{"action":"created","issue":{"url":"https://api.github.com/repos/certbot/certbot/issues/6158","repository_url":"https://api.github.com/repos/certbot/certbot","labels_url":"https://api.github.com/repos/certbot/certbot/issues/6158/labels{/name}","comments_url":"https://api.github.com/repos/certbot/certbot/issues/6158/comments","events_url":"https://api.github.com/repos/certbot/certbot/issues/6158/events","html_url":"https://github.com/certbot/certbot/issues/6158","id":336675667,"node_id":"MDU6SXNzdWUzMzY2NzU2Njc=","number":6158,"title":"Received 2 certificate(s), first certificate had names \"1a.domain1.com\". Skipping.","user":{"login":"TimoCrafter","id":18309528,"node_id":"MDQ6VXNlcjE4MzA5NTI4","avatar_url":"https://avatars3.githubusercontent.com/u/18309528?v=4","gravatar_id":"","url":"https://api.github.com/users/TimoCrafter","html_url":"https://github.com/TimoCrafter","followers_url":"https://api.github.com/users/TimoCrafter/followers","following_url":"https://api.github.com/users/TimoCrafter/following{/other_user}","gists_url":"https://api.github.com/users/TimoCrafter/gists{/gist_id}","starred_url":"https://api.github.com/users/TimoCrafter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TimoCrafter/subscriptions","organizations_url":"https://api.github.com/users/TimoCrafter/orgs","repos_url":"https://api.github.com/users/TimoCrafter/repos","events_url":"https://api.github.com/users/TimoCrafter/events{/privacy}","received_events_url":"https://api.github.com/users/TimoCrafter/received_events","type":"User","site_admin":false},"labels":[{"id":258836903,"node_id":"MDU6TGFiZWwyNTg4MzY5MDM=","url":"https://api.github.com/repos/certbot/certbot/labels/area:%20apache","name":"area: apache","color":"c5def5","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-06-28T15:40:34Z","updated_at":"2018-06-29T13:21:49Z","closed_at":null,"author_association":"NONE","body":"If you're having trouble using Certbot and aren't sure you've found a bug or\r\nrequest for a new feature, please first try asking for help at\r\nhttps://community.letsencrypt.org/. There is a much larger community there of\r\npeople familiar with the project who will be able to more quickly answer your\r\nquestions.\r\n\r\n## My operating system is (include version):\r\nUbuntu 16.04\r\n\r\n## I installed Certbot with (certbot-auto, OS package manager, pip, etc):\r\napt install certbot\r\n\r\n## I ran this command and it produced this output:\r\n```\r\n~# certbot renew\r\nSaving debug log to /var/log/letsencrypt/letsencrypt.log\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/impressum.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert not yet due for renewal\r\nPlugins selected: Authenticator standalone, Installer apache\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/domain2.com.conf\r\n-------------------------------------------------------------------------------\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator apache, Installer apache\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for domain2.com\r\ntls-sni-01 challenge for www.domain2.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nAttempting to renew cert (domain2.com) from /etc/letsencrypt/renewal/domain2.com.conf produced an unexpected error: Failed authorization procedure. domain2.com (tls-sni-01): urn:acme:error:tls :: The server experienced a TLS error during domain verification :: remote error: tls: handshake failure, www.domain2.com (tls-sni-01): urn:acme:error:tls :: The server experienced a TLS error during domain verification :: remote error: tls: handshake failure. Skipping.\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/javadoc.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert not yet due for renewal\r\nPlugins selected: Authenticator standalone, Installer apache\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/pfa.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert not yet due for renewal\r\nPlugins selected: Authenticator apache, Installer apache\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/growth.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert not yet due for renewal\r\nPlugins selected: Authenticator apache, Installer None\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/1a.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert not yet due for renewal\r\nPlugins selected: Authenticator apache, Installer apache\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/mail.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator apache, Installer apache\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for mail.domain1.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nAttempting to renew cert (mail.domain1.com) from /etc/letsencrypt/renewal/mail.domain1.com.conf produced an unexpected error: Failed authorization procedure. mail.domain1.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested e95169bcec0a861f1456af7870c94e48.71bcd14ae6c73bad8c9a3d525034da55.acme.invalid from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first certificate had names \"1a.domain1.com\". Skipping.\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/tickets.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator apache, Installer apache\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for tickets.domain1.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nAttempting to renew cert (tickets.domain1.com) from /etc/letsencrypt/renewal/tickets.domain1.com.conf produced an unexpected error: Failed authorization procedure. tickets.domain1.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 01a2dbf4052a1a289e16fb2ad8e331c0.c82dc079f1712e9b68ff602a7d5f58d9.acme.invalid from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first certificate had names \"1a.domain1.com\". Skipping.\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/domain1.com-0001.conf\r\n-------------------------------------------------------------------------------\r\nCert not yet due for renewal\r\nCould not choose appropriate plugin for updaters: The manual plugin is not working; there may be problems with your existing configuration.\r\nThe error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',)\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/paste.