Answers: <p>Changed the challenge from tls-sni to:</p>
  
  <blockquote>
    <p>--preferred-challenges http</p>
  </blockquote>
  
  <p>and the certificates are renewed.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-07-13T15:15:55.323Z
Answers: 2018-07-13T15:15:55.323Z
Answers: fbielejec
Body: <p>I'm using LetsEncrypt CA for SSL certificates with a cron job that renews them. Recently moved one of our domains to dual ipv4/ipv6 stack and now the certificate renewal fails for that domain:</p>
  
  <pre><code>Attempting to renew cert (nodrama.io) from /etc/letsencrypt/renewal/nodrama.io.conf produced an unexpected error: Failed authorization procedure.
  
  www.nodrama.io (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization ::
  
  Incorrect validation certificate for tls-sni-01 challenge.
  
  Requested 1d2e60bbb911a0fa373af1c71068a98f.df68ccc953b03b03cbca639fa7b20469.acme.invalid from [2600:1f16:14a:7b00:e9ba:752c:feb8:49d5]:443.
  
  Received 1 certificate(s), first certificate had names "5de1f81c71783962782726ac76156d00.51706d503a8be636f033680ff5a1664e.acme.invalid, dummy". Skipping.
  </code></pre>
  
  <p>If I remove the 443 over ipv6 from the nginx server configuration then the challenge goes through, cert is renewed. 
  Bring it back and after that the content is availiable on ipv6 over https:</p>
  
  <pre><code>Connected to nodrama.io (2600:1f16:14a:7b00:e9ba:752c:feb8:49d5) port 443 (#0)
  * found 592 certificates in /etc/ssl/certs
  * ALPN, offering http/1.1
  * SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
  * server certificate verification OK
  </code></pre>
  
Tags: <ssl><nginx><certbot>
Title: certbot renewal fails over ipv6
UserDisplayName: fbielejec
ThreadText: # certbot renewal fails over ipv6
  
  (Asked by: username_0 on 2018-07-12)
  
  I'm using LetsEncrypt CA for SSL certificates with a cron job that renews them. Recently moved one of our domains to dual ipv4/ipv6 stack and now the certificate renewal fails for that domain:
  
  ```
  Attempting to renew cert (nodrama.io) from /etc/letsencrypt/renewal/nodrama.io.conf produced an unexpected error: Failed authorization procedure.
  
  www.nodrama.io (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization ::
  
  Incorrect validation certificate for tls-sni-01 challenge.
  
  Requested 1d2e60bbb911a0fa373af1c71068a98f.df68ccc953b03b03cbca639fa7b20469.acme.invalid from [2600:1f16:14a:7b00:e9ba:752c:feb8:49d5]:443.
  
  Received 1 certificate(s), first certificate had names "5de1f81c71783962782726ac76156d00.51706d503a8be636f033680ff5a1664e.acme.invalid, dummy". Skipping.
  
  ```
  
  If I remove the 443 over ipv6 from the nginx server configuration then the challenge goes through, cert is renewed.
  Bring it back and after that the content is availiable on ipv6 over https:
  
  ```
  Connected to nodrama.io (2600:1f16:14a:7b00:e9ba:752c:feb8:49d5) port 443 (#0)
  * found 592 certificates in /etc/ssl/certs
  * ALPN, offering http/1.1
  * SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
  * server certificate verification OK
  
  ```
  
  **Tags:** ssl, nginx, certbot
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2018-07-13. Score: 1
  
  Changed the challenge from tls-sni to:
  
  > --preferred-challenges http
  
  and the certificates are renewed.
  
  
  ---
  
  