I'm using LetsEncrypt CA for SSL certificates with a cron job that renews them. Recently moved one of our domains to dual ipv4/ipv6 stack and now the certificate renewal fails for that domain:
Attempting to renew cert (nodrama.io) from /etc/letsencrypt/renewal/nodrama.io.conf produced an unexpected error: Failed authorization procedure.
www.nodrama.io (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization ::
Incorrect validation certificate for tls-sni-01 challenge.
Requested 1d2e60bbb911a0fa373af1c71068a98f.df68ccc953b03b03cbca639fa7b20469.acme.invalid from [2600:1f16:14a:7b00:e9ba:752c:feb8:49d5]:443.
Received 1 certificate(s), first certificate had names "5de1f81c71783962782726ac76156d00.51706d503a8be636f033680ff5a1664e.acme.invalid, dummy". Skipping.
If I remove the 443 over ipv6 from the nginx server configuration then the challenge goes through, cert is renewed. Bring it back and after that the content is availiable on ipv6 over https:
Connected to nodrama.io (2600:1f16:14a:7b00:e9ba:752c:feb8:49d5) port 443 (#0)
* found 592 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* server certificate verification OK