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator apache, Installer apache\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for paste.domain1.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nAttempting to renew cert (paste.domain1.com) from /etc/letsencrypt/renewal/paste.domain1.com.conf produced an unexpected error: Failed authorization procedure. paste.domain1.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 958c94f3f2e1dbcf20f787e928acfafe.d46588d85513b5df0b631bee4ce66120.acme.invalid from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first certificate had names \"1a.domain1.com\". Skipping.\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/jenkins.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator apache, Installer None\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for jenkins.domain1.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nAttempting to renew cert (jenkins.domain1.com) from /etc/letsencrypt/renewal/jenkins.domain1.com.conf produced an unexpected error: Failed authorization procedure. jenkins.domain1.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 9f5658a3c65f1dc26849cbca1c10a313.645b9bed1a60f096b7f524aa68051c03.acme.invalid from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first certificate had names \"1a.domain1.com\". Skipping.\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/miriam.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert not yet due for renewal\r\nPlugins selected: Authenticator apache, Installer None\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/api.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator apache, Installer apache\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for api.domain1.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nAttempting to renew cert (api.domain1.com) from /etc/letsencrypt/renewal/api.domain1.com.conf produced an unexpected error: Failed authorization procedure. api.domain1.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 710658a41dea0453da124fb6481c34b2.c8acdbf6bd759d0fe20072a69dd4c1f6.acme.invalid from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first certificate had names \"1a.domain1.com\". Skipping.\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/privacy.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert not yet due for renewal\r\nPlugins selected: Authenticator apache, Installer None\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert not yet due for renewal\r\nPlugins selected: Authenticator apache, Installer apache\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/cloud.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator apache, Installer apache\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for cloud.domain1.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nAttempting to renew cert (cloud.domain1.com) from /etc/letsencrypt/renewal/cloud.domain1.com.conf produced an unexpected error: Failed authorization procedure. cloud.domain1.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 70da42a2b1262ec1dcf33707cbb00cb6.3589435c22cadab95078f60c10da5e3b.acme.invalid from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first certificate had names \"1a.domain1.com\". Skipping.\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/maven.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator apache, Installer None\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for maven.domain1.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nAttempting to renew cert (maven.domain1.com) from /etc/letsencrypt/renewal/maven.domain1.com.conf produced an unexpected error: Failed authorization procedure. maven.domain1.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 7aa6ee8198ae2ce93a31767d66959b23.295978166ae542ee81fcc72e9d4efbec.acme.invalid from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first certificate had names \"1a.domain1.com\". Skipping.\r\n\r\n-------------------------------------------------------------------------------\r\nProcessing /etc/letsencrypt/renewal/images.domain1.com.conf\r\n-------------------------------------------------------------------------------\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator apache, Installer apache\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for images.domain1.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nAttempting to renew cert (images.domain1.com) from /etc/letsencrypt/renewal/images.domain1.com.conf produced an unexpected error: Failed authorization procedure. images.domain1.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 5ccca1724434320d71f8665888521858.a54d12872feec31b1d7d9000c1b98935.acme.invalid from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first certificate had names \"1a.domain1.com\". Skipping.\r\nAll renewal attempts failed. The following certs could not be renewed:\r\n  /etc/letsencrypt/live/domain2.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/mail.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/tickets.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/paste.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/jenkins.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/api.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/cloud.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/maven.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/images.domain1.com/fullchain.pem (failure)\r\n\r\n-------------------------------------------------------------------------------\r\n\r\nThe following certs are not due for renewal yet:\r\n  /etc/letsencrypt/live/impressum.domain1.com/fullchain.pem expires on 2018-09-26 (skipped)\r\n  /etc/letsencrypt/live/javadoc.domain1.com/fullchain.pem expires on 2018-09-26 (skipped)\r\n  /etc/letsencrypt/live/pfa.domain1.com/fullchain.pem expires on 2018-07-29 (skipped)\r\n  /etc/letsencrypt/live/growth.domain1.com/fullchain.pem expires on 2018-08-23 (skipped)\r\n  /etc/letsencrypt/live/1a.domain1.com/fullchain.pem expires on 2018-07-29 (skipped)\r\n  /etc/letsencrypt/live/domain1.com-0001/fullchain.pem expires on 2018-08-31 (skipped)\r\n  /etc/letsencrypt/live/miriam.domain1.com/fullchain.pem expires on 2018-09-04 (skipped)\r\n  /etc/letsencrypt/live/privacy.domain1.com/fullchain.pem expires on 2018-08-26 (skipped)\r\n  /etc/letsencrypt/live/domain1.com/fullchain.pem expires on 2018-08-31 (skipped)\r\nAll renewal attempts failed. The following certs could not be renewed:\r\n  /etc/letsencrypt/live/domain2.