My web server is (include version): Not relevant The operating system my web server runs on is (include version): Ubuntu 20.04 My hosting provider, if applicable, is: not relevant VPS with full root access I can login to a root shell on my machine (yes or no, or I don't know): Yes I'm using a co…

[image] nemi: test -x /usr/bin/certbot -a ! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew --reuse-key You might be better off adding this to /etc/letsencrypt/cli.ini: reuse-key = true On Ubuntu 20.04, the systemd timer is used, not the cronjob. So if the onl…

Perhaps worth the read: [image] DANE and upcoming LE issuer certs Issuance Tech X…

Thank you. I found this. [image] [Anleitung] DANE/TLSA mit Letsencrypt - netcup Kundenforum Hallo Leute, ich wollte heute mal eine kleine Anleitung dazu geben, wie Ihr DANE in Verbindung mit Letsencrypt verwenden könnt.Das ganze kann relativ kompliziert werden und die Anleitungen im Inte…

Thanks, I was not sure which options could be used in the ini due to that I placed it in command line. Seems to be nearly everything which is working in command line is working in the ini? This part of the documentation is very short. I will try that, thanks. I'm using 3.1 2 - so this should work. …

[image] nemi: I have tried this via dry run but still getting new TLSA? A dry-run discards the certificate, so I don't see how you would be getting a different TLSA record. Here is me with reuse-key = true in cli.ini: Generating the initial certificate $ sudo -E certbot certonly -d example…

Just be aware that intermediate CAs aren't forever . You still need to check whether the new certificate chain from the CA has the expected issuer, before deploying it. Unless you pay close attention to LE pre-announcements of upcoming changes, eventually a static pin of the intermediate CA will be…

Thank you. I viewed the log entries in the dry run and renew option. But maybe this is not working with dry run like I imagined. I did two dry runs and compared the full chain entries which are written into the log and compared with the current TLSA record. That resulted in three different TLSA. S…

Can you setup a "test" subdomain? If so, you could begin practicing with it in the in the staging environment immediately. With something simple like: certbot -d test.my.domain --staging certbot delete -d test.my.domain certbot -d test.my.domain --staging certbot -d test.my.domain --staging --…

TLSA record changes with every renewal process which breaks DANE

Help

rg305 January 31, 2021, 10:24am 4

Perhaps worth the read:

Topic		Replies	Views
A DANE-friendly Certbot workflow Help	3	2350	August 24, 2021
Please avoid "3 0 1" and "3 0 2" DANE TLSA records with LE certificates Server	17	36759	October 14, 2018
TLSA record hygiene for Let's Encrypt issuer CAs Issuance Tech	16	618	June 17, 2025
Migrate from dehydrated to certbot Help	11	1338	May 8, 2022
DANE+TLSA record generation Issuance Tech	25	2598	May 7, 2024

TLSA record changes with every renewal process which breaks DANE

Related topics