me version 0.30.0 but … certbot --version keeps showing 0.10 (the old version) … why ??

One is your very old certbot, the other is your new certbot-auto.

---

<div class="post-metadata">

**Author:** ![rbottoni](https://avatars.discourse-cdn.com/v4/letter/r/a88e4f/32.png) [@rbottoni](https://community.letsencrypt.org/u/rbottoni)\
**Post date:** [January 21, 2019, 11:58am UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/17 "2019-01-21T11:58:56Z")

</div>

still many many thanks !!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [February 20, 2019, 1:00pm UTC](https://community.letsencrypt.org/t/tls-sni-01-client-update/83017/19 "2019-02-20T13:00:34Z")

</div>

Closed on February 20, 2019, 1:00pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.