Trellis: Let's Encrypt ACMEv1 end of life.

[amelotrgr]

• [x] I've read the [guidelines for Contributing to Roots Projects (https://github.com/roots/.github/blob/master/CONTRIBUTING.md)
• [x] This request isn't a duplicate of an existing issue
• [x] I've read the docs and followed them (if applicable)
• [x] This is not a personal support request that should be posted on the Roots Discourse community

Description

According to the official website, this ACME version 1 was disabled on October 1st for staging websites and it will be disabled for production on November 1st. Please see the dates on the website below:

https://calendar.google.com/calendar/embed?src=letsencrypt.org_caqskun93lgiabjj4ba9cb1rek%40group.calendar.google.com

Steps to reproduce

1. Run the provisioning to stage through the Ansible playbook server.yml.

Expected behavior: Error at the step: TASK [letsencrypt : Generate the certificates]

Actual behavior: It is showing this error:
Account creation on ACMEv1 is disabled. Please upgrade your ACME client to a version that supports ACMEv2 / RFC 8555. See https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430 for details.

Reproduces how often: 100%

Versions

Ansible: 2.7.5
Trellis: 1.1.0
macOS Mojave: 10.14.6 (18G103)

Additional information

You can find more details on the link below:
https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430

[swalkinshaw]

😨 thanks for letting us know about this, I had no idea. I've got an initial PR up at https://github.com/roots/trellis/pull/1114.

Definitely needs more testing and possible more work!

[lekkerduidelijk]

I can confirm your PR works. I've just applied the diff from the commit with

patch -p1 < 16d2cf8e96ed01357386ed8f4a498d5e713836ce.diff

and was able to provision Lets Encrypt. 💪

[kennethptchr]

Was also able to provision a new letsencrypt certificate on my end, so it seems to work, thanks @swalkinshaw

[amelotrgr]

I tested several times to different domains and I can confirm that the Lets Encrypt v2 patch is working fine. You're a Ninja.

[swalkinshaw]

Thank you for testing this 🙇 I'm publishing a release tonight to ensure everyone has as much time as possible to get this update. If you don't want to upgrade to a new release, at least apply the patch as @lekkerduidelijk suggested 😄

[swalkinshaw]

I just published a thread on our forums with more details on this: https://discourse.roots.io/t/trellis-and-lets-encrypt-v1-end-of-life/16816/2

The most important part:

Existing Trellis sites should continue work for renewing certificates until June 2021. This is because if you’ve provisioned prior to Nov 2019, your account will already exist.