解决letsencrypt出现Error creating new authz :: Validations for new domains are disabled in the V1 API问题

背景

今天收到Let's Encrypt Expiry Bot邮件通知，说某个我设置好自动更新证书的域名的证书还有19天就要过期了。这究竟是为什么呢？

排查

登录到机器上手工尝试更新，发现产生了如下错误：

/opt/eff.org/certbot/venv/bin/certbot renew --no-self-upgrade --post-hook "/bin/systemctl reload  nginx.service"
Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/xx.xxxx.com.conf
-------------------------------------------------------------------------------
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator certbot-dns-dnspod:dns-dnspod, Installer None
Renewing an existing certificate
Attempting to renew cert (xx.xxxx.com) from /etc/letsencrypt/renewal/xx.xxxx.com.conf produced an unexpected error: urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Error creating new authz :: Validations for new domains are disabled in the V1 API (https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430). Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/xx.xxxx.com/fullchain.pem (failure)

-------------------------------------------------------------------------------

All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/xx.xxxx.com/fullchain.pem (failure)
-------------------------------------------------------------------------------
Running post-hook command: /bin/systemctl reload  nginx.service
1 renew failure(s), 0 parse failure(s)

/opt/eff.org/certbot/venv/bin/certbot renew --no-self-upgrade --post-hook "/bin/systemctl reload nginx.service"

Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------

Processing /etc/letsencrypt/renewal/xx.xxxx.com.conf

-------------------------------------------------------------------------------

Cert is due for renewal, auto-renewing...

Plugins selected: Authenticator certbot-dns-dnspod:dns-dnspod, Installer None

Renewing an existing certificate

Attempting to renew cert (xx.xxxx.com) from /etc/letsencrypt/renewal/xx.xxxx.com.conf produced an unexpected error: urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Error creating new authz :: Validations for new domains are disabled in the V1 API (https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430). Skipping.

All renewal attempts failed. The following certs could not be renewed:

/etc/letsencrypt/live/xx.xxxx.com/fullchain.pem (failure)

-------------------------------------------------------------------------------

All renewal attempts failed. The following certs could not be renewed:

/etc/letsencrypt/live/xx.xxxx.com/fullchain.pem (failure)

-------------------------------------------------------------------------------

Running post-hook command: /bin/systemctl reload nginx.service

1 renew failure(s), 0 parse failure(s)

所以关键信息看起来是letsencrypt不再支持V1的API更新了，而我的配置脚本里设置了使用v1的API。通过查看官方的说明，推荐使用系统自带的可以更新的certbot，而不是从官方下载的通用版certbot-auto。那这样问题解决就比较容易了。

处理

因为目标系统是centos 7，所以参照官网给出的说明进行处理即可。因为我使用了dnspod的dns验证，所以特别安装了一下这个pip包。

sudo yum install certbot python2-certbot-nginx
pip install certbot_dns_dnspod
/bin/certbot renew --post-hook "service nginx reload"

sudo yum install certbot python2-certbot-nginx

pip install certbot_dns_dnspod

/bin/certbot renew --post-hook "service nginx reload"

最后更新一下crontab，问题解决。