# Updating your ACME client bc TLS-SNI-01 **URL:** \ **Category:** Help\ **Created:** [January 18, 2019, 7:57am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848 "2019-01-18T07:57:43Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![maelyt](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maelyt/32/28992_2.png) [@maelyt](https://community.letsencrypt.org/u/maelyt)\ **Post date:** [January 18, 2019, 7:57am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/1 "2019-01-18T07:57:43Z")
My domain is: [maelyt.net](http://maelyt.net) (+ some subdomains + other domains) I ran this command: `letsencrypt renew` (after I shutdown the nginx) It produced this output: ``` root@xyz:~# letsencrypt renew Saving debug log to /var/log/letsencrypt/letsencrypt.log ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/mabikra.de.conf ------------------------------------------------------------------------------- Cert not yet due for renewal ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/rent-a-minion.net.conf ------------------------------------------------------------------------------- Cert not yet due for renewal ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/miachan.de.conf ------------------------------------------------------------------------------- Cert not yet due for renewal ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/maelyt.net.conf ------------------------------------------------------------------------------- Cert not yet due for renewal ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/noahkun.de.conf ------------------------------------------------------------------------------- Cert not yet due for renewal ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/yamlet.net.conf ------------------------------------------------------------------------------- Cert not yet due for renewal ------------------------------------------------------------------------------- The following certs are not due for renewal yet: /etc/letsencrypt/live/mabikra.de/fullchain.pem expires on 2019-02-23 (skipped) /etc/letsencrypt/live/rent-a-minion.net/fullchain.pem expires on 2019-03-31 (skipped) /etc/letsencrypt/live/miachan.de/fullchain.pem expires on 2019-02-23 (skipped) /etc/letsencrypt/live/maelyt.net/fullchain.pem expires on 2019-03-03 (skipped) /etc/letsencrypt/live/noahkun.de/fullchain.pem expires on 2019-02-23 (skipped) /etc/letsencrypt/live/yamlet.net/fullchain.pem expires on 2019-02-23 (skipped) No renewals were attempted. ------------------------------------------------------------------------------- ``` My web server is (include version): `nginx/1.14.0 (Ubuntu)` [needs to be toggled off for renew] The operating system my web server runs on is (include version): `Ubuntu 18.04.1 LTS (64bit)` My hosting provider, if applicable, is: own vserver I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no ---
**Author:** ![Humbug83](https://avatars.discourse-cdn.com/v4/letter/h/c77e96/32.png) [@Humbug83](https://community.letsencrypt.org/u/Humbug83)\ **Post date:** [January 18, 2019, 8:35am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/2 "2019-01-18T08:35:16Z")
Hi, i had the same “problem”. For me it seems that it doesnt try to update because your certs wonts get invalid in the next 30 days. E.g. my cert was valid until 15.03.2019 so a renew also doesnt work. so i forced it with following command: /usr/bin/certbot --force-renewal After some question (wanna redirect all requests to https, …) i restarted my apache (just to get sure) and checked the certificate again. Now its valid until 18.04.2019, so this worked for me. ---
**Author:** ![lutzhorn](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lutzhorn/32/28978_2.png) [@lutzhorn](https://community.letsencrypt.org/u/lutzhorn)\ **Post date:** [January 18, 2019, 8:40am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/3 "2019-01-18T08:40:43Z")
`--foce-renewal` helped me, too. But `certbot` still uses `TLS-SNI-01`: ```auto $ sudo ./certbot-auto renew --force-renewal ... Processing /etc/letsencrypt/renewal/foo.example.com.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Plugins selected: Authenticator standalone, Installer None Renewing an existing certificate Performing the following challenges: tls-sni-01 challenge for foo.example.com TLS-SNI-01 is deprecated, and will stop working soon. Waiting for verification... Cleaning up challenges - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - new certificate deployed without reload, fullchain is /etc/letsencrypt/live/foo.example.com/fullchain.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ``` How do I tell `certbot` to _not_ use TLS-SNI-01? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 18, 2019, 8:42am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/4 "2019-01-18T08:42:58Z")
