4

I have obtained a certificate through let's encrypt with the following command:

sudo certbot certonly --manual -d *.domain.com --agree-tos --no-bootstrap
--manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory

When I try to renew the certificate now with sudo certbot renew I stumble upon the following error:

Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.

The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',)
Attempting to renew cert (domain.com) from /etc/letsencrypt/renewal/domain.com.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration.

The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',). Skipping. All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/domain.com/fullchain.pem (failure)

Do I need to enter additional options in the command or is this feature not yet supported?

Improve this question
1
  • What does your host say? – Simon Hayter Jul 9 '18 at 20:46
8

I had the same problem...

You don't have to renew Certificate with "renew" option. You have to run the same command you ran for Certificate creation.

It detects your Certificate needs renew, and it will ask you the new DNS record "_acme-challenge" modification. You must change record as it will tell you, and continue and Voila: Certificate will renew next three months.

Improve this answer
3
  • ok, this is what I did as my certificate was due to expire. Only problem tough was that some application (like exchange email on smartphone) were giving errors because the certificate (both private + public key) changed. Guess there is no way to circumvent this? – wouter205 Jul 10 '18 at 13:48
  • That's another problem, but this is a renew, the Certificate not must change, and none have to give any error because the certificate change, because Certificate not change. – Bypper Jul 31 '18 at 8:28
  • You are right. It turned out I needed to install the let's encrypt certificate as root certificate on my proxy server. Now I don't experience any trouble with any applications. Thanks. – wouter205 Aug 6 '18 at 6:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.