☰

Let's encrypt 确实会尝试续订旧域名

tag-icon • tag-icon lets-encrypt
Let's encrypt 确实会尝试续订旧域名

如果我运行以下命令，我会收到此错误：certbot -q renew

Attempting to renew cert (example-master.com) from 
/etc/letsencrypt/renewal/example-master.com.conf produced an unexpected error:
Failed authorization procedure. www.example-sub.com (http-01):
urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: 
Invalid response from https://example-sub.com [2a01:488:42:1000:50ed:8233:4f:2092]:
"<!DOCTYPE html>...Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/example-master.com/fullchain.pem (failure)

该域名example-sub.com已过时，不再由该服务器提供服务。目前由另一台服务器提供服务。

不幸的是我找不到有关此域的任何配置：

cd /etc
grep -r example-sub.com .
(no results)

为什么更新命令仍尝试访问旧主机？

答案1

您可以使用以下命令列出该服务器的证书：

certbot certificates

输出：

Found the following certs:
    Domains: example-master.com example-sub.com
    Expiry Date: 2019-03-29 11:43:58+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/example-master.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/example-master.com/privkey.pem

域名 example-sub.com 仍在使用。不幸的是，这个纯字符串不在 /etc 目录中。这就是为什么grep找不到它的原因。

如果 example-sub.com 仍然是 example-master.com 的一部分，那么您需要删除旧的 example-master.com 证书。

您可以像这样删除旧证书：

rm -rf /etc/letsencrypt/live/example-master.com
rm -rf /etc/letsencrypt/renewal/example-master.com.conf

现在为 example-master.com 创建一个新证书，其中不再包含 example-sub.com 域。

相关内容