<![CDATA[Certs won't renew - HELP]]>One of our (paid) Cloud instances is refusing to update certs. Starting a couple of days ago. A manual refresh gets a lot of errors on the log. The client cannot log in - this is a big deal.
Where do I start?
filled with lines like this:
Dec 28 13:27:10 box:cert/acme2 sendSignedRequest: using nonce GJdccAF6CFXCywo_pgyPU5yKhGI7gls_ftlnroNQuIRwVCm8sb4 for url https://acme-v02.api.letsencrypt.org/acme/chall/1970589977/451963773075/ZgIswA
Dec 28 13:27:10 box:cert/acme2 waitForChallenge: status is "invalid" "{"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/1970589977/451963773075/ZgIswA","status":"invalid","validated":"2024-12-28T19:23:46Z","error":{"type":"urn:ietf:params:acme:error:unauthorized","detail":"Incorrect TXT record "dU24qPdE0kcVPGtd9z6Bf1KVFhUdUsO4QBFQPIpuXFc" found at _acme-challenge.fpiw-content.media","status":403},"token":"dDgFIftTVmWxvJ7vUeVLq-iux1rxrN_1-cw8SxaXWyU"}"
Dec 28 13:27:10 box:cert/acme2 Attempt 11 failed. Will retry: Unexpected status when waiting for challenge: invalid

]]>https://forum.cloudron.io/topic/13025/certs-won-t-renew-helpRSS for NodeWed, 16 Sep 2026 01:06:32 GMTSat, 28 Dec 2024 19:37:43 GMT60<![CDATA[Reply to Certs won't renew - HELP on Wed, 01 Jan 2025 17:23:33 GMT]]>Who uses gd????

]]>https://forum.cloudron.io/post/99208https://forum.cloudron.io/post/99208Wed, 01 Jan 2025 17:23:33 GMT<![CDATA[Reply to Certs won't renew - HELP on Wed, 01 Jan 2025 16:31:08 GMT]]>Unfortunately, we have lost the ability to test GoDaddy since they disabled API use for all customers having < 10 domains or something. See also https://www.reddit.com/r/godaddy/comments/1chs1j8/godaddy_access_denied_via_apicall/ . If anyone can reproduce this and can give us a test set up, happy to debug further.

]]>https://forum.cloudron.io/post/99205https://forum.cloudron.io/post/99205Wed, 01 Jan 2025 16:31:08 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 19:45:55 GMT]]>So we have looked into this and it appears that LetsEncrypt does not see the TXT records (reporting a NXDOMAN) for those when directly talking to the GoDaddy nameservers. We have set the DNS backend to manual to fallback to the HTTP acme flow. That way the certs were refreshed fine.

Lets see if other GoDaddy users also face this, or if this is just a hiccup for those associated nameservers.

]]>https://forum.cloudron.io/post/99106https://forum.cloudron.io/post/99106Mon, 30 Dec 2024 19:45:55 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 19:26:46 GMT]]>@stevespaw testing.

]]>https://forum.cloudron.io/post/99102https://forum.cloudron.io/post/99102Mon, 30 Dec 2024 19:26:46 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 19:24:26 GMT]]>Yes it is possible to migrate to another Cloudron, but what's to say that the SSL will work on a different cloudron to the same domain that is having issues?

]]>https://forum.cloudron.io/post/99100https://forum.cloudron.io/post/99100Mon, 30 Dec 2024 19:24:26 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 19:00:34 GMT]]>@stevespaw they'll still work, just on a different cloudron, right?

Containers for a reason.

]]>https://forum.cloudron.io/post/99093https://forum.cloudron.io/post/99093Mon, 30 Dec 2024 19:00:34 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 18:43:00 GMT]]>Ouch this is bad news. We have custom apps that directly work with API's in these cloudron apps.

]]>https://forum.cloudron.io/post/99092https://forum.cloudron.io/post/99092Mon, 30 Dec 2024 18:43:00 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 18:34:51 GMT]]>Ugh, then it might be best to migrate the domain and app to a working Cloudron for your customer until this system can be fixed up.

This is more of a @girish specialty and he's on vacay for a bit

]]>https://forum.cloudron.io/post/99090https://forum.cloudron.io/post/99090Mon, 30 Dec 2024 18:34:51 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 18:31:26 GMT]]>yes.. I tried that 2 days ago when this started happening.

]]>https://forum.cloudron.io/post/99088https://forum.cloudron.io/post/99088Mon, 30 Dec 2024 18:31:26 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 18:24:04 GMT]]>Ok, so it's Cloudron specific, have you tried rebooting for any updates that may be needed?

]]>https://forum.cloudron.io/post/99084https://forum.cloudron.io/post/99084Mon, 30 Dec 2024 18:24:04 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 18:07:32 GMT]]>Yes we have all of our Cloudrons DNS automated - We have quite a few paid instances. This one instance is failing the automated renewal. That is the issue.

