Problem starting over with renewal

[Phydeauxman]

Problem starting over with renewal

[ebekker]

Unfortunately, once an Identifier is marked invalid, that particular instance can't be revived (this is a limitation of LE and the ACME protocol), as you discovered. You need to create a new Identifier (starting with the New-ACMEIdentifier step in your code).

The reason you're getting an error about the same key already being added is that you're reusing the same Alias parameter, which is essentially a unique ID for the Identifier. You should come up with a scheme to compute a unique alias (since you'll need to do this every 3 months anyway), so based on your code, something like...

$AliasDns = "certificateAlias-$([datetime]::Now.ToString("yyyyMMdd-HHmm"))"
New-ACMEIdentifier -Dns $domain -Alias $AliasDns

Would give you unique aliases each time this code is run. So to address your original issue, pby want to stop after the call to Complete-ACMEChallenge and validate the response is correct.

NOTE, if you still have the response from the previous challenge, you can still validate it was correct, because the challenge response file should still be where it was placed.

[Phydeauxman]

@ebekker thanks for the great info. I think I still have everything from the first try...can you give me some detail on how to validate the response?