ML
    • Register
    • Login
    • Search
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups

    CERTBOT renewal fails

    IT Discussion
    5
    10
    1234
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • WLS-ITGuy
      WLS-ITGuy last edited by

      Hello all,

      I received notification that one of my certs was coming up for renewal and just to make sure I ran this:

      [email protected]:~# sudo certbot renew
      sudo: unable to resolve host SemMoodle
      Saving debug log to /var/log/letsencrypt/letsencrypt.log


      Processing /etc/letsencrypt/renewal/www.wls-online.net.conf

      Cert is due for renewal, auto-renewing...
      Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
      Renewing an existing certificate
      Performing the following challenges:
      tls-sni-01 challenge for www.wls-online.net
      Waiting for verification...
      Cleaning up challenges
      Attempting to renew cert from /etc/letsencrypt/renewal/www.wls-online.net.conf produced an unexpected error: Failed authorization procedure. www.wls-online.net (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: DNS problem: SERVFAIL looking up CAA for wls-online.net. Skipping.

      All renewal attempts failed. The following certs could not be renewed:
      /etc/letsencrypt/live/www.wls-online.net/fullchain.pem (failure)
      1 renew failure(s), 0 parse failure(s)

      IMPORTANT NOTES:

      • The following errors were reported by the server:

        Domain: www.wls-online.net
        Type: connection
        Detail: DNS problem: SERVFAIL looking up CAA for wls-online.net

        To fix these errors, please make sure that your domain name was
        entered correctly and the DNS A record(s) for that domain
        contain(s) the right IP address. Additionally, please check that
        your computer has a publicly routable IP address and that no
        firewalls are preventing the server from communicating with the
        client. If you're using the webroot plugin, you should also verify
        that you are serving files from the webroot path you provided.

      When I look at my DNS host I see that both wls-online.net and www.wls-online.net are pointed to the same IP and have DNS records. What am I missing as to why it is failing?

      TIA,

      Jeff

      1 Reply Last reply Reply Quote 1
      • Dashrender
        Dashrender last edited by

        Who are you using for public DNS for your domain?

        WLS-ITGuy 1 Reply Last reply Reply Quote 0
        • JaredBusch
          JaredBusch last edited by

          How did you run certbot the first time?

          WLS-ITGuy 1 Reply Last reply Reply Quote 0
          • WLS-ITGuy
            WLS-ITGuy @Dashrender last edited by

            @dashrender said in CERTBOT renewal fails:

            Who are you using for public DNS for your domain?

            GoDaddy has our domain but Linode has the DNS.

            1 Reply Last reply Reply Quote 0
            • WLS-ITGuy
              WLS-ITGuy @JaredBusch last edited by

              @jaredbusch said in CERTBOT renewal fails:

              How did you run certbot the first time?

              You mean the very first time? I can't remember what I did 5 minutes ago 🙂

              travisdh1 1 Reply Last reply Reply Quote 0
              • momurda
                momurda last edited by

                I think youll find there is a problem with your dns for wls-online.net.
                www.wls-online.net resolves correctly, but not wls-online.net
                0_1506964698086_af7c11e4-c4ad-41ea-bb92-ad8e5f14ecae-image.png

                WLS-ITGuy 1 Reply Last reply Reply Quote 1
                • WLS-ITGuy
                  WLS-ITGuy @momurda last edited by

                  @momurda said in CERTBOT renewal fails:

                  I think youll find there is a problem with your dns for wls-online.net.
                  www.wls-online.net resolves correctly, but not wls-online.net
                  0_1506964698086_af7c11e4-c4ad-41ea-bb92-ad8e5f14ecae-image.png

                  Fixed.

                  1 Reply Last reply Reply Quote 0
                  • momurda
                    momurda last edited by

                    The issue or the dns lookup?
                    I think the issue is that you dont have a CAA DNS record, which as of a few days ago is required to get certs.

                    WLS-ITGuy 1 Reply Last reply Reply Quote 0
                    • WLS-ITGuy
                      WLS-ITGuy @momurda last edited by

                      @momurda said in CERTBOT renewal fails:

                      The issue or the dns lookup?
                      I think the issue is that you dont have a CAA DNS record, which as of a few days ago is required to get certs.

                      Both actually. I had the DNS record entry backwards. I created a www.wls-online.net record and had a *.wls-online.net subdomain entered. I created a new DNS record and the renewal works now.

                      Jeff

                      1 Reply Last reply Reply Quote 0
                      • travisdh1
                        travisdh1 @WLS-ITGuy last edited by

                        @wls-itguy said in CERTBOT renewal fails:

                        @jaredbusch said in CERTBOT renewal fails:

                        How did you run certbot the first time?

                        You mean the very first time? I can't remember what I did 5 minutes ago 🙂

                        Documentation! I know it's a pain, and often takes 5x longer than actually doing anything, but it's so very needed.

                        1 Reply Last reply Reply Quote 1
                        • First post
                          Last post