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/mail.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/tickets.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/paste.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/jenkins.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/api.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/cloud.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/maven.domain1.com/fullchain.pem (failure)\r\n  /etc/letsencrypt/live/images.domain1.com/fullchain.pem (failure)\r\n-------------------------------------------------------------------------------\r\n9 renew failure(s), 0 parse failure(s)\r\n\r\nIMPORTANT NOTES:\r\n - The following errors were reported by the server:\r\n\r\n   Domain: domain2.com\r\n   Type:   tls\r\n   Detail: remote error: tls: handshake failure\r\n\r\n   Domain: www.domain2.com\r\n   Type:   tls\r\n   Detail: remote error: tls: handshake failure\r\n\r\n   To fix these errors, please make sure that your domain name was\r\n   entered correctly and the DNS A/AAAA record(s) for that domain\r\n   contain(s) the right IP address. Additionally, please check that\r\n   you have an up-to-date TLS configuration that allows the server to\r\n   communicate with the Certbot client.\r\n - The following errors were reported by the server:\r\n\r\n   Domain: api.domain1.com\r\n   Type:   unauthorized\r\n   Detail: Incorrect validation certificate for tls-sni-01 challenge.\r\n   Requested\r\n   710658a41dea0453da124fb6481c34b2.c8acdbf6bd759d0fe20072a69dd4c1f6.acme.invalid\r\n   from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first\r\n   certificate had names \"1a.domain1.com\"\r\n\r\n   To fix these errors, please make sure that your domain name was\r\n   entered correctly and the DNS A/AAAA record(s) for that domain\r\n   contain(s) the right IP address.\r\n - The following errors were reported by the server:\r\n\r\n   Domain: cloud.domain1.com\r\n   Type:   unauthorized\r\n   Detail: Incorrect validation certificate for tls-sni-01 challenge.\r\n   Requested\r\n   70da42a2b1262ec1dcf33707cbb00cb6.3589435c22cadab95078f60c10da5e3b.acme.invalid\r\n   from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first\r\n   certificate had names \"1a.domain1.com\"\r\n\r\n   To fix these errors, please make sure that your domain name was\r\n   entered correctly and the DNS A/AAAA record(s) for that domain\r\n   contain(s) the right IP address.\r\n - The following errors were reported by the server:\r\n\r\n   Domain: images.domain1.com\r\n   Type:   unauthorized\r\n   Detail: Incorrect validation certificate for tls-sni-01 challenge.\r\n   Requested\r\n   5ccca1724434320d71f8665888521858.a54d12872feec31b1d7d9000c1b98935.acme.invalid\r\n   from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first\r\n   certificate had names \"1a.domain1.com\"\r\n\r\n   To fix these errors, please make sure that your domain name was\r\n   entered correctly and the DNS A/AAAA record(s) for that domain\r\n   contain(s) the right IP address.\r\n - The following errors were reported by the server:\r\n\r\n   Domain: jenkins.domain1.com\r\n   Type:   unauthorized\r\n   Detail: Incorrect validation certificate for tls-sni-01 challenge.\r\n   Requested\r\n   9f5658a3c65f1dc26849cbca1c10a313.645b9bed1a60f096b7f524aa68051c03.acme.invalid\r\n   from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first\r\n   certificate had names \"1a.domain1.com\"\r\n\r\n   To fix these errors, please make sure that your domain name was\r\n   entered correctly and the DNS A/AAAA record(s) for that domain\r\n   contain(s) the right IP address.\r\n - The following errors were reported by the server:\r\n\r\n   Domain: mail.domain1.com\r\n   Type:   unauthorized\r\n   Detail: Incorrect validation certificate for tls-sni-01 challenge.\r\n   Requested\r\n   e95169bcec0a861f1456af7870c94e48.71bcd14ae6c73bad8c9a3d525034da55.acme.invalid\r\n   from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first\r\n   certificate had names \"1a.domain1.com\"\r\n\r\n   To fix these errors, please make sure that your domain name was\r\n   entered correctly and the DNS A/AAAA record(s) for that domain\r\n   contain(s) the right IP address.\r\n - The following errors were reported by the server:\r\n\r\n   Domain: maven.domain1.com\r\n   Type:   unauthorized\r\n   Detail: Incorrect validation certificate for tls-sni-01 challenge.\r\n   Requested\r\n   7aa6ee8198ae2ce93a31767d66959b23.295978166ae542ee81fcc72e9d4efbec.acme.invalid\r\n   from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first\r\n   certificate had names \"1a.domain1.com\"\r\n\r\n   To fix these errors, please make sure that your domain name was\r\n   entered correctly and the DNS A/AAAA record(s) for that domain\r\n   contain(s) the right IP address.\r\n - The following errors were reported by the server:\r\n\r\n   Domain: paste.domain1.com\r\n   Type:   unauthorized\r\n   Detail: Incorrect validation certificate for tls-sni-01 challenge.\r\n   Requested\r\n   958c94f3f2e1dbcf20f787e928acfafe.d46588d85513b5df0b631bee4ce66120.acme.invalid\r\n   from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first\r\n   certificate had names \"1a.domain1.com\"\r\n\r\n   To fix these errors, please make sure that your domain name was\r\n   entered correctly and the DNS A/AAAA record(s) for that domain\r\n   contain(s) the right IP address.\r\n - The following errors were reported by the server:\r\n\r\n   Domain: tickets.domain1.com\r\n   Type:   unauthorized\r\n   Detail: Incorrect validation certificate for tls-sni-01 challenge.\r\n   Requested\r\n   01a2dbf4052a1a289e16fb2ad8e331c0.c82dc079f1712e9b68ff602a7d5f58d9.acme.invalid\r\n   from [MY_IP_ADDRESS]:443. Received 2 certificate(s), first\r\n   certificate had names \"1a.domain1.com\"\r\n\r\n   To fix these errors, please make sure that your domain name was\r\n   entered correctly and the DNS A/AAAA record(s) for that domain\r\n   contain(s) the right IP address.