1

I'm using LetsEncrypt CA for SSL certificates with a cron job that renews them. Recently moved one of our domains to dual ipv4/ipv6 stack and now the certificate renewal fails for that domain:

Attempting to renew cert (nodrama.io) from /etc/letsencrypt/renewal/nodrama.io.conf produced an unexpected error: Failed authorization procedure.

www.nodrama.io (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization ::

Incorrect validation certificate for tls-sni-01 challenge.

Requested 1d2e60bbb911a0fa373af1c71068a98f.df68ccc953b03b03cbca639fa7b20469.acme.invalid from [2600:1f16:14a:7b00:e9ba:752c:feb8:49d5]:443.

Received 1 certificate(s), first certificate had names "5de1f81c71783962782726ac76156d00.51706d503a8be636f033680ff5a1664e.acme.invalid, dummy". Skipping.

If I remove the 443 over ipv6 from the nginx server configuration then the challenge goes through, cert is renewed. Bring it back and after that the content is availiable on ipv6 over https:

Connected to nodrama.io (2600:1f16:14a:7b00:e9ba:752c:feb8:49d5) port 443 (#0)
* found 592 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* server certificate verification OK
1

Changed the challenge from tls-sni to:

--preferred-challenges http

and the certificates are renewed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.