> [@lutzhorn](#): > > How do I tell `certbot` to _not_ use TLS-SNI-01? You can try: ``` --preferred-challenges http ``` or updating your renewal parameters file under `/etc/letsencrypt/renewal` so that it shows: ``` [renewalparams] pref_challs = http-01 ``` Please don't use `--force-renewal` guys, you can update your preferences without actually using up your rate limits. Edit: this post previously had wrong advice regarding `--dry-run`. ---
**Author:** ![lutzhorn](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lutzhorn/32/28978_2.png) [@lutzhorn](https://community.letsencrypt.org/u/lutzhorn)\ **Post date:** [January 18, 2019, 8:44am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/5 "2019-01-18T08:44:54Z")
Works! Maybe the email received by so many of us should at least hint on how `certbot` is supposed to be used. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 18, 2019, 8:45am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/6 "2019-01-18T08:45:17Z")
Yeah that email was not ideal ☹ . ---
**Author:** ![Simo](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Simo](https://community.letsencrypt.org/u/Simo)\ **Post date:** [January 18, 2019, 8:52am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/7 "2019-01-18T08:52:35Z")
Hello, So the command to use is : `sudo ./certbot-auto renew --preferred-challenges http --dry-run` ? Thanks in advance ---
**Author:** ![scolar](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/scolar/32/28990_2.png) [@scolar](https://community.letsencrypt.org/u/scolar)\ **Post date:** [January 18, 2019, 8:56am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/9 "2019-01-18T08:56:05Z")
–dry-run currently only works with the ‘certonly’ or ‘renew’ subcommands (‘run’) means I need to update my client? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 18, 2019, 8:58am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/10 "2019-01-18T08:58:51Z")
If you can show the full command that you are trying to use, I can suggest a suitable invocation. ---
**Author:** ![scolar](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/scolar/32/28990_2.png) [@scolar](https://community.letsencrypt.org/u/scolar)\ **Post date:** [January 18, 2019, 9:00am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/11 "2019-01-18T09:00:57Z")
> root@ScolaServer2:/etc/letsencrypt/renewal# certbot --preferred-challenges http --dry-run > --dry-run currently only works with the 'certonly' or 'renew' subcommands ('run') ---
**Author:** ![guilhembn](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@guilhembn](https://community.letsencrypt.org/u/guilhembn)\ **Post date:** [January 18, 2019, 9:04am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/12 "2019-01-18T09:04:19Z")
You need to run `certbot renew --preferred-challenges http --dry-run`. You were missing the `renew` command. ---
**Author:** ![scolar](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/scolar/32/28990_2.png) [@scolar](https://community.letsencrypt.org/u/scolar)\ **Post date:** [January 18, 2019, 9:05am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/13 "2019-01-18T09:05:24Z")
Ah, I see. It works now! Thanks ---
**Author:** ![maelyt](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maelyt/32/28992_2.png) [@maelyt](https://community.letsencrypt.org/u/maelyt)\ **Post date:** [January 18, 2019, 9:09am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/14 "2019-01-18T09:09:46Z")
`certbot renew --preferred-challenges http --dry-run` was successful, but I have no `certbot-auto` command. So I changed some confs in /etc/letsencrypt/renewal/ with this part ``` [renewalparams] pref_challs = http ``` But after `certbot renew --dry-run` all domains run with http-01 challenge? Is this the “http” challenge or the deprecated one? I have no old log. So doesn’t I need changing the confs or does the change failed? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 18, 2019, 9:17am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/15 "2019-01-18T09:17:40Z")
> [@maelyt](#): > > pref\_challs = http This is the correct. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [February 17, 2019, 9:17am UTC](https://community.letsencrypt.org/t/updating-your-acme-client-bc-tls-sni-01/82848/16 "2019-02-17T09:17:45Z")
Closed on February 17, 2019, 9:17am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.