CERTBOT renewal fails

[WLS-ITGuy]

Hello all,

I received notification that one of my certs was coming up for renewal and just to make sure I ran this:

[email protected]:~# sudo certbot renew
sudo: unable to resolve host SemMoodle
Saving debug log to /var/log/letsencrypt/letsencrypt.log

---

Processing /etc/letsencrypt/renewal/www.wls-online.net.conf

Cert is due for renewal, auto-renewing...
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for www.wls-online.net
Waiting for verification...
Cleaning up challenges
Attempting to renew cert from /etc/letsencrypt/renewal/www.wls-online.net.conf produced an unexpected error: Failed authorization procedure. www.wls-online.net (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: DNS problem: SERVFAIL looking up CAA for wls-online.net. Skipping.

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/www.wls-online.net/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: www.wls-online.net
  Type: connection
  Detail: DNS problem: SERVFAIL looking up CAA for wls-online.net

  To fix these errors, please make sure that your domain name was
  entered correctly and the DNS A record(s) for that domain
  contain(s) the right IP address. Additionally, please check that
  your computer has a publicly routable IP address and that no
  firewalls are preventing the server from communicating with the
  client. If you're using the webroot plugin, you should also verify
  that you are serving files from the webroot path you provided.

When I look at my DNS host I see that both wls-online.net and www.wls-online.net are pointed to the same IP and have DNS records. What am I missing as to why it is failing?

TIA,

Jeff

[Dashrender]

Who are you using for public DNS for your domain?

[JaredBusch]

How did you run certbot the first time?

[WLS-ITGuy]

@dashrender said in CERTBOT renewal fails:

Who are you using for public DNS for your domain?

GoDaddy has our domain but Linode has the DNS.

[WLS-ITGuy]

@jaredbusch said in CERTBOT renewal fails:

How did you run certbot the first time?

You mean the very first time? I can't remember what I did 5 minutes ago

[momurda]

I think youll find there is a problem with your dns for wls-online.net.
www.wls-online.net resolves correctly, but not wls-online.net

[WLS-ITGuy]

@momurda said in CERTBOT renewal fails:

I think youll find there is a problem with your dns for wls-online.net.
www.wls-online.net resolves correctly, but not wls-online.net

Fixed.

[momurda]

The issue or the dns lookup?
I think the issue is that you dont have a CAA DNS record, which as of a few days ago is required to get certs.

[WLS-ITGuy]

@momurda said in CERTBOT renewal fails:

The issue or the dns lookup?
I think the issue is that you dont have a CAA DNS record, which as of a few days ago is required to get certs.

Both actually. I had the DNS record entry backwards. I created a www.wls-online.net record and had a *.wls-online.net subdomain entered. I created a new DNS record and the renewal works now.

Jeff

[travisdh1]

@wls-itguy said in CERTBOT renewal fails:

@jaredbusch said in CERTBOT renewal fails:

How did you run certbot the first time?

You mean the very first time? I can't remember what I did 5 minutes ago

Documentation! I know it's a pain, and often takes 5x longer than actually doing anything, but it's so very needed.