背景
今天收到Let's Encrypt Expiry Bot邮件通知，说某个我设置好自动更新证书的域名的证书还有19天就要过期了。这究竟是为什么呢？
排查
登录到机器上手工尝试更新，发现产生了如下错误：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
/opt/eff.org/certbot/venv/bin/certbot renew --no-self-upgrade --post-hook "/bin/systemctl reload nginx.service" Saving debug log to /var/log/letsencrypt/letsencrypt.log ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/xx.xxxx.com.conf ------------------------------------------------------------------------------- Cert is due for renewal, auto-renewing... Plugins selected: Authenticator certbot-dns-dnspod:dns-dnspod, Installer None Renewing an existing certificate Attempting to renew cert (xx.xxxx.com) from /etc/letsencrypt/renewal/xx.xxxx.com.conf produced an unexpected error: urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Error creating new authz :: Validations for new domains are disabled in the V1 API (https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430). Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/xx.xxxx.com/fullchain.pem (failure) ------------------------------------------------------------------------------- All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/xx.xxxx.com/fullchain.pem (failure) ------------------------------------------------------------------------------- Running post-hook command: /bin/systemctl reload nginx.service 1 renew failure(s), 0 parse failure(s) |
所以关键信息看起来是letsencrypt不再支持V1的API更新了，而我的配置脚本里设置了使用v1的API。通过查看官方的说明，推荐使用系统自带的可以更新的certbot，而不是从官方下载的通用版certbot-auto。那这样问题解决就比较容易了。
处理
因为目标系统是centos 7，所以参照官网给出的说明进行处理即可。因为我使用了dnspod的dns验证，所以特别安装了一下这个pip包。
|
1 2 3 4 |
sudo yum install certbot python2-certbot-nginx pip install certbot_dns_dnspod /bin/certbot renew --post-hook "service nginx reload" |
最后更新一下crontab，问题解决。