TLS-SNI-01 validation is reaching end-of-life

Help
5

You should be safe, then.

Certbot 0.23.0 is new enough that it supports HTTP validation, but old enough that it will continue to use TLS-SNI validation by default until Let's Encrypt disables it.

You could upgrade to a newer version of Certbot that uses HTTP validation by default, but you don't really have to.

https://certbot.eff.org/lets-encrypt/ubuntubionic-nginx

If you run "grep pref_challs /etc/letsencrypt/cli.ini /etc/letsencrypt/renewal/*", are any of your certificates forcing TLS-SNI validation?

Edit:

For posterity, the grep command above only half works. It should have been:

grep preferred-challenges /etc/letsencrypt/cli.ini
grep pref_challs /etc/letsencrypt/renewal/*

See also: