Renewal

[acartapanis]

Thanks for this script, it is perfectly working ... but for creation only ! Il would be great if it can also work for renewal. I give a try replacing "certonly" verb by "renew", but it is not working well, as it only renew the first certificate of the list. Then it tries to delete an acme challenge for the second one, before even creating it.

Here is the output for the second execution :

Saving debug log to /home/kops/infra/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Processing /home/kops/infra/letsencrypt/renewal/srv1.exemple.com.conf
-------------------------------------------------------------------------------
Cert not yet due for renewal

-------------------------------------------------------------------------------
Processing /home/kops/infra/letsencrypt/renewal/srv2.exemple.com.conf
-------------------------------------------------------------------------------
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator manual, Installer None
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for srv2.exemple.com
Output from certbot-route53-renew.sh:
1

Waiting for verification...
Cleaning up challenges
Output from certbot-route53-renew.sh:
1


-------------------------------------------------------------------------------
new certificate deployed without reload, fullchain is
/home/kops/infra/letsencrypt/live/srv2.exemple.com/fullchain.pem
-------------------------------------------------------------------------------

-------------------------------------------------------------------------------
Processing /home/kops/infra/letsencrypt/renewal/srv3.exemple.com.conf
-------------------------------------------------------------------------------
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator manual, Installer None
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for srv3.exemple.com
Output from certbot-route53-renew.sh:
1

Error output from certbot-route53-renew.sh:

An error occurred (InvalidChangeBatch) when calling the ChangeResourceRecordSets operation: Tried to delete resource record set [name='_acme-challenge.srv3.exemple.com.', type='TXT'] but it was not found
usage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]
To see help text, you can run:

  aws help
  aws <command> help
  aws <command> <subcommand> help
aws: error: argument --id: expected one argument

Waiting for verification...
Cleaning up challenges
Output from certbot-route53-renew.sh:
1

Error output from certbot-route53-renew.sh:

An error occurred (InvalidChangeBatch) when calling the ChangeResourceRecordSets operation: Tried to delete resource record set [name='_acme-challenge.srv3.exemple.com.', type='TXT'] but it was not found
usage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]
To see help text, you can run:

  aws help
  aws <command> help
  aws <command> <subcommand> help
aws: error: argument --id: expected one argument

Attempting to renew cert (srv3.exemple.com) from /home/kops/infra/letsencrypt/renewal/srv3.exemple.com.conf produced an unexpected error: Failed authorization procedure. srv3.exemple.com (dns-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.srv3.exemple.com. Skipping.
The following certs could not be renewed:
  /home/kops/infra/letsencrypt/live/srv3.exemple.com/fullchain.pem (failure)

-------------------------------------------------------------------------------

The following certs are not due for renewal yet:
  /home/kops/infra/letsencrypt/live/srv1.exemple.com/fullchain.pem (skipped)
The following certs were successfully renewed:
  /home/kops/infra/letsencrypt/live/srv2.exemple.com/fullchain.pem (success)

The following certs could not be renewed:
  /home/kops/infra/letsencrypt/live/srv3.exemple.com/fullchain.pem (failure)
-------------------------------------------------------------------------------
1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: srv3.exemple.com
   Type:   connection
   Detail: DNS problem: NXDOMAIN looking up TXT for
   _acme-challenge.srv3.exemple.com

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.```