\r\n```\r\n\r\n## Certbot's behavior differed from what I expected because:\r\nIt seems that certbot somehow has an error when interacting with apache, since apache redirects the authorization requests to 1a.domain1.com, which is the first in the alphabet. I have no idea why apache does that. It always used to work, but since a week or so it did not work anymore. \r\n\r\nI have the newest version of Apache, Certbot, ... . \r\n\r\nWhen I try \"certbot renew --standalone\" after stopping Apache, though, 1 certificate is successfully renewed. Then, a ghost process called apache keeps running on port 443 (normal apache is not running), and I have to stop it with \"kill ...\". Hence, the other renewals fail because port 443 is blocked.\r\n\r\n## Here is a Certbot log showing the issue (if available):\r\n```\r\n###### Logs are stored in `/var/log/letsencrypt` by default. Feel free to redact domains, e-mail and IP addresses as you see fit.\r\n2018-06-28 11:36:00,853:INFO:certbot.main:Renewing an existing certificate\r\n2018-06-28 11:36:00,924:DEBUG:certbot.crypto_util:Generating key (2048 bits): /etc/letsencrypt/keys/0335_key-certbot.pem\r\n2018-06-28 11:36:00,928:DEBUG:certbot.crypto_util:Creating CSR: /etc/letsencrypt/csr/0335_csr-certbot.pem\r\n2018-06-28 11:36:00,928:DEBUG:acme.client:Requesting fresh nonce\r\n2018-06-28 11:36:00,928:DEBUG:acme.client:Sending HEAD request to https://acme-v01.api.letsencrypt.org/acme/new-authz.\r\n2018-06-28 11:36:01,173:DEBUG:urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"HEAD /acme/new-authz HTTP/1.1\" 405 0\r\n2018-06-28 11:36:01,174:DEBUG:acme.client:Received response:\r\nHTTP 405\r\nServer: nginx\r\nContent-Type: application/problem+json\r\nContent-Length: 91\r\nAllow: POST\r\nReplay-Nonce: WSLPeHSmAS6Xgelt5sANJE2OfBS69gUu63Kj8UeTUN0\r\nExpires: Thu, 28 Jun 2018 15:36:01 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Thu, 28 Jun 2018 15:36:01 GMT\r\nConnection: keep-alive\r\n\r\n\r\n2018-06-28 11:36:01,174:DEBUG:acme.client:Storing nonce: WSLPeHSmAS6Xgelt5sANJE2OfBS69gUu63Kj8UeTUN0\r\n2018-06-28 11:36:01,175:DEBUG:acme.client:JWS payload:\r\nb'{\\n  \"identifier\": {\\n    \"value\": \"domain2.com\",\\n    \"type\": \"dns\"\\n  },\\n  \"resource\": \"new-authz\"\\n}'\r\n2018-06-28 11:36:01,178:DEBUG:acme.client:Sending POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz:\r\n{\r\n  \"payload\": \"ewogICJpZGVudGlmaWVyIjogewogICAgInZhbHVlIjogImFuZ2VsYS1jc29rYS5jb20iLAogICAgInR5cGUiOiAiZG5zIgogIH0sCiAgInJlc291cmNlIjogIm5ldy1hdXRoeiIKfQ\",\r\n  \"signature\": \"GBPYo5tJkFE7ensCqk6cIS-3icyxMd2gz7aR8TfSSWyYI8tQoMlYRFZltTOAjtbwKV0XGy7IhJqcyk4zfcMwizL5MriL5BTkVuuTkyj95kpOCT2i_SS099SVnx-1sTXH16RaMZMhhWETkPba_mVO3QEHC7pwIsDNv_RjdQVTVPt4JXp3zmRX_hfBlD_KeGe2qg4UAQAtHIi1PK-jPL9p944UP-svs0a_D3oi_L_jGfyYGyntcBrl4ruNyqNN1YA_QU7SEXUfOgyr48F-buvCp8xaBBxkbQVOzOIlfggjeZAJmSorzkYnhkitbI17bMvHA5gir7e9DjJyARi5AI4Lrw\",\r\n  \"protected\": \"eyJub25jZSI6ICJXU0xQZUhTbUFTNlhnZWx0NXNBTkpFMk9mQlM2OWdVdTYzS2o4VWVUVU4wIiwgImFsZyI6ICJSUzI1NiIsICJqd2siOiB7Im4iOiAiczZvZVBEczdtUlRrQVBXZmRhZ1gwcHhXcHBVdzhRSGl3M19KNkY5M0ZGNElsUExmTjVRQ2ZRUkZNMTAzbjliNVVqTVh5cno5VHNvOGpMVTRzXzROcUpUVXhjTy1fNWpQQTY1TzNTNjJLZFEyaFZlTGtQbTBUckVKUzYyWndra2tqeklfejhXMWFVdkMzSGhfOTlPVUdyUnBmU0NmaXNBeTZxZTczUGRmcGEzaVZXZHhacms5cGFMUlM5Mml5cERrN1h6OFBoMHp0YS1pbDlTSkNvQW53Q0hJck1naFBQeHpIT3k3ZjJhbXdaczlvVlJ1c0JFMXFHNndPMmFnNzdCTVVkbW00VlhERVA3c18xOWwxempiNmZxQzVLM1VFLVRhVG1LcThnOGhfZThTRk94aGUzVUVHU08zVXZCWGdvaVp4UU1BQ085Y0FmNElNRlpPWkpnQk53IiwgImUiOiAiQVFBQiIsICJrdHkiOiAiUlNBIn19\"\r\n}\r\n2018-06-28 11:36:01,505:DEBUG:urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"POST /acme/new-authz HTTP/1.1\" 201 994\r\n2018-06-28 11:36:01,505:DEBUG:acme.client:Received response:\r\nHTTP 201\r\nServer: nginx\r\nContent-Type: application/json\r\nContent-Length: 994\r\nBoulder-Requester: 33386020\r\nLink: <https://acme-v01.api.letsencrypt.org/acme/new-cert>;rel=\"next\"\r\nLocation: https://acme-v01.api.letsencrypt.org/acme/authz/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk\r\nReplay-Nonce: PLN04-2BTHMPJnyy1x3ODtPMkdDzSEeHBc_cEFXnawM\r\nX-Frame-Options: DENY\r\nStrict-Transport-Security: max-age=604800\r\nExpires: Thu, 28 Jun 2018 15:36:01 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Thu, 28 Jun 2018 15:36:01 GMT\r\nConnection: keep-alive\r\n\r\n{\r\n  \"identifier\": {\r\n    \"type\": \"dns\",\r\n    \"value\": \"domain2.com\"\r\n  },\r\n  \"status\": \"pending\",\r\n  \"expires\": \"2018-07-05T15:30:42Z\",\r\n  \"challenges\": [\r\n    {\r\n      \"type\": \"tls-sni-01\",\r\n      \"status\": \"pending\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041910\",\r\n      \"token\": \"pRXpu_X1Jn_ZRXvLtYyc0heEthxUuiZEe_ftzAebeYQ\"\r\n    },\r\n    {\r\n      \"type\": \"dns-01\",\r\n      \"status\": \"pending\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041911\",\r\n      \"token\": \"oNamBBsZi9TFANerrY2Do6vtXubBsjIVyC3i0-Z67J4\"\r\n    },\r\n    {\r\n      \"type\": \"http-01\",\r\n      \"status\": \"pending\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041912\",\r\n      \"token\": \"l3F02vWytveb5Cb3yrOsaoDBDcrr-lyuTXYyrpYEBTU\"\r\n    }\r\n  ],\r\n  \"combinations\": [\r\n    [\r\n      1\r\n    ],\r\n    [\r\n      2\r\n    ],\r\n    [\r\n      0\r\n    ]\r\n  ]\r\n}\r\n2018-06-28 11:36:01,506:DEBUG:acme.client:Storing nonce: PLN04-2BTHMPJnyy1x3ODtPMkdDzSEeHBc_cEFXnawM\r\n2018-06-28 11:36:01,507:DEBUG:acme.client:JWS payload:\r\nb'{\\n  \"identifier\": {\\n    \"value\": \"www.domain2.com\",\\n    \"type\": \"dns\"\\n  },\\n  \"resource\": \"new-authz\"\\n}'\r\n2018-06-28 11:36:01,509:DEBUG:acme.client:Sending POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz:\r\n{\r\n  \"payload\": \"ewogICJpZGVudGlmaWVyIjogewogICAgInZhbHVlIjogInd3dy5hbmdlbGEtY3Nva2EuY29tIiwKICAgICJ0eXBlIjogImRucyIKICB9LAogICJyZXNvdXJjZSI6ICJuZXctYXV0aHoiCn0\",\r\n  \"signature\": \"p7g6YO46WsQmxBaOozaJc39ln0fmvLuBtg-tUBFLkB3y9N0gKWDTcpFxcr0IylM0JA9k_NXNdWCg37lxnkoOTwwwaASTs0JarcayrYIeO9jnCUA5-aY7TYm2sZPlAxAm0EztOSRmUB28KCN3ZgMcZ_e8kvPKV8zjwF0qkMyYk2fyy4ge-YwjMdfVmcQ1G6sOAU4ywm3WBpi7b3WZte8A2FCGzC7O05pDXpUoEE4KNhP0zmK1BqM1NEUy-rlvD2NEpS5QtToH118CiNuglkFs79uzHM-eFylaeyT5KbWWlI9LmrPILeUu8MKhXoNQMDVJniOjrL_LBbJaa8fVTpha5w\",\r\n  \"protected\": \"eyJub25jZSI6ICJQTE4wNC0yQlRITVBKbnl5MXgzT0R0UE1rZER6U0VlSEJjX2NFRlhuYXdNIiwgImFsZyI6ICJSUzI1NiIsICJqd2siOiB7Im4iOiAiczZvZVBEczdtUlRrQVBXZmRhZ1gwcHhXcHBVdzhRSGl3M19KNkY5M0ZGNElsUExmTjVRQ2ZRUkZNMTAzbjliNVVqTVh5cno5VHNvOGpMVTRzXzROcUpUVXhjTy1fNWpQQTY1TzNTNjJLZFEyaFZlTGtQbTBUckVKUzYyWndra2tqeklfejhXMWFVdkMzSGhfOTlPVUdyUnBmU0NmaXNBeTZxZTczUGRmcGEzaVZXZHhacms5cGFMUlM5Mml5cERrN1h6OFBoMHp0YS1pbDlTSkNvQW53Q0hJck1naFBQeHpIT3k3ZjJhbXdaczlvVlJ1c0JFMXFHNndPMmFnNzdCTVVkbW00VlhERVA3c18xOWwxempiNmZxQzVLM1VFLVRhVG1LcThnOGhfZThTRk94aGUzVUVHU08zVXZCWGdvaVp4UU1BQ085Y0FmNElNRlpPWkpnQk53IiwgImUiOiAiQVFBQiIsICJrdHkiOiAiUlNBIn19\"\r\n}\r\n2018-06-28 11:36:01,824:DEBUG:urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"POST /acme/new-authz HTTP/1.1\" 201 998\r\n2018-06-28 11:36:01,825:DEBUG:acme.client:Received response:\r\nHTTP 201\r\nServer: nginx\r\nContent-Type: application/json\r\nContent-Length: 998\r\nBoulder-Requester: 33386020\r\nLink: <https://acme-v01.api.letsencrypt.org/acme/new-cert>;rel=\"next\"\r\nLocation: https://acme-v01.api.letsencrypt.org/acme/authz/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY\r\nReplay-Nonce: xRbuZNTBWVnPklRIqsk1b8li13b1f0OKS6aOqOPC5iA\r\nX-Frame-Options: DENY\r\nStrict-Transport-Security: max-age=604800\r\nExpires: Thu, 28 Jun 2018 15:36:01 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Thu, 28 Jun 2018 15:36:01 GMT\r\nConnection: keep-alive\r\n\r\n{\r\n  \"identifier\": {\r\n    \"type\": \"dns\",\r\n    \"value\": \"www.domain2.com\"\r\n  },\r\n  \"status\": \"pending\",\r\n  \"expires\": \"2018-07-05T15:30:43Z\",\r\n  \"challenges\": [\r\n    {\r\n      \"type\": \"http-01\",\r\n      \"status\": \"pending\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041967\",\r\n      \"token\": \"Mvz6s53kJnfcFrqOAGHyaYRc1NSSJECheu7R6Q972OE\"\r\n    },\r\n    {\r\n      \"type\": \"dns-01\",\r\n      \"status\": \"pending\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041968\",\r\n      \"token\": \"7aHjFBFlTFg3hVwQL4q3LUZcRS2DiSM6PDuZfi_oQ6o\"\r\n    },\r\n    {\r\n      \"type\": \"tls-sni-01\",\r\n      \"status\": \"pending\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041969\",\r\n      \"token\": \"UWnEJDhNNJJhSi5UC2T0UzmAYebAmljKqmzQ55DRQHU\"\r\n    }\r\n  ],\r\n  \"combinations\": [\r\n    [\r\n      2\r\n    ],\r\n    [\r\n      0\r\n    ],\r\n    [\r\n      1\r\n    ]\r\n  ]\r\n}\r\n2018-06-28 11:36:01,825:DEBUG:acme.client:Storing nonce: xRbuZNTBWVnPklRIqsk1b8li13b1f0OKS6aOqOPC5iA\r\n2018-06-28 11:36:01,825:INFO:certbot.auth_handler:Performing the following challenges:\r\n2018-06-28 11:36:01,826:INFO:certbot.auth_handler:tls-sni-01 challenge for domain2.com\r\n2018-06-28 11:36:01,826:INFO:certbot.auth_handler:tls-sni-01 challenge for www.domain2.com\r\n2018-06-28 11:36:02,130:DEBUG:certbot_apache.parser:Adding Include /etc/apache2/le_tls_sni_01_cert_challenge.conf to /files/etc/apache2/apache2.conf\r\n2018-06-28 11:36:02,131:DEBUG:certbot_apache.tls_sni_01:writing a config file with text:\r\n <IfModule mod_ssl.c>\r\n<VirtualHost *:443>\r\n    ServerName fd264b12ec05f43020a80bf2bfe521c4.a4d401c306408c94c7a7a53499e3f993.acme.invalid\r\n    UseCanonicalName on\r\n    SSLStrictSNIVHostCheck on\r\n\r\n    LimitRequestBody 1048576\r\n\r\n    Include /etc/letsencrypt/options-ssl-apache.conf\r\n    SSLCertificateFile /var/lib/letsencrypt/pRXpu_X1Jn_ZRXvLtYyc0heEthxUuiZEe_ftzAebeYQ.crt\r\n    SSLCertificateKeyFile /var/lib/letsencrypt/pRXpu_X1Jn_ZRXvLtYyc0heEthxUuiZEe_ftzAebeYQ.pem\r\n\r\n    DocumentRoot /var/lib/letsencrypt/tls_sni_01_page/\r\n</VirtualHost>\r\n\r\n<VirtualHost *:443>\r\n    ServerName e95ff9b9d115967c1dc9c034573197dd.078ae469261f06a03c9eb5a114989bab.acme.invalid\r\n    UseCanonicalName on\r\n    SSLStrictSNIVHostCheck on\r\n\r\n    LimitRequestBody 1048576\r\n\r\n    Include /etc/letsencrypt/options-ssl-apache.conf\r\n    SSLCertificateFile /var/lib/letsencrypt/UWnEJDhNNJJhSi5UC2T0UzmAYebAmljKqmzQ55DRQHU.crt\r\n    SSLCertificateKeyFile /var/lib/letsencrypt/UWnEJDhNNJJhSi5UC2T0UzmAYebAmljKqmzQ55DRQHU.pem\r\n\r\n    DocumentRoot /var/lib/letsencrypt/tls_sni_01_page/\r\n</VirtualHost>\r\n\r\n</IfModule>\r\n\r\n2018-06-28 11:36:02,144:DEBUG:certbot.reverter:Creating backup of /etc/apache2/apache2.conf\r\n2018-06-28 11:36:05,309:INFO:certbot.auth_handler:Waiting for verification...\r\n2018-06-28 11:36:05,310:DEBUG:acme.client:JWS payload:\r\nb'{\\n  \"type\": \"tls-sni-01\",\\n  \"keyAuthorization\": \"pRXpu_X1Jn_ZRXvLtYyc0heEthxUuiZEe_ftzAebeYQ.olF7lJoC_lxauWEu67DZJoOzgtH_uwjgo2j2Nop8fvE\",\\n  \"resource\": \"challenge\"\\n}'\r\n2018-06-28 11:36:05,313:DEBUG:acme.client:Sending POST request to https://acme-v01.api.letsencrypt.org/acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041910:\r\n{\r\n  \"payload\": \"ewogICJ0eXBlIjogInRscy1zbmktMDEiLAogICJrZXlBdXRob3JpemF0aW9uIjogInBSWHB1X1gxSm5fWlJYdkx0WXljMGhlRXRoeFV1aVpFZV9mdHpBZWJlWVEub2xGN2xKb0NfbHhhdVdFdTY3RFpKb096Z3RIX3V3amdvMmoyTm9wOGZ2RSIsCiAgInJlc291cmNlIjogImNoYWxsZW5nZSIKfQ\",\r\n  \"signature\": \"CWZDOljGw65SZjrTiWG49eNErWs8VznbuW_hZl2fqJJjw_Kty6b6yXe8NRgcmd78oiOjMwssrxfyWIelmFcYX-4xbnXXFn7-T4Eq8O16Hzi-N4zdjdVG0Xh4nDWLpKQwuBC73YKcIxvhwNw485C0srC5EWt7FXa5Juefr_ih1w7Jro10fV1RKRmIqYTSkRkuscnby8RkMf4ew6UYBYkmNTOKKLBfSNAZfV33950cvtqypIGCFEb5Qb7B83ZM1d71m-q3LhncFc7uSJoB5QDAoTQ1nk_Jc-7yTGAovbKN9rUWOvPyTI0shC_P3rhcrIYC3uiQWNWaTBk5pDLD51d6xw\",\r\n  \"protected\": \"eyJub25jZSI6ICJ4UmJ1Wk5UQldWblBrbFJJcXNrMWI4bGkxM2IxZjBPS1M2YU9xT1BDNWlBIiwgImFsZyI6ICJSUzI1NiIsICJqd2siOiB7Im4iOiAiczZvZVBEczdtUlRrQVBXZmRhZ1gwcHhXcHBVdzhRSGl3M19KNkY5M0ZGNElsUExmTjVRQ2ZRUkZNMTAzbjliNVVqTVh5cno5VHNvOGpMVTRzXzROcUpUVXhjTy1fNWpQQTY1TzNTNjJLZFEyaFZlTGtQbTBUckVKUzYyWndra2tqeklfejhXMWFVdkMzSGhfOTlPVUdyUnBmU0NmaXNBeTZxZTczUGRmcGEzaVZXZHhacms5cGFMUlM5Mml5cERrN1h6OFBoMHp0YS1pbDlTSkNvQW53Q0hJck1naFBQeHpIT3k3ZjJhbXdaczlvVlJ1c0JFMXFHNndPMmFnNzdCTVVkbW00VlhERVA3c18xOWwxempiNmZxQzVLM1VFLVRhVG1LcThnOGhfZThTRk94aGUzVUVHU08zVXZCWGdvaVp4UU1BQ085Y0FmNElNRlpPWkpnQk53IiwgImUiOiAiQVFBQiIsICJrdHkiOiAiUlNBIn19\"\r\n}\r\n2018-06-28 11:36:05,638:DEBUG:urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"POST /acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041910 HTTP/1.1\" 202 339\r\n2018-06-28 11:36:05,639:DEBUG:acme.client:Received response:\r\nHTTP 202\r\nServer: nginx\r\nContent-Type: application/json\r\nContent-Length: 339\r\nBoulder-Requester: 