[let's encrypt]렛츠인크립트 인증 오류 대처법

certbot renew명령어를 여러번 입력해도 갱신이 안되었고 인증요청 초과로 아래와 같은 에러가 났다.

 

There were too many requests of a given type :: Error creating new order :: too many failed authorizations recently

히잉;;

 

[root@ip-172-26-8-147 mysqldump]# certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/Test.Domain.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator nginx, Installer nginx
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate for Test.Domain
Performing the following challenges:
http-01 challenge for Test.Domain
Using default address 80 for authentication.
Waiting for verification...
Challenge failed for domain Test.Domain
http-01 challenge for Test.Domain
Cleaning up challenges
Failed to renew certificate Test.Domain with error: Some challenges have failed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All renewals failed. The following certificates could not be renewed:
  /etc/letsencrypt/live/Test.Domain/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: Test.Domain
   Type:   unauthorized
   Detail: 43.myip.myip.myip: Invalid response from
   http://Test.Domain/.well-known/acme-challenge/UyVXHfhxOcqN_Xj_zTBGOjQmdJC-wl1Qrr5uJ8OXXZE:
   404

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

문제원인 :

1. certbot renew요청에서 ca인증서버가 내 ip에서 요청하는 파일을 전달하지 못했다.
2. 80포트를 tomcat이 모든 request를 핸들링하고 있어서 ca서버에 인증파일을 전달하지 못했다.
3. 없는 파일을 여러번요청 했기 때문에 ca서버 인증에 lock이 걸렸다.

 

해결방법 : 

1. 1~2시간후에 nginx를 재시작한다. (ca서버 lock해제)
2. tomcat을 셧다운한다. (80포트 점유해제)
3. certbot renew입력
4. tomcat 재시작