1

I get this error if I run this command: certbot -q renew

Attempting to renew cert (example-master.com) from 
/etc/letsencrypt/renewal/example-master.com.conf produced an unexpected error:
Failed authorization procedure. www.example-sub.com (http-01):
urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: 
Invalid response from https://example-sub.com [2a01:488:42:1000:50ed:8233:4f:2092]:
"<!DOCTYPE html>...Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/example-master.com/fullchain.pem (failure)

The domain example-sub.com is old and does not get served from this server any more. It gets served from a different server today.

Unfortunately I can't find any config about this domain:

cd /etc
grep -r example-sub.com .
(no results)

Why does the renew command still tries to access the old host?

Improve this question

1 Answer 1

Reset to default
0

You can list the certs of this server with this command:

certbot certificates

Output:

Found the following certs:
    Domains: example-master.com example-sub.com
    Expiry Date: 2019-03-29 11:43:58+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/example-master.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/example-master.com/privkey.pem

The domain example-sub.com is still used. Unfortunately this plain string is not in the /etc directory. That's why grep does not find it.

If example-sub.com is still a part of example-master.com, then you need to delete the old example-master.com cert.

You can remove the old cert like this:

rm -rf /etc/letsencrypt/live/example-master.com
rm -rf /etc/letsencrypt/renewal/example-master.com.conf

Now create a new cert for example-master.com which does not contain the example-sub.com domain any more.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .