0

I just got this email. However, I host many wabsites (not all of them on the same server). I guess that one of the server is using an old version on the certbot client, but I'm not sure which. I however have a list of all the domains I host. Is there a command available to know which of them is using the old validation method ?

For reference, here is the email I got from Let's Encrypt on my contact email:

Hello,

Action is required to prevent your Let's Encrypt certificate renewals from breaking.

Your Let’s Encrypt client used ACME TLS-SNI-01 domain validation to issue a certificate in the past 60 days.

TLS-SNI-01 validation is reaching end-of-life and will stop working on February 13th, 2019.

You need to update your ACME client to use an alternative validation method (HTTP-01, DNS-01 or TLS-ALPN-01) before this date or your certificate renewals will break and existing certificates will start to expire.

If you need help updating your ACME client, please open a new topic in the Help category of the Let's Encrypt community forum:

https://community.letsencrypt.org/c/help

Please answer all of the questions in the topic template so we can help you.

For more information about the TLS-SNI-01 end-of-life please see our API announcement:

https://community.letsencrypt.org/t/february-13-2019-end-of-life-for-all-tls-sni-01-validation-support/74209

Thank you, Let's Encrypt Staff

  • 1
    maybe the package ssl-cert-check (debian, ubuntu) could help – Max Jan 18 at 8:57
  • 1
    Just update certbot on all your servers. That should take about a minute. – Michael Hampton Jan 18 at 16:44
3

I received the same email. After reviewing the information in a post titled, "How to stop using TLS-SNI-01 with Certbot" in the help link, they provided this command to determine if you need to:

grep '^pref_challs.*tls-sni-01' /etc/letsencrypt/renewal/*

They also suggested you update Certbot before running the command.

1

I tested my domain name on this site: https://letsdebug.net/ (mentioned on the let's encrypt forum : https://community.letsencrypt.org/t/third-party-tools-to-check-your-configuration/76272). I tested these alternative methods of validation (HTTP-01, DNS-01 or TLS-ALPN-01) and all my domains are OK. You can already do this manipulation. Best regard.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.