I am confused about the new auto-renewal, Lets Encrypt/DuckDNS changes. I have both enabled in Hass.io v 55.2.
The logs for the Hass.io Let’s Encrypt show an auto-renewal error.
starting version 3.2.2
Saving debug log to /var/log/letsencrypt/letsencrypt.log
-------------------------------------------------------------------------------
Processing /data/letsencrypt/renewal/XXXX.duckdns.org.conf
-------------------------------------------------------------------------------
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for XXXX.duckdns.org
Waiting for verification...
Cleaning up challenges
Attempting to renew cert from /data/letsencrypt/renewal/XXXX.duckdns.org.conf produced an unexpected error: Failed authorization procedure. XXXX.duckdns.org (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 294c59af4d40ccb620191322819XXXX1f84e.fcdcca5999d41de0b885c67ab29929bb.acme.invalid from 134.144.235.58:443. Received 2 certificate(s), first certificate had names "XXXX.duckdns.org". Skipping.
All renewal attempts failed. The following certs could not be renewed:
/data/letsencrypt/live/XXXX.duckdns.org/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: XXXX.duckdns.org
Type: unauthorized
Detail: Incorrect validation certificate for tls-sni-01 challenge.
Requested
294c59af4d40ccb62019XXXX13228191f84e.fcdcca5999d41de0b885c67ab29929bb.acme.invalid
from 134.144.235.58:443. Received 2 certificate(s), first
certificate had names "XXXX.duckdns.org"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
You only use one of them, if your using DuckDNS just install the DuckDNS one and it will look after letsencrypt too OR if using your own domain or a different DNS service install letsencrypt.
If you need another DNS service whilst still using letsencrypt you can look at my addon, it works with any Dynamic DNS service provider. You can even use it in lieu of the DuckDNS addon if you are having trouble with it specifically or just prefer to use letsencrypt addon separately.
So since I have both installed now, I should uninstall LetsEncrypt component and remove the settings in configuration.yaml file under the http: heading? Is there anything special I need to do to DuckDNS? I don’t have any configuration.yaml setting for duckdns. It was installed with he handy hass.io installer.
Thanks. I tried putting the letsencrypt part of the json entries like the link you so kindly provided, but after saving, a restart makes it go back to the way it was.
For future reference, My DuckDNS addon was at version 0.6. It was set for AutoUpdate. I could not get it to accept the new letsencrypt parameters. I uninstalled DuckDNS and reinstalled it. The version was changed to 1.0 and the letsencrypt parameters were already added. I just needed to update the nulls with my token and domain. It looks like it is working. No errors yet in the logs.