certbot certonly \
--force-renew \
--manual \
--manual-public-ip-logging-ok \
--allow-subset-of-names --text \
--non-interactive \
--keep-until-expiring \
--debug \
--expand \
--no-self-upgrade \
--agree-tos \
--config-dir "/mnt/efs/letsencrypt/config" \
--work-dir "/mnt/efs/letsencrypt/work" \
--logs-dir "/mnt/efs/letsencrypt/logs" \
#{domains}
Traceback (most recent call last):
File "/usr/bin/certbot", line 11, in <module>
load_entry_point('certbot==1.14.0', 'console_scripts', 'certbot')()
File "/usr/lib/python3.8/site-packages/certbot/main.py", line 15, in main
return internal_main.main(cli_args)
File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1435, in main
return config.func(config, plugins)
File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1304, in certonly
lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 129, in _get_and_save_cert
renewal.renew_cert(config, domains, le_client, lineage)
File "/usr/lib/python3.8/site-packages/certbot/_internal/renewal.py", line 341, in renew_cert
new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)
File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 390, in obtain_certificate
cert, chain = self.obtain_certificate_from_csr(csr, orderr)
File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 291, in obtain_certificate_from_csr
orderr = self.acme.finalize_order(orderr, deadline,
File "/usr/lib/python3.8/site-packages/acme/client.py", line 920, in finalize_order
return cast(ClientV2, self.client).finalize_order(
File "/usr/lib/python3.8/site-packages/acme/client.py", line 742, in finalize_order
self._post(orderr.body.finalize, wrapped_csr)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 86, in _post
return self.net.post(*args, **kwargs)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 1198, in post
return self._post_once(*args, **kwargs)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 1211, in _post_once
response = self._check_response(response, content_type=content_type)
File "/usr/lib/python3.8/site-packages/acme/client.py", line 1068, in _check_response
raise messages.Error.from_json(jobj)
acme.messages.Error: urn:ietf:params:acme:error:caa :: Certification Authority Authorization (CAA) records forbid the CA from issuing a certificate :: Error finalizing order :: Rechecking CAA for "xxxxx.xxxx.xx" and 1 more identifiers failed. Refer to sub-problems for more information
Instead, Certbot panics when it finds CAA records that forbid the CA from issuing a certificate for one of the names, and does not continue to issue a certificate for the rest of the names.
My operating system is (include version):
Fedora 32
I installed Certbot with (snap, OS package manager, pip, certbot-auto, etc):
dnf (OS package manager)
I ran this command and it produced this output:
Certbot's behavior differed from what I expected because:
When using
--allow-subset-of-namesI expect certbot to issue a certificate for any names that do not have errors, even if some do have errors.Instead, Certbot panics when it finds CAA records that forbid the CA from issuing a certificate for one of the names, and does not continue to issue a certificate for the rest of the names.