0

I have a domain, let's say domain.com

This domain was registered with Go Daddy and using the Go Daddy dashboard, I point the domain to a certain IP, let's say 1.2.3.4

This IP, 1.2.3.4, belongs to a AWS EC2 instance.

The machine runs Ubuntu and serves the content I desire using nginx.

lsb_release -a

No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.2 LTS
Release:    16.04
Codename:   xenial

nginx -v

nginx version: nginx/1.10.3 (Ubuntu)

I set up my SSL certificates with Let's Encrypt using certbot. I did that by issuing the command sudo certbot --nginx

The certificate was generated and everything went very well for three months. My site was correctly served over https, with a valid certificate.

My certificate expired recently, so I attempted to renew. I issued this command first.

sudo certbot renew

The error was something like this:

Detail: Incorrect validation certificate for tls-sni-01 challenge. Requested 243e624c366db6a6f6aca6ac57f6f3cc.16fe65202571c102848dfa2b97afa875.acme.invalid from 1.2.3.4:443. Received 2 certificate(s), first certificate had names "domain.com"

WARNING:certbot.renewal:Attempting to renew cert (domain.com) from /etc/letsencrypt/renewal/domain.com.conf produced an unexpected error: Failed authorization procedure. domain.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 243e624c366db6a6f6aca6ac57f6f3cc.16fe65202571c102848dfa2b97afa875.acme.invalid from 1.2.3.4:443. Received 2 certificate(s), first certificate had names "domain.com". Skipping.

When I issued this command, the nginx server was still running. I stopped the server and tried again and also tried other variations on the command. I tried running sudo certbot renew again, sudo certbot --nginx again, I tried sudo certbot renew --agree-tos and others.

I was not aware of the rate limit Let's Encrypt imposes. The last time I tried I got the error:

Attempting to renew cert (domain.com) from /etc/letsencrypt/renewal/domain.com.conf produced an unexpected error: urn:acme:error:rateLimited :: There were too many requests of a given type :: Error creating new authz :: too many failed authorizations recently: see https://letsencrypt.org/docs/rate-limits/. Skipping.

After I get access again to Let's Encrypt, how should I solve this problem?


How do I renew my Let's Encrypt certificate for a nginx server running on a Ubuntu machine?

Why do I get Incorrect validation certificate for tls-sni-01 challenge?

Should I remove certbot and all certificates entirely and reinstall?

What approaches do you suggest for this problem?

Thanks!


Edit 2: Server Configuration

server {
    listen 80;
    server_name domain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name domain.com;

    location / {
        root /home/deploy/frontend/build;
        try_files $uri /index.html;
    }

ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem; # managed by Certbot
}

Edit 3:

This is the full error for certbot --nginx

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx

Which names would you like to activate HTTPS for?
-------------------------------------------------------------------------------
1: domain.com
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for domain.com
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. domain.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 8e2860a15c352af70bba07e265c4e05d.01f665a017c20bd5d2c25f1ec2110b6b.acme.invalid from 1.2.3.4:443. Received 2 certificate(s), first certificate had names "domain.com"

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: domain.com
   Type:   unauthorized
   Detail: Incorrect validation certificate for tls-sni-01 challenge.
   Requested
   8e2860a15c352af70bba07e265c4e05d.01f665a017c20bd5d2c25f1ec2110b6b.acme.invalid
   from 1.2.3.4:443. Received 2 certificate(s), first certificate
   had names "domain.com"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.
  • I'm pretty sure you can't renew an expired cert. – Rob Jan 28 '18 at 13:46
  • Ok. Do I create a new one? – mayk93 Jan 28 '18 at 13:50
  • What's your NGINX configuration look like? There are a multitude of issues that could be the culprit. – Daniel Cazares Jan 28 '18 at 13:59
  • Sorry, I should've been more clear. The configuration (most likely in conf.d) declaring your server block configuration. – Daniel Cazares Jan 28 '18 at 14:08
  • @DanielCazares I added the nginx configuration in the question body. I will try to remove all existing certificates and also reinstall certbot and try to see if I can get a certificate again. I am not entirely sure how Let's Encrypt works but isn't the certificate bound to them as oppose to the machine? If I can't renew the certificate and I can't issue a new one, what do I do? – mayk93 Jan 28 '18 at 14:09
1

Let’s Encrypt permanently disabled the TLS-SNI-01 challenge303 due to a security report, as of 2018-01-09.

you can use the command :

sudo certbot --authenticator standalone --installer nginx -d example.com --pre-hook “service nginx stop” --post-hook “service nginx start”

https://community.letsencrypt.org/t/solution-client-with-the-currently-selected-authenticator-does-not-support-any-combination-of-challenges-that-will-satisfy-the-ca/49983

0

The solution that I found was to use this command:

sudo certbot --authenticator webroot --installer nginx

What this does, essentially is to reissue the certificate. However, in my case, this was not enough. The check done for this approach involves hitting this url:

Failed authorization procedure. example.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://example.com/.well-known/acme-challenge/6OmVoBFxfKtjdAO1bgM9ylZw0d7U7MVC8KqyS6A2LfU: "<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,shr"

Note: I used domain.com as an example in my question but in the answer i am forced to use example.com

The way my nginx server was setup, http://example.com/ was not reachable, because I had return 301 https://$server_name$request_uri;

What I had to do was allow on http access to my webroot, /home/deploy/frontend/build get the certificate and revert the settings.

I hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.