Trellis: Let's encrypt error due to new agreement url
Bug report
When I try to reprovision the server, I get an error on the [letsencrypt : Generate the certificates] task. Looks like the agreement url changed today, on the 15th of November.
I already had a certificate with this subdomain. I rebuilt the droplet on DO.
What also feels wrong is that the old URL https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf works whereas the new one doesn't https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf ?
Please provide steps to reproduce, including full log output:
non-zero return code
fatal: [mr-green.floid.ch]: FAILED! => {"changed": false, "cmd": ["./renew-certs.py"], "delta": "0:00:00.491843", "end": "2017-11-15 10:54:30.919082", "failed": true, "rc": 1, "start": "2017-11-15 10:54:30.427239", "stderr": "", "stderr_lines": [], "stdout": "Generating certificate for mr-green.floid.ch\nError while generating certificate for mr-green.floid.ch\nTraceback (most recent call last):\n File \"/usr/local/letsencrypt/acme_tiny.py\", line 198, in <module>\n main(sys.argv[1:])\n File \"/usr/local/letsencrypt/acme_tiny.py\", line 194, in main\n signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca)\n File \"/usr/local/letsencrypt/acme_tiny.py\", line 92, in get_crt\n raise ValueError(\"Error registering: {0} {1}\".format(code, result))\nValueError: Error registering: 400 {\n \"type\": \"urn:acme:error:malformed\",\n \"detail\": \"Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]\",\n \"status\": 400\n}", "stdout_lines": ["Generating certificate for mr-green.floid.ch", "Error while generating certificate for mr-green.floid.ch", "Traceback (most recent call last):", " File \"/usr/local/letsencrypt/acme_tiny.py\", line 198, in <module>", " main(sys.argv[1:])", " File \"/usr/local/letsencrypt/acme_tiny.py\", line 194, in main", " signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca)", " File \"/usr/local/letsencrypt/acme_tiny.py\", line 92, in get_crt", " raise ValueError(\"Error registering: {0} {1}\".format(code, result))", "ValueError: Error registering: 400 {", " \"type\": \"urn:acme:error:malformed\",", " \"detail\": \"Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]\",", " \"status\": 400", "}"]}
Please describe your local environment:
Ansible version: 2.4.1.0
OS: 10.12.6
Vagrant version: 1.9.5
Where did the bug happen? Development or remote servers?
Staging environment
vdrnn
All 8 comments
Seems like this is a acme.sh specific problem. I stumbled upon this issue but doesn't get me any further for now https://github.com/Neilpang/acme.sh/issues/1112
vdrnn
on 15 Nov 2017
swalkinshaw
on 15 Nov 2017
I got the same error today
TASK [letsencrypt : Generate the certificates] ***********
System info:
Ansible 2.4.2.0; Darwin
Trellis at "Bump Ansible version_tested_max to 2.4.2.0"
non-zero return code
fatal: [159.89.23.36]: FAILED! => {"changed": false, "cmd": ["./renew-certs.py"], "delta": "0:00:01.432599", "end": "2018-01-16 14:42:40.194274", "rc": 1, "start": "2018-01-16 14:42:38.761675", "stderr": "", "stderr_lines": [], "stdout": "Generating certificate for 159.89.23.36\nError while generating certificate for 159.89.23.36\nTraceback (most recent call last):\n File \"/usr/local/letsencrypt/acme_tiny.py\", line 198, in
pawelkleczek
on 16 Jan 2018
Same; receiving the below when provisioning with ssl: true and letsencrypt.
Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]
jrgd
on 16 Jan 2018
Future readers: Related issues are most likely support questions more applicable for discussion at https://discourse.roots.io/ rather than issues for this GitHub bug tracker.
@pawelkleczek The error you posted appears different than the original issue. Note:
"detail": "Error creating new authz :: Issuance for IP addresses not supported"
If using SSL enabled: true and provider: letsencrypt you must not use an IP in site_hosts. If your reason for using an IP is that you're still in development and don't yet have public DNS set up, you could omit the IP from site_hosts (use domain names instead) and fake DNS using your local machine's /etc/hosts file. Or if you must use an IP in site_hosts during development, you may need to use provider: self-signed or disable SSL.
