4 ms·
You get an email like this: Hello, Action may be required to prevent your Let's Encrypt certificate renewals from breaking. If you already received a similar
by thro_away_n 8y ago
You get an email like this:
Hello,
Action may be required to prevent your Let's Encrypt certificate renewals from breaking.
If you already received a similar e-mail, this one contains updated information.
Your Let's Encrypt client used ACME TLS-SNI-01 domain validation to issue a certificate in the past 60 days. Below is a list of names and IP addresses validated (max of one per account):
example.com (x.x.x.x) on 2018-12-05
TLS-SNI-01 validation is reaching end-of-life. It will stop working temporarily on February 13th, 2019, and permanently on March 13th, 2019. Any certificates issued before then will continue to work for 90 days after their issuance date.
You need to update your ACME client to use an alternative validation method (HTTP-01, DNS-01 or TLS-ALPN-01) before this date or your certificate renewals will break and existing certificates will start to expire.
Our staging environment already has TLS-SNI-01 disabled, so if you'd like to test whether your system will work after February 13, you can run against staging: https://letsencrypt.org/docs/staging-environment/ https://letsencrypt.org/docs/staging-environment/
If you're a Certbot user, you can find more information here:
https://community.letsencrypt.org/t/how-to-stop-using-tls-sni-01-with-certbot/83210 https://community.letsencrypt.org/t/how-to-stop-using-tls-sn...
Our forum has many threads on this topic. Please search to see if your question has been answered, then open a new thread if it has not:
https://community.letsencrypt.org/ https://community.letsencrypt.org/
For more information about the TLS-SNI-01 end-of-life please see our API announcement:
https://community.letsencrypt.org/t/february-13-2019-end-of-life-for-all-tls-sni-01-validation-support/74209 https://community.letsencrypt.org/t/february-13-2019-end-of-...
Thank you,
Let's Encrypt Staff
- opless 8y agoHopefully Ubuntu has updated certbot to support this.
- GuyPostington 8y agoIf not, installing from pip is always an option. `pip install --upgrade --user certbot`
- schoen 8y agoWe would really suggest using certbot-auto instead because it will create a venv for you so that you don't get version conflicts elsewhere. (It does use pip behind the scenes, but in a venv.)
- GuyPostington 8y agoThat's a good point, thank you.
- gamegod 8y agoThey have updated, just `apt-get upgrade`.
- rlpb 8y agoUbuntu Server developer involved with Certbot here. I have posted elsewhere in this discussion with details.