33386020\r\nLink: <https://acme-v01.api.letsencrypt.org/acme/authz/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk>;rel=\"up\"\r\nLocation: https://acme-v01.api.letsencrypt.org/acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041910\r\nReplay-Nonce: FdZXB4mRwkt3dN7nrcJ-E57ar2wiyEcckWWUYwj09pQ\r\nExpires: Thu, 28 Jun 2018 15:36:05 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Thu, 28 Jun 2018 15:36:05 GMT\r\nConnection: keep-alive\r\n\r\n{\r\n  \"type\": \"tls-sni-01\",\r\n  \"status\": \"pending\",\r\n  \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041910\",\r\n  \"token\": \"pRXpu_X1Jn_ZRXvLtYyc0heEthxUuiZEe_ftzAebeYQ\",\r\n  \"keyAuthorization\": \"pRXpu_X1Jn_ZRXvLtYyc0heEthxUuiZEe_ftzAebeYQ.olF7lJoC_lxauWEu67DZJoOzgtH_uwjgo2j2Nop8fvE\"\r\n}\r\n2018-06-28 11:36:05,639:DEBUG:acme.client:Storing nonce: FdZXB4mRwkt3dN7nrcJ-E57ar2wiyEcckWWUYwj09pQ\r\n2018-06-28 11:36:05,640:DEBUG:acme.client:JWS payload:\r\nb'{\\n  \"type\": \"tls-sni-01\",\\n  \"keyAuthorization\": \"UWnEJDhNNJJhSi5UC2T0UzmAYebAmljKqmzQ55DRQHU.olF7lJoC_lxauWEu67DZJoOzgtH_uwjgo2j2Nop8fvE\",\\n  \"resource\": \"challenge\"\\n}'\r\n2018-06-28 11:36:05,643:DEBUG:acme.client:Sending POST request to https://acme-v01.api.letsencrypt.org/acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041969:\r\n{\r\n  \"payload\": \"ewogICJ0eXBlIjogInRscy1zbmktMDEiLAogICJrZXlBdXRob3JpemF0aW9uIjogIlVXbkVKRGhOTkpKaFNpNVVDMlQwVXptQVllYkFtbGpLcW16UTU1RFJRSFUub2xGN2xKb0NfbHhhdVdFdTY3RFpKb096Z3RIX3V3amdvMmoyTm9wOGZ2RSIsCiAgInJlc291cmNlIjogImNoYWxsZW5nZSIKfQ\",\r\n  \"signature\": \"GRGwyw73uPuCClaWQl-FCrMge42lPlgL5v_AL5Q2JqO4lI_j6pxiEYRy4xrXEiLaO--exWPu81QXlRIGpNpI_c4EuHPjG-dv7wtpiKfWVfVel95-8qsgidcsMYNRXWyGy2NiE5eV9syVezyM5UNPd-Vj0eI-GQwMNo0umV2Ikpg0e8Kw5lmC_N-WVtLmNtxMUfGNNscLsRfTWxCtjZP61R-xV1QCl9WHFJ5DL3k6MACbzIS3lzTB5PaH7SD15gyC3bPQIAY89UdRXDvpbyTZyswpjZw1NDnlhPR3aS_0jpKB_MGnNoBFwHJxxuiO8gv5IllztSqLAk86ZoWSGxMAkg\",\r\n  \"protected\": \"eyJub25jZSI6ICJGZFpYQjRtUndrdDNkTjducmNKLUU1N2FyMndpeUVjY2tXV1VZd2owOXBRIiwgImFsZyI6ICJSUzI1NiIsICJqd2siOiB7Im4iOiAiczZvZVBEczdtUlRrQVBXZmRhZ1gwcHhXcHBVdzhRSGl3M19KNkY5M0ZGNElsUExmTjVRQ2ZRUkZNMTAzbjliNVVqTVh5cno5VHNvOGpMVTRzXzROcUpUVXhjTy1fNWpQQTY1TzNTNjJLZFEyaFZlTGtQbTBUckVKUzYyWndra2tqeklfejhXMWFVdkMzSGhfOTlPVUdyUnBmU0NmaXNBeTZxZTczUGRmcGEzaVZXZHhacms5cGFMUlM5Mml5cERrN1h6OFBoMHp0YS1pbDlTSkNvQW53Q0hJck1naFBQeHpIT3k3ZjJhbXdaczlvVlJ1c0JFMXFHNndPMmFnNzdCTVVkbW00VlhERVA3c18xOWwxempiNmZxQzVLM1VFLVRhVG1LcThnOGhfZThTRk94aGUzVUVHU08zVXZCWGdvaVp4UU1BQ085Y0FmNElNRlpPWkpnQk53IiwgImUiOiAiQVFBQiIsICJrdHkiOiAiUlNBIn19\"\r\n}\r\n2018-06-28 11:36:05,970:DEBUG:urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"POST /acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041969 HTTP/1.1\" 202 339\r\n2018-06-28 11:36:05,971:DEBUG:acme.client:Received response:\r\nHTTP 202\r\nServer: nginx\r\nContent-Type: application/json\r\nContent-Length: 339\r\nBoulder-Requester: 33386020\r\nLink: <https://acme-v01.api.letsencrypt.org/acme/authz/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY>;rel=\"up\"\r\nLocation: https://acme-v01.api.letsencrypt.org/acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041969\r\nReplay-Nonce: N8_GYt46hQjOp_boZbHy1to2rT9ucfqR32RAyyXsqF8\r\nExpires: Thu, 28 Jun 2018 15:36:05 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Thu, 28 Jun 2018 15:36:05 GMT\r\nConnection: keep-alive\r\n\r\n{\r\n  \"type\": \"tls-sni-01\",\r\n  \"status\": \"pending\",\r\n  \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041969\",\r\n  \"token\": \"UWnEJDhNNJJhSi5UC2T0UzmAYebAmljKqmzQ55DRQHU\",\r\n  \"keyAuthorization\": \"UWnEJDhNNJJhSi5UC2T0UzmAYebAmljKqmzQ55DRQHU.olF7lJoC_lxauWEu67DZJoOzgtH_uwjgo2j2Nop8fvE\"\r\n}\r\n2018-06-28 11:36:05,971:DEBUG:acme.client:Storing nonce: N8_GYt46hQjOp_boZbHy1to2rT9ucfqR32RAyyXsqF8\r\n2018-06-28 11:36:08,974:DEBUG:acme.client:Sending GET request to https://acme-v01.api.letsencrypt.org/acme/authz/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk.\r\n2018-06-28 11:36:09,234:DEBUG:urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"GET /acme/authz/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk HTTP/1.1\" 200 1697\r\n2018-06-28 11:36:09,235:DEBUG:acme.client:Received response:\r\nHTTP 200\r\nServer: nginx\r\nContent-Type: application/json\r\nContent-Length: 1697\r\nLink: <https://acme-v01.api.letsencrypt.org/acme/new-cert>;rel=\"next\"\r\nReplay-Nonce: KV3UqacB2SIrcKPMTaZQ_Br-uUxDpAH7nfKJD2gzkMA\r\nX-Frame-Options: DENY\r\nStrict-Transport-Security: max-age=604800\r\nExpires: Thu, 28 Jun 2018 15:36:09 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Thu, 28 Jun 2018 15:36:09 GMT\r\nConnection: keep-alive\r\n\r\n{\r\n  \"identifier\": {\r\n    \"type\": \"dns\",\r\n    \"value\": \"domain2.com\"\r\n  },\r\n  \"status\": \"invalid\",\r\n  \"expires\": \"2018-07-05T15:30:42Z\",\r\n  \"challenges\": [\r\n    {\r\n      \"type\": \"tls-sni-01\",\r\n      \"status\": \"invalid\",\r\n      \"error\": {\r\n        \"type\": \"urn:acme:error:tls\",\r\n        \"detail\": \"remote error: tls: handshake failure\",\r\n        \"status\": 400\r\n      },\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041910\",\r\n      \"token\": \"pRXpu_X1Jn_ZRXvLtYyc0heEthxUuiZEe_ftzAebeYQ\",\r\n      \"keyAuthorization\": \"pRXpu_X1Jn_ZRXvLtYyc0heEthxUuiZEe_ftzAebeYQ.olF7lJoC_lxauWEu67DZJoOzgtH_uwjgo2j2Nop8fvE\",\r\n      \"validationRecord\": [\r\n        {\r\n          \"hostname\": \"domain2.com\",\r\n          \"port\": \"443\",\r\n          \"addressesResolved\": [\r\n            \"104.27.178.160\",\r\n            \"104.27.179.160\",\r\n            \"2400:cb00:2048:1::681b:b2a0\",\r\n            \"2400:cb00:2048:1::681b:b3a0\"\r\n          ],\r\n          \"addressUsed\": \"104.27.178.160\",\r\n          \"addressesTried\": [\r\n            \"2400:cb00:2048:1::681b:b2a0\"\r\n          ]\r\n        }\r\n      ]\r\n    },\r\n    {\r\n      \"type\": \"dns-01\",\r\n      \"status\": \"invalid\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041911\",\r\n      \"token\": \"oNamBBsZi9TFANerrY2Do6vtXubBsjIVyC3i0-Z67J4\"\r\n    },\r\n    {\r\n      \"type\": \"http-01\",\r\n      \"status\": \"invalid\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/KqkXTCgmhnv7zGYkvmR05P-XJMeCuHH4VKZ1P7nrVhk/5350041912\",\r\n      \"token\": \"l3F02vWytveb5Cb3yrOsaoDBDcrr-lyuTXYyrpYEBTU\"\r\n    }\r\n  ],\r\n  \"combinations\": [\r\n    [\r\n      1\r\n    ],\r\n    [\r\n      2\r\n    ],\r\n    [\r\n      0\r\n    ]\r\n  ]\r\n}\r\n2018-06-28 11:36:09,236:DEBUG:acme.client:Sending GET request to https://acme-v01.api.letsencrypt.org/acme/authz/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY.