Unable to renew certificates

[mjstealey]

Unable to renew certificates

[sadesarrollo]

Here you can see the content of my ./certs/renewal conf file:

# renew_before_expiry = 30 days
version = 0.33.1
archive_dir = /etc/letsencrypt/archive/staging.mydomain.es
cert = /etc/letsencrypt/live/staging.mydomain.es/cert.pem
privkey = /etc/letsencrypt/live/staging.mydomain.es/privkey.pem
chain = /etc/letsencrypt/live/staging.mydomain.es/chain.pem
fullchain = /etc/letsencrypt/live/staging.mydomain.es/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = webroot
account = 927948f4f23f575ce4f837843853e441
webroot_path = /data/letsencrypt,
server = https://acme-v02.api.letsencrypt.org/directory
[[webroot_map]]
staging.mydomain.es = /data/letsencrypt

[sadesarrollo]

I don't know if it could be a permission problem.. I tried giving 777 permission on my certs-data folder to no avail... please help.

[mjstealey]

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

The error being shown is due to a missing A-record for staging.mydomain.es (cannot be found in DNS). The site must be DNS resolvable for Certbot to issue or renew a certificate. Basically the URL https://staging.mydomain.es/.well-known/... is unreachable from the public internet, so Certbot cannot interact with the site to perform it's checks.

From a permissions point of view, all certificate related files should be owned by root and should not be moved around after generation. Certbot will use it's own versioning and symlinks to keep track of which certificates are valid for that period of time. Reference: https://certbot.eff.org/docs/using.html#where-are-my-certificates

[Richacinas]

Hi have the same problem. It is not about DNS.

The problem is that the file is not being placed on .../.well-known/acme-challenge

Shouldn't it exist there?

[mjstealey]

Have converted to using: https://github.com/RENCI-NRIG/ez-letsencrypt