How to change challenge from tls-sni-01 to webroot for existing letsencrypt certificate?

Question

I'm trying to renew my certificate that is due to expire. I used the apache plugin for certbot like this: sudo certbot --apache -d support.example.com.

However, when I try to renew it now it uses tls-sni-01 challlenge and thus failes to authenticate:

Processing /etc/letsencrypt/renewal/support.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for support.example.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (support.example.com) from /etc/letsencrypt/renewal/support.example.com.conf produced an unexpected error: Failed authorization procedure. support.example.com (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 1ab20abd9ac656e814998274e38cd6e1.cfffa3659f04d5bb0c041a9fef293f9d.acme.invalid from <EXTERNAL IP-ADDRESS:443>. Received 2 certificate(s), first certificate had names "*.example.com". Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/support.example.com/fullchain.pem (failure)

And

 - The following errors were reported by the server:

   Domain: support.example.com
   Type:   unauthorized
   Detail: Incorrect validation certificate for tls-sni-01 challenge.
   Requested
   1ab20abd9ac656e814998274e38cd6e1.cfffa3659f04d5bb0c041a9fef293f9d.acme.invalid
   from <EXTERNAL IP-ADDRESS:443. Received 2 certificate(s), first
   certificate had names "*.example.com"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

Here is the output from support.example.com.conf

# renew_before_expiry = 30 days
version = 0.22.2
archive_dir = /etc/letsencrypt/archive/support.example.com
cert = /etc/letsencrypt/live/support.example.com/cert.pem
privkey = /etc/letsencrypt/live/support.example.com/privkey.pem
chain = /etc/letsencrypt/live/support.example.com/chain.pem
fullchain = /etc/letsencrypt/live/support.example.com/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = apache
installer = apache
account = <ACCOUNT NUMBER>

As I understand, certbot is trying to renew with DNS-challenge whereas I used webroot (through the apache plugin) so it failes to succeed.

How can I make certbot to correctly use webroot challenge?

update:

When I perform certbot renew --dry-run it uses the correct http-01 challenge

Processing /etc/letsencrypt/renewal/support.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for support.example.com
Waiting for verification...
Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed with reload of apache server; fullchain is
/etc/letsencrypt/live/support.example.com/fullchain.pem

How is this possible?

update 2:

I've changed my let's encrypt renewal conf in order to use the correct webroot challenge.

# renew_before_expiry = 30 days
version = 0.22.2
archive_dir = /etc/letsencrypt/archive/support.example.com
cert = /etc/letsencrypt/live/support.example.com/cert.pem
privkey = /etc/letsencrypt/live/support.example.com/privkey.pem
chain = /etc/letsencrypt/live/support.example.com/chain.pem
fullchain = /etc/letsencrypt/live/support.example.com/fullchain.pem

[renewalparams]
post_hook = service apache2 start
installer = apache
account = a57eab015444b60984498d853e6c3531
authenticator = webroot
pre_hook = service apache2 stop
[[webroot_map]]
support.example.com = /var/www/support/

But performing renewal now I get the following error:

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer apache
Running pre-hook command: service apache2 stop
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for support.example.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (support.example.com) from /etc/letsencrypt/renewal/support.example.com.conf produced an unexpected error: Failed authorization procedure. support.example.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://support.example.com/.well-known/acme-challenge/VDmwSn8yXRbV2dFGe6dvsWelJBthNE33aoynDZ9i3qE: Connection refused. Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/support.example.com/fullchain.pem (failure)

I can reach http://support.example.com/.well-known/acme-challenge from outside so this could not be the problem in my opinion.

Answer 1

Okay, after many headscratching I figured it out. In my renewal conf I stated to stop apache... thus my site was down and let's encrypt was not able to connect hence the error.

Underneath the correct settings I can use to renew my certificate using webroot method (instead of apache plugin using tls-sni-01 which somehow does not function).

# renew_before_expiry = 30 days
version = 0.26.1
archive_dir = /etc/letsencrypt/archive/support.example.com
cert = /etc/letsencrypt/live/support.example.com/cert.pem
privkey = /etc/letsencrypt/live/support.example.com/privkey.pem
chain = /etc/letsencrypt/live/support.example.com/chain.pem
fullchain = /etc/letsencrypt/live/support.example.com/fullchain.pem


[renewalparams]
installer = apache
account = a57eab015444b60984498d853e6c3531
authenticator = webroot
server = https://acme-v02.api.letsencrypt.org/directory
[[webroot_map]]
support.example.com = /var/www/support/

edit:

For the sake of completion, here is also my virtualhost configuration to allow access to location ./well-known/acme-challenge and redirects all trafic to https except for this one location.

<VirtualHost *:80>
        ServerName support.example.com
        DocumentRoot /var/www/support/

<Location />
   Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
    Satisfy Any

 </Location>

        <Location /.well-known/acme-challenge/>
        DirectoryIndex index.html
        DirectoryIndex enabled
        Require all granted
        </Location>

RedirectMatch 301 ^(?!/\.well-known/acme-challenge/).* https://suppor.example.com$0
</VirtualHost>