Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
Certbot 0.23.0 is new enough that it supports HTTP validation, but old enough that it will continue to use TLS-SNI validation by default until Let's Encrypt disables it.
You could upgrade to a newer version of Certbot that uses HTTP validation by default, but you don't really have to.
No matter what I do, I cant renew using http. It ALWAYS goes to tls-sni
I am on Ubuntu 16.
Certbot 0.28
I see NO references to tls-sni in my conf files anywhere.
I have tried forcing the preferred challenge to HTTP-01.. but it always attempts to use tls-sni
WORKS:
certbot --dry-run
FAILS:
certbot --force-renew
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for oozora.com
TLS-SNI-01 is deprecated, and will stop working soon.
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/000-default-le-ssconf
I have scoured the /etc/letsencrypt folder for ANY references to tls-sni
grep -iRl "tls" ./
(no hits)
I have tried adding HTTP as a preferred challenge both in the client.ini and the domain renewal file itself... again, NO change in behavior.. it continues using tls-sni
Well… All is well… it worked… but I am still curious why it was defaulting to TLS-SNI. What is the answer? Why did it ignore settings in the renewal file (to prefer http) and yet worked when invoked from the command line?