2

I'm trying to renew my certificate that is due to expire. I used the apache plugin for certbot like this: sudo certbot --apache -d support.example.com.

However, when I try to renew it now it uses tls-sni-01 challlenge and thus failes to authenticate:

Processing /etc/letsencrypt/renewal/support.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for support.example.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (support.example.com) from /etc/letsencrypt/renewal/support.example.com.conf produced an unexpected error: Failed authorization procedure. support.example.com (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 1ab20abd9ac656e814998274e38cd6e1.cfffa3659f04d5bb0c041a9fef293f9d.acme.invalid from <EXTERNAL IP-ADDRESS:443>. Received 2 certificate(s), first certificate had names "*.example.com". Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/support.example.com/fullchain.pem (failure)

And

 - The following errors were reported by the server:

   Domain: support.example.com
   Type:   unauthorized
   Detail: Incorrect validation certificate for tls-sni-01 challenge.
   Requested
   1ab20abd9ac656e814998274e38cd6e1.cfffa3659f04d5bb0c041a9fef293f9d.acme.invalid
   from <EXTERNAL IP-ADDRESS:443. Received 2 certificate(s), first
   certificate had names "*.example.com"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

Here is the output from support.example.com.conf

# renew_before_expiry = 30 days
version = 0.22.2
archive_dir = /etc/letsencrypt/archive/support.example.com
cert = /etc/letsencrypt/live/support.example.com/cert.pem
privkey = /etc/letsencrypt/live/support.example.com/privkey.pem
chain = /etc/letsencrypt/live/support.example.com/chain.pem
fullchain = /etc/letsencrypt/live/support.example.com/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = apache
installer = apache
account = <ACCOUNT NUMBER>

As I understand, certbot is trying to renew with DNS-challenge whereas I used webroot (through the apache plugin) so it failes to succeed.

How can I make certbot to correctly use webroot challenge?

update:

When I perform certbot renew --dry-run it uses the correct http-01 challenge

Processing /etc/letsencrypt/renewal/support.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for support.example.com
Waiting for verification...
Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed with reload of apache server; fullchain is
/etc/letsencrypt/live/support.example.com/fullchain.pem

How is this possible?

update 2:

I've changed my let's encrypt renewal conf in order to use the correct webroot challenge. 

# renew_before_expiry = 30 days
version = 0.22.2
archive_dir = /etc/letsencrypt/archive/support.example.com
cert = /etc/letsencrypt/live/support.example.com/cert.pem
privkey = /etc/letsencrypt/live/support.example.com/privkey.pem
chain = /etc/letsencrypt/live/support.example.com/chain.pem
fullchain = /etc/letsencrypt/live/support.example.com/fullchain.pem

[renewalparams]
post_hook = service apache2 start
installer = apache
account = a57eab015444b60984498d853e6c3531
authenticator = webroot
pre_hook = service apache2 stop
[[webroot_map]]
support.example.com = /var/www/support/

But performing renewal now I get the following error:

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer apache
Running pre-hook command: service apache2 stop
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for support.example.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (support.example.com) from /etc/letsencrypt/renewal/support.example.com.conf produced an unexpected error: Failed authorization procedure. support.example.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://support.example.com/.well-known/acme-challenge/VDmwSn8yXRbV2dFGe6dvsWelJBthNE33aoynDZ9i3qE: Connection refused. Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/support.example.com/fullchain.pem (failure)

I can reach http://support.example.com/.well-known/acme-challenge from outside so this could not be the problem in my opinion.

|improve this question
  • That challenge is NOT dns: "create a self-signed certificate with a specific, invalid hostname, and the domain name's web server is validated to serve that certificate. The ACME server then looks up the domain name's IP addresses, initializes a TLS connection, and sends the invalid hostname to the SNI extension. If the response is a self-signed certificate which contains the hostname, the client is considered to be in control of the domain name and is therefore permitted to issue certificates for it." zdnet.com/article/lets-encrypt-disables-tls-sni-01-validation – Stephen Ostermiller♦ Aug 6 '18 at 10:17
  • Have you tried using the --webroot command line option as documented here: certbot.eff.org/docs/using.html#webroot – Stephen Ostermiller♦ Aug 6 '18 at 10:19
  • Thanks for your comment. I've updated my post; when I perform a dry run it does use the correct http-01 challenge. How is that possible? – wouter205 Aug 6 '18 at 10:49
  • Certbot has a lot of functionality and options. I run it in --standalone mode and specify the webroot directory as a command line option because I don't want it messing with my Apache configuration or automatically restarting my server. In my opinion the options for trying to work automatically with the different specific servers shouldn't be implemented. They are unlikely to work all the time and they are very likely to break somebody's web server. I recommend not using them. – Stephen Ostermiller♦ Aug 6 '18 at 12:03
  • I've changed my let'sencrypt conf (see update in post). I also encountered problems with my Apache configuration: it redirected all traffic to https. Now I've implemented an exception for location '.well-known/acme-challenge'. It does use the correct http-01 challenge, but now with a different error. See update also – wouter205 Aug 6 '18 at 14:10
2

Okay, after many headscratching I figured it out. In my renewal conf I stated to stop apache... thus my site was down and let's encrypt was not able to connect hence the error.

Underneath the correct settings I can use to renew my certificate using webroot method (instead of apache plugin using tls-sni-01 which somehow does not function).

# renew_before_expiry = 30 days
version = 0.26.1
archive_dir = /etc/letsencrypt/archive/support.example.com
cert = /etc/letsencrypt/live/support.example.com/cert.pem
privkey = /etc/letsencrypt/live/support.example.com/privkey.pem
chain = /etc/letsencrypt/live/support.example.com/chain.pem
fullchain = /etc/letsencrypt/live/support.example.com/fullchain.pem


[renewalparams]
installer = apache
account = a57eab015444b60984498d853e6c3531
authenticator = webroot
server = https://acme-v02.api.letsencrypt.org/directory
[[webroot_map]]
support.example.com = /var/www/support/

edit:

For the sake of completion, here is also my virtualhost configuration to allow access to location ./well-known/acme-challenge and redirects all trafic to https except for this one location.

<VirtualHost *:80>
        ServerName support.example.com
        DocumentRoot /var/www/support/

<Location />
   Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
    Satisfy Any

 </Location>

        <Location /.well-known/acme-challenge/>
        DirectoryIndex index.html
        DirectoryIndex enabled
        Require all granted
        </Location>

RedirectMatch 301 ^(?!/\.well-known/acme-challenge/).* https://suppor.example.com$0
</VirtualHost>
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.