Win-acme ARI 'replaces' error prevent cert renewal

My domain is: ggturbo.ddns.net

I ran this command: wacs.exe

It produced this output: Renewing turbo
[HTTP] Request completed with status Conflict
Failed to create order: Could not validate ARI 'replaces' field :: cannot indicate an order replaces certificate with serial "0652572425f87e5c72256244c7198f414d8d", which already has a replacement order
Renewal for turbo failed, will retry on next run
Unable to create order
No certificate generated

My web server is (include version): Apache/2.4.58

The operating system my web server runs on is (include version): Windows 11

My hosting provider, if applicable, is: N/A

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): win-acme v2.2.9.1701

I have never encountered this error before. I googled the error message and can't find a solution.

2 Likes

Welcome @bobl61

ARI is ACME Renewal Information. It tells win-acme when it should renew the cert. That error says win-acme is telling Let's Encrypt that this new cert should replace a previous one. But, that the previous one has already been replaced.

That should not happen. It may be because something went wrong with a prior win-acme run. I'm not sure the proper procedure to reset win-acme and retry but that might be one option. Or, try asking on their github for suggestions.

A better option is to replace win-acme with simple-acme. It is a drop-in replacement for it and is managed by the same person who used to provide main support for win-acme. This will likely be a better supported client going forward.

If the problem persists in simple-acme you will get a reply on their support channel. See: https://simple-acme.com/

I don't have lots of personal experience with either but we see these often enough. Perhaps a different volunteer will have other suggestions. I changed the title to bring attention to it.

4 Likes

If I had known I'd have to wait around for 20 minutes to get a response, I'd have tried another forum :rofl: Thanks, MikeMcQ. I just downloaded simple-acme and will give that a try.

4 Likes