\r\n2018-06-28 11:36:09,501:DEBUG:urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"GET /acme/authz/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY HTTP/1.1\" 200 1705\r\n2018-06-28 11:36:09,502:DEBUG:acme.client:Received response:\r\nHTTP 200\r\nServer: nginx\r\nContent-Type: application/json\r\nContent-Length: 1705\r\nLink: <https://acme-v01.api.letsencrypt.org/acme/new-cert>;rel=\"next\"\r\nReplay-Nonce: lohHTR0DS0MZCU72oqZv-FR9V24_Hr7uCY1vCd0R104\r\nX-Frame-Options: DENY\r\nStrict-Transport-Security: max-age=604800\r\nExpires: Thu, 28 Jun 2018 15:36:09 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Thu, 28 Jun 2018 15:36:09 GMT\r\nConnection: keep-alive\r\n\r\n{\r\n  \"identifier\": {\r\n    \"type\": \"dns\",\r\n    \"value\": \"www.domain2.com\"\r\n  },\r\n  \"status\": \"invalid\",\r\n  \"expires\": \"2018-07-05T15:30:43Z\",\r\n  \"challenges\": [\r\n    {\r\n      \"type\": \"http-01\",\r\n      \"status\": \"invalid\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041967\",\r\n      \"token\": \"Mvz6s53kJnfcFrqOAGHyaYRc1NSSJECheu7R6Q972OE\"\r\n    },\r\n    {\r\n      \"type\": \"dns-01\",\r\n      \"status\": \"invalid\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041968\",\r\n      \"token\": \"7aHjFBFlTFg3hVwQL4q3LUZcRS2DiSM6PDuZfi_oQ6o\"\r\n    },\r\n    {\r\n      \"type\": \"tls-sni-01\",\r\n      \"status\": \"invalid\",\r\n      \"error\": {\r\n        \"type\": \"urn:acme:error:tls\",\r\n        \"detail\": \"remote error: tls: handshake failure\",\r\n        \"status\": 400\r\n      },\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/2bi1O5Mj8N03tM9bpnGSUEUnZOgMGJugzzLjXP_R1KY/5350041969\",\r\n      \"token\": \"UWnEJDhNNJJhSi5UC2T0UzmAYebAmljKqmzQ55DRQHU\",\r\n      \"keyAuthorization\": \"UWnEJDhNNJJhSi5UC2T0UzmAYebAmljKqmzQ55DRQHU.olF7lJoC_lxauWEu67DZJoOzgtH_uwjgo2j2Nop8fvE\",\r\n      \"validationRecord\": [\r\n        {\r\n          \"hostname\": \"www.domain2.com\",\r\n          \"port\": \"443\",\r\n          \"addressesResolved\": [\r\n            \"104.27.178.160\",\r\n            \"104.27.179.160\",\r\n            \"2400:cb00:2048:1::681b:b3a0\",\r\n            \"2400:cb00:2048:1::681b:b2a0\"\r\n          ],\r\n          \"addressUsed\": \"104.27.178.160\",\r\n          \"addressesTried\": [\r\n            \"2400:cb00:2048:1::681b:b3a0\"\r\n          ]\r\n        }\r\n      ]\r\n    }\r\n  ],\r\n  \"combinations\": [\r\n    [\r\n      2\r\n    ],\r\n    [\r\n      0\r\n    ],\r\n    [\r\n      1\r\n    ]\r\n  ]\r\n}\r\n2018-06-28 11:36:09,503:DEBUG:certbot.reporter:Reporting to user: The following errors were reported by the server:\r\n\r\nDomain: domain2.com\r\nType:   tls\r\nDetail: remote error: tls: handshake failure\r\n\r\nDomain: www.domain2.com\r\nType:   tls\r\nDetail: remote error: tls: handshake failure\r\n\r\nTo fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address. Additionally, please check that you have an up-to-date TLS configuration that allows the server to communicate with the Certbot client.\r\n2018-06-28 11:36:09,503:DEBUG:certbot.error_handler:Encountered exception:\r\nTraceback (most recent call last):\r\n  File \"/usr/lib/python3/dist-packages/certbot/auth_handler.py\", line 82, in handle_authorizations\r\n    self._respond(aauthzrs, resp, best_effort)\r\n  File \"/usr/lib/python3/dist-packages/certbot/auth_handler.py\", line 155, in _respond\r\n    self._poll_challenges(aauthzrs, chall_update, best_effort)\r\n  File \"/usr/lib/python3/dist-packages/certbot/auth_handler.py\", line 226, in _poll_challenges\r\n    raise errors.FailedChallenges(all_failed_achalls)\r\ncertbot.errors.FailedChallenges: Failed authorization procedure. domain2.com (tls-sni-01): urn:acme:error:tls :: The server experienced a TLS error during domain verification :: remote error: tls: handshake failure, www.domain2.com (tls-sni-01): urn:acme:error:tls :: The server experienced a TLS error during domain verification :: remote error: tls: handshake failure\r\n\r\n2018-06-28 11:36:09,503:DEBUG:certbot.error_handler:Calling registered functions\r\n2018-06-28 11:36:09,504:INFO:certbot.auth_handler:Cleaning up challenges\r\n2018-06-28 11:36:09,762:WARNING:certbot.renewal:Attempting to renew cert (domain2.com) from /etc/letsencrypt/renewal/domain2.com.conf produced an unexpected error: Failed authorization procedure. domain2.com (tls-sni-01): urn:acme:error:tls :: The server experienced a TLS error during domain verification :: remote error: tls: handshake failure, www.domain2.com (tls-sni-01): urn:acme:error:tls :: The server experienced a TLS error during domain verification :: remote error: tls: handshake failure. Skipping.\r\n2018-06-28 11:36:09,763:DEBUG:certbot.renewal:Traceback was:\r\nTraceback (most recent call last):\r\n  File \"/usr/lib/python3/dist-packages/certbot/renewal.py\", line 429, in handle_renewal_request\r\n    main.renew_cert(lineage_config, plugins, renewal_candidate)\r\n  File \"/usr/lib/python3/dist-packages/certbot/main.py\", line 1156, in renew_cert\r\n    renewed_lineage = _get_and_save_cert(le_client, config, lineage=lineage)\r\n  File \"/usr/lib/python3/dist-packages/certbot/main.py\", line 115, in _get_and_save_cert\r\n    renewal.renew_cert(config, domains, le_client, lineage)\r\n  File \"/usr/lib/python3/dist-packages/certbot/renewal.py\", line 304, in renew_cert\r\n    new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)\r\n  File \"/usr/lib/python3/dist-packages/certbot/client.py\", line 326, in obtain_certificate\r\n    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)\r\n  File \"/usr/lib/python3/dist-packages/certbot/client.py\", line 362, in _get_order_and_authorizations\r\n    authzr = self.auth_handler.handle_authorizations(orderr, best_effort)\r\n  File \"/usr/lib/python3/dist-packages/certbot/auth_handler.py\", line 82, in handle_authorizations\r\n    