Let’s Encrypt から上記のようなメールが来ました。
ここを参考に実施しましたが、NGだったので対応記録
【原因】DNS名は、Aレコードでつかってね
ここを参考にして、以下を実行したら怒られた原因が分かった。
$ sudo certbot certonly –apache -d bitool.***.*** -d bitool.***.***
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for bitool.***.***
Waiting for verification…
Challenge failed for domain bitool.aitake.net
http-01 challenge for bitool.***.***
Cleaning up challenges
Some challenges have failed.
IMPORTANT NOTES:
– The following errors were reported by the server:
Domain: bitool.***.***
Type: connection
Detail: 13.114.207.19: Fetching
http://bitool.***.***/.well-known/acme-challenge/Q6lc1yFBqpk5-6xlgHxbNZlAVguSXOsIHADKOxGR7Ps:
Connection refused
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you’re using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
【対応したこと】
DNSの登録がCNAMEで対応したのがまずかったようです。Aレコードに修正してOK
【結果】
$ sudo certbot certonly –apache -d bitool.****.*** -d bitool.****.***
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for bitool.****.***
Waiting for verification…
Cleaning up challenges
IMPORTANT NOTES:
– Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/bitool.****.***/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/bitool.****.***/privkey.pem
Your cert will expire on 2024-08-24. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
“certbot renew”
– If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
追加２：そもそも期限が切れていた
$ sudo certbot certonly –apache -d bitool.****.*** -d bitool.****.***
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Cert not yet due for renewal
You have an existing certificate that has exactly the same domains or certificate name you requested and isn’t close to expiry.
(ref: /etc/letsencrypt/renewal/bitool.****.***.conf)
What would you like to do?
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 2
Renewing an existing certificate
IMPORTANT NOTES:
– Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/bitool.****.***/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/bitool.****.***/privkey.pem
Your cert will expire on 2024-08-25. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
“certbot renew”
– If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
いつものShellもOK。
$ sudo certbot renew –pre-hook “service apache2 stop” –post-hook “service apache2 start”
Saving debug log to /var/log/letsencrypt/letsencrypt.log
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Processing /etc/letsencrypt/renewal/bitool.****.***.conf
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Cert not yet due for renewal
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
The following certs are not due for renewal yet:
/etc/letsencrypt/live/bitool.****.***/fullchain.pem expires on 2024-08-25 (skipped)
No renewals were attempted.
No hooks were run.
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –