My domain is: I ran this command: certbot renewal And dig @8.8.8.8 acme-v1.letsencrypt.org (from several servers) It produced this output: Attempting to renew cert (xxxx) from /etc/letsencrypt/renewal/nwh.c Xxxx.de.conf produced an unexpected error: ("bad handshake: Error([('SSL ro utines', …

[image] rg305: Change that to v2. These have no A records: acme-v1.api.letsencrypt.org acme-v2.api.letsencrypt.org acme-v01.api.letsencrypt.org This does: acme-v02.api.letsencrypt.org

[image] griffin: You need to update to an ACMEv2 client. Actually... [image] ole1986: certbot 0.28.0 Should be capable of using ACMEv2 protocol. See: Certbot 0.22.0 Release with ACMEv2 and Wildcard Support - Client dev - Let's Encrypt Community Support (letsencrypt.org) The problem…

Quite true, @rg305 . Simply changing the server line in the renewal configuration file from https://acme-v01.api.letsencrypt.org/directory to https://acme-v02.api.letsencrypt.org/directory might be sufficient.

Although the bad handshake seems to imply that OpenSSL may be having issue too... Not enough of the LE logs are shown to understand what went wrong.

Unfortunately not. as I had the https://acme-v02.api.letsencrypt.org/directory already configured. And i still assume its not an issue of the certbot but more a DNS issue. I tried several dns resolver all failed to resolve an ip address for acme-v2

Please show the outputs of: curl -Iv https://acme-v02.api.letsencrypt.org/ openssl version [image] ole1986: I tried several dns resolver all failed to resolve an ip address for acme-v2 But you only showed ACMEv1 DNS requests.

Ah... DST Root CA X3 expiration complications possibly.

I would be surprised if this even responds: acme-v1.api.letsencrypt.org I always thought it was only this: acme-v01.api.letsencrypt.org

[image] ole1986: dig @8.8.8.8 acme-v1.letsencrypt.org Change that to v02.

* Trying 172.65.32.248... * TCP_NODELAY set * Connected to acme-v02.api.letsencrypt.org (172.65.32.248) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CA…

Urgent certbot does not update due DNS issue

Help

griffin November 6, 2021, 7:10am 2

Welcome to the Let's Encrypt Community

Your certbot version is ancient and ACMEv1 is obsolete. ~~You need to update to an ACMEv2 client.~~

Topic		Replies	Views
Update to ACMEv2 and point to right infos to renew certs Help	6	1565	November 29, 2021
Update your client software to continue using Let's Encrypt Help	6	926	May 14, 2020
Manual certificate renewal failing - DNS challenge Help	5	1634	August 14, 2021
Certbot renew failed Help	10	2425	January 14, 2022
Impossible to renew certificate with certbot 0.10.2-1 Help	4	788	July 22, 2022

Urgent certbot does not update due DNS issue

Related topics