@jrgd It appears your Trellis needs the update in #921 as mentioned above.
Closed by #921
fullyint
on 16 Jan 2018
Thanks man, that was it!
pawelkleczek
on 17 Jan 2018
Same error is happening on my website http://gulfday.com
see the attached screenshot..
Anybody up for the help ?
faheemrazaa
on 27 Feb 2018
I was getting this error even after I changed my IP's to domains in my host file.
Where I went wrong: I had my CNAME record for www pointed to "@" in DNS.
Solution: I deleted that CNAME record and created an A record that pointed to the server IP address, I was able to run ansible-playbook server.yml -e env=production --tags letsencrypt and all of the tasks completed successfully.
TASK [letsencrypt : Generate the certificates]
System info:
Ansible 2.6.1; Darwin
Trellis version (per changelog): "Update xdebug tunnel configuration"
non-zero return code
fatal: [rampartls.com]: FAILED! => {"changed": false, "cmd": ["./renew-certs.py"], "delta": "0:00:00.500485", "end": "2018-07-18 15:46:40.898560", "rc": 1, "start": "2018-07-18 15:46:40.398075", "stderr": "", "stderr_lines": [], "stdout": "Generating certificate for rampartls.com\nError while generating certificate for rampartls.com\nTraceback (most recent call last):\n File \"/usr/local/letsencrypt/acme_tiny.py\", line 198, in <module>\n main(sys.argv[1:])\n File \"/usr/local/letsencrypt/acme_tiny.py\", line 194, in main\n signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca)\n File \"/usr/local/letsencrypt/acme_tiny.py\", line 123, in get_crt\n wellknown_path, wellknown_url))\nValueError: Wrote file to /srv/www/letsencrypt/D4atj0lwRWT0dOJ_mry49TvlkN-6T7do2ymZbrQC3-g, but couldn't download http://www.rampartls.com/.well-known/acme-challenge/D4atj0lwRWT0dOJ_mry49TvlkN-6T7do2ymZbrQC3-g", "stdout_lines": ["Generating certificate for rampartls.com", "Error while generating certificate for rampartls.com", "Traceback (most recent call last):", " File \"/usr/local/letsencrypt/acme_tiny.py\", line 198, in <module>", " main(sys.argv[1:])", " File \"/usr/local/letsencrypt/acme_tiny.py\", line 194, in main", " signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca)", " File \"/usr/local/letsencrypt/acme_tiny.py\", line 123, in get_crt", " wellknown_path, wellknown_url))", "ValueError: Wrote file to /srv/www/letsencrypt/D4atj0lwRWT0dOJ_mry49TvlkN-6T7do2ymZbrQC3-g, but couldn't download http://www.rampartls.com/.well-known/acme-challenge/D4atj0lwRWT0dOJ_mry49TvlkN-6T7do2ymZbrQC3-g"]}
ghettifish
on 18 Jul 2018
Related issues
nathanielks
路
6Comments
MasonFI
路
5Comments
swalkinshaw
路
8Comments
joejordanbrown
路
8Comments
baradhili
路
8Comments
Most helpful comment
Future readers: Related issues are most likely support questions more applicable for discussion at https://discourse.roots.io/ rather than issues for this GitHub bug tracker.
@pawelkleczek The error you posted appears different than the original issue. Note:
If using SSL
enabled: trueandprovider: letsencryptyou must not use an IP insite_hosts. If your reason for using an IP is that you're still in development and don't yet have public DNS set up, you could omit the IP fromsite_hosts(use domain names instead) and fake DNS using your local machine's/etc/hostsfile. Or if you must use an IP insite_hostsduring development, you may need to useprovider: self-signedor disable SSL.@jrgd It appears your Trellis needs the update in #921 as mentioned above.