self._respond(aauthzrs, resp, best_effort)\r\n  File \"/usr/lib/python3/dist-packages/certbot/auth_handler.py\", line 155, in _respond\r\n    self._poll_challenges(aauthzrs, chall_update, best_effort)\r\n  File \"/usr/lib/python3/dist-packages/certbot/auth_handler.py\", line 226, in _poll_challenges\r\n    raise errors.FailedChallenges(all_failed_achalls)\r\ncertbot.errors.FailedChallenges: Failed authorization procedure. domain2.com (tls-sni-01): urn:acme:error:tls :: The server experienced a TLS error during domain verification :: remote error: tls: handshake failure, www.domain2.com (tls-sni-01): urn:acme:error:tls :: The server experienced a TLS error during domain verification :: remote error: tls: handshake failure\r\n\r\n2018-06-28 11:36:09,769:INFO:certbot.renewal:Cert not yet due for renewal\r\n2018-06-28 11:36:09,770:DEBUG:certbot.plugins.selection:Requested authenticator standalone and installer apache\r\n2018-06-28 11:36:09,847:DEBUG:certbot_apache.configurator:Apache version is 2.4.18\r\n2018-06-28 11:36:10,241:DEBUG:certbot.plugins.selection:Single candidate plugin: * apache\r\nDescription: Apache Web Server plugin - Beta\r\nInterfaces: IAuthenticator, IInstaller, IPlugin\r\nEntry point: apache = certbot_apache.entrypoint:ENTRYPOINT\r\nInitialized: <certbot_apache.override_debian.DebianConfigurator object at 0x7f5c1e60c550>\r\nPrep: True\r\n2018-06-28 11:36:10,291:ERROR:certbot.log:Exiting abnormally:\r\nTraceback (most recent call last):\r\n  File \"/usr/bin/certbot\", line 11, in <module>\r\n    load_entry_point('certbot==0.25.0', 'console_scripts', 'certbot')()\r\n  File \"/usr/lib/python3/dist-packages/certbot/main.py\", line 1323, in main\r\n    return config.func(config, plugins)\r\n  File \"/usr/lib/python3/dist-packages/certbot/main.py\", line 1235, in renew\r\n    renewal.handle_renewal_request(config)\r\n  File \"/usr/lib/python3/dist-packages/certbot/renewal.py\", line 438, in handle_renewal_request\r\n    plugins)\r\n  File \"/usr/lib/python3/dist-packages/certbot/updater.py\", line 31, in run_generic_updaters\r\n    installer, _ = plug_sel.choose_configurator_plugins(config, plugins, \"certonly\")\r\n  File \"/usr/lib/python3/dist-packages/certbot/plugins/selection.py\", line 200, in choose_configurator_plugins\r\n    authenticator = pick_authenticator(config, req_auth, plugins)\r\n  File \"/usr/lib/python3/dist-packages/certbot/plugins/selection.py\", line 40, in pick_authenticator\r\n    config, default, plugins, question, (interfaces.IAuthenticator,))\r\n  File \"/usr/lib/python3/dist-packages/certbot/plugins/selection.py\", line 75, in pick_plugin\r\n    filtered.init(config)\r\n  File \"/usr/lib/python3/dist-packages/certbot/plugins/disco.py\", line 224, in init\r\n    in six.itervalues(self._plugins)]\r\n  File \"/usr/lib/python3/dist-packages/certbot/plugins/disco.py\", line 223, in <listcomp>\r\n    return [plugin_ep.init(config) for plugin_ep\r\n  File \"/usr/lib/python3/dist-packages/certbot/plugins/disco.py\", line 98, in init\r\n    self._initialized = self.plugin_cls(config, self.name)\r\n  File \"/usr/lib/python3/dist-packages/certbot/plugins/standalone.py\", line 192, in __init__\r\n    self.key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)\r\n  File \"/usr/lib/python3/dist-packages/OpenSSL/crypto.py\", line 250, in generate_key\r\n    result = _lib.RSA_generate_key_ex(rsa, bits, exponent, _ffi.NULL)\r\n```\r\n\r\n## Here is the relevant nginx server block or Apache virtualhost for the domain I am configuring:\r\nI use an Apache macro for all of my domains: (I use it with \"Use ssl domain.com\")\r\n\r\n```\r\n<Macro ssl $host>\r\n  <VirtualHost *:80>\r\n\r\n    ServerName $host\r\n    ServerAlias www.$host\r\n\r\n        RedirectMatch permanent ^(.*)$ https://$host$1\r\n        ErrorLog ${APACHE_LOG_DIR}/$host-error.log\r\n        CustomLog ${APACHE_LOG_DIR}/$host-access.log combined\r\n\r\n  </VirtualHost>\r\n\r\n<VirtualHost *:443>\r\n\r\n        ServerName $host\r\n        ServerAlias www.$host\r\n\r\n        SSLEngine on\r\n        SSLCertificateFile /etc/letsencrypt/live/$host/cert.pem\r\n        SSLCertificateKeyFile /etc/letsencrypt/live/$host/privkey.pem\r\n        SSLCertificateChainFile /etc/letsencrypt/live/$host/chain.pem\r\n\r\n        DocumentRoot /var/www/$host/\r\n\r\n        <IfModule mod_headers.c>\r\n          Header always set Strict-Transport-Security \"max-age=15552000; includeSubDomains\"\r\n        </IfModule>\r\n</VirtualHost>\r\n\r\n</Macro>\r\n```\r\n\r\n\r\nThanks for your help!"},"comment":{"url":"https://api.github.com/repos/certbot/certbot/issues/comments/401352375","html_url":"https://github.com/certbot/certbot/issues/6158#issuecomment-401352375","issue_url":"https://api.github.com/repos/certbot/certbot/issues/6158","id":401352375,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTM1MjM3NQ==","user":{"login":"TimoCrafter","id":18309528,"node_id":"MDQ6VXNlcjE4MzA5NTI4","avatar_url":"https://avatars3.githubusercontent.com/u/18309528?v=4","gravatar_id":"","url":"https://api.github.com/users/TimoCrafter","html_url":"https://github.com/TimoCrafter","followers_url":"https://api.github.com/users/TimoCrafter/followers","following_url":"https://api.github.com/users/TimoCrafter/following{/other_user}","gists_url":"https://api.github.com/users/TimoCrafter/gists{/gist_id}","starred_url":"https://api.github.com/users/TimoCrafter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TimoCrafter/subscriptions","organizations_url":"https://api.github.com/users/TimoCrafter/orgs","repos_url":"https://api.github.com/users/TimoCrafter/repos","events_url":"https://api.github.com/users/TimoCrafter/events{/privacy}","received_events_url":"https://api.github.com/users/TimoCrafter/received_events","type":"User","site_admin":false},"created_at":"2018-06-29T13:21:49Z","updated_at":"2018-06-29T13:21:49Z","author_association":"NONE","body":"@joohoi Hm, it worked on my old server. It had the same operating system, the same apache configs, everything. Then I migrated to the new server, and issuing the certificates worked perfectly. Though, I think this is the first time to try renewing it on the new server.\r\n\r\nHow should I renew all of my certificates now?"}}
{"actor":{"display_login":"TimoCrafter"}}