I'm trying to renew my certificate that is due to expire. I used the apache plugin for certbot like this: sudo certbot --apache -d support.example.com.
However, when I try to renew it now it uses tls-sni-01 challlenge and thus failes to authenticate:
Processing /etc/letsencrypt/renewal/support.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for support.example.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (support.example.com) from /etc/letsencrypt/renewal/support.example.com.conf produced an unexpected error: Failed authorization procedure. support.example.com (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 1ab20abd9ac656e814998274e38cd6e1.cfffa3659f04d5bb0c041a9fef293f9d.acme.invalid from <EXTERNAL IP-ADDRESS:443>. Received 2 certificate(s), first certificate had names "*.example.com". Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/support.example.com/fullchain.pem (failure)
And
- The following errors were reported by the server:
Domain: support.example.com
Type: unauthorized
Detail: Incorrect validation certificate for tls-sni-01 challenge.
Requested
1ab20abd9ac656e814998274e38cd6e1.cfffa3659f04d5bb0c041a9fef293f9d.acme.invalid
from <EXTERNAL IP-ADDRESS:443. Received 2 certificate(s), first
certificate had names "*.example.com"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
Here is the output from support.example.com.conf
# renew_before_expiry = 30 days
version = 0.22.2
archive_dir = /etc/letsencrypt/archive/support.example.com
cert = /etc/letsencrypt/live/support.example.com/cert.pem
privkey = /etc/letsencrypt/live/support.example.com/privkey.pem
chain = /etc/letsencrypt/live/support.example.com/chain.pem
fullchain = /etc/letsencrypt/live/support.example.com/fullchain.pem
# Options used in the renewal process
[renewalparams]
authenticator = apache
installer = apache
account = <ACCOUNT NUMBER>
As I understand, certbot is trying to renew with DNS-challenge whereas I used webroot (through the apache plugin) so it failes to succeed.
How can I make certbot to correctly use webroot challenge?
update:
When I perform certbot renew --dry-run it uses the correct http-01 challenge
Processing /etc/letsencrypt/renewal/support.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for support.example.com
Waiting for verification...
Cleaning up challenges
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed with reload of apache server; fullchain is
/etc/letsencrypt/live/support.example.com/fullchain.pem
How is this possible?
update 2:
I've changed my let's encrypt renewal conf in order to use the correct webroot challenge.
# renew_before_expiry = 30 days
version = 0.22.2
archive_dir = /etc/letsencrypt/archive/support.example.com
cert = /etc/letsencrypt/live/support.example.com/cert.pem
privkey = /etc/letsencrypt/live/support.example.com/privkey.pem
chain = /etc/letsencrypt/live/support.example.com/chain.pem
fullchain = /etc/letsencrypt/live/support.example.com/fullchain.pem
[renewalparams]
post_hook = service apache2 start
installer = apache
account = a57eab015444b60984498d853e6c3531
authenticator = webroot
pre_hook = service apache2 stop
[[webroot_map]]
support.example.com = /var/www/support/
But performing renewal now I get the following error:
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer apache
Running pre-hook command: service apache2 stop
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for support.example.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (support.example.com) from /etc/letsencrypt/renewal/support.example.com.conf produced an unexpected error: Failed authorization procedure. support.example.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://support.example.com/.well-known/acme-challenge/VDmwSn8yXRbV2dFGe6dvsWelJBthNE33aoynDZ9i3qE: Connection refused. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/support.example.com/fullchain.pem (failure)
I can reach http://support.example.com/.well-known/acme-challenge from outside so this could not be the problem in my opinion.
--webrootcommand line option as documented here: certbot.eff.org/docs/using.html#webroot--standalonemode and specify the webroot directory as a command line option because I don't want it messing with my Apache configuration or automatically restarting my server. In my opinion the options for trying to work automatically with the different specific servers shouldn't be implemented. They are unlikely to work all the time and they are very likely to break somebody's web server. I recommend not using them.