]]>https://forum.cloudron.io/post/99083https://forum.cloudron.io/post/99083Mon, 30 Dec 2024 18:07:32 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 18:01:05 GMT]]>@stevespaw Cloudron.. as idk how you set up your DNS. Most folks here choose to have it automated by Cloudron.

For example, if you configure GoDaddy to use CloudFlare for DNS, then you can have Cloudron effortlessly auto manage DNS entries via Cloudflare integration.

]]>https://forum.cloudron.io/post/99082https://forum.cloudron.io/post/99082Mon, 30 Dec 2024 18:01:05 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 17:53:48 GMT]]>

If you set up a new sub domain, do the certs work ok?

within GoDaddy or a new app in Cloudron?

BTW even the main "my.xyz.com" is also failing. Currently 4 apps installed in Cloudron.

]]>https://forum.cloudron.io/post/99081https://forum.cloudron.io/post/99081Mon, 30 Dec 2024 17:53:48 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 17:44:43 GMT]]>If you set up a new sub domain, do the certs work ok?

If so, then you can move the app from its current sub/domain to another temporary one. Validate it all works. Then move it back for a fresh set of certs.

]]>https://forum.cloudron.io/post/99079https://forum.cloudron.io/post/99079Mon, 30 Dec 2024 17:44:43 GMT<![CDATA[Reply to Certs won't renew - HELP on Mon, 30 Dec 2024 17:40:03 GMT]]>OK I have access to the GoDaddy account _ have deleted the TXT record and restarted - I keep seeing the TXT record change, buy I get errors that they don't match. This is now a big issue I need to solve, but I am not very knowledgeable on LetsEncrypt. Where do I go from here?

]]>https://forum.cloudron.io/post/99078https://forum.cloudron.io/post/99078Mon, 30 Dec 2024 17:40:03 GMT<![CDATA[Reply to Certs won't renew - HELP on Sat, 28 Dec 2024 20:34:40 GMT]]>@stevespaw said in Certs won't renew - HELP:

No not yet - I have no idea how that would have happened. I currently do not have direct access to DNS records.

I assume this entry wasn't cleared properly after the last certificate was issued and is now preventing you from getting a new one

]]>https://forum.cloudron.io/post/99001https://forum.cloudron.io/post/99001Sat, 28 Dec 2024 20:34:40 GMT<![CDATA[Reply to Certs won't renew - HELP on Sat, 28 Dec 2024 20:31:07 GMT]]>No not yet - I have no idea how that would have happened. I currently do not have direct access to DNS records.

]]>https://forum.cloudron.io/post/98999https://forum.cloudron.io/post/98999Sat, 28 Dec 2024 20:31:07 GMT<![CDATA[Reply to Certs won't renew - HELP on Sat, 28 Dec 2024 20:27:15 GMT]]>@stevespaw Have you tried deleting this txt entry and reissuing the certificate?

]]>https://forum.cloudron.io/post/98998https://forum.cloudron.io/post/98998Sat, 28 Dec 2024 20:27:15 GMT<![CDATA[Reply to Certs won't renew - HELP on Sat, 28 Dec 2024 20:22:45 GMT]]>Nothing has changed from the initial install which went just fine several months ago - this just appeared.

]]>https://forum.cloudron.io/post/98996https://forum.cloudron.io/post/98996Sat, 28 Dec 2024 20:22:45 GMT<![CDATA[Reply to Certs won't renew - HELP on Sat, 28 Dec 2024 20:08:48 GMT]]>@stevespaw said in Certs won't renew - HELP:

Dec 28 13:27:10 box:cert/acme2 waitForChallenge: status is "invalid" "{"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/1970589977/451963773075/ZgIswA","status":"invalid","validated":"2024-12-28T19:23:46Z","error":{"type":"urn:ietf:params:acme:error:unauthorized","detail":"Incorrect TXT record "dU24qPdE0kcVPGtd9z6Bf1KVFhUdUsO4QBFQPIpuXFc" found at _acme-challenge.fpiw-content.media","status":403},"token":"dDgFIftTVmWxvJ7vUeVLq-iux1rxrN_1-cw8SxaXWyU"}"
Dec 28 13:27:10 box:cert/acme2 Attempt 11 failed. Will retry: Unexpected status when waiting for challenge: invalid

Not an expert when it comes to SSL but it looks like it's refusing to issue a new certificate because there is a text record DNS entry at _acme-challenge.fpiw-content.media? Not sure why that would be an issue but a quick DNS check does yield a result there. Did you try deleting this entry and reissue?

]]>https://forum.cloudron.io/post/98995https://forum.cloudron.io/post/98995Sat, 28 Dec 2024 20:08:48 GMT