Certbot ошибки когда много аккаунтов

Продлить нужно сертификат для почтового сервера

Сначала проверяем nginx конфиг для почтового домена

server

{

        listen 1.2.3.4:80;

        server_name mail.domain.tld;

        # letsencrypt

        location ~ ^/\.well-known {

            auth_basic off;

            allow all;

            root /home/www/acme;

        }

        location ~ ^/\.well-known/acme-challenge

        {

            auth_basic off;

            allow all;

            root /home/www/acme;

        }

}

По факту в letsencrypt один аккаунт в папке v01 и два аккаунта в v02 (причина ошибок)

acme-v01.api.letsencrypt.org
acme-v02.api.letsencrypt.org

certbot certificates
Проверить статус сертификатов. Вижу, что сертификат почтовика просрочен.

certbot версии 0.23.0, запускаем с проверкой

/usr/bin/certbot certonly --webroot -w /home/www/acme -d mail.domain.tld --email testcert@domain.tld --non-interactive --agree-tos --dry-run




Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Missing command line flag or config entry for this setting:
Please choose an account
Choices: ['account1@2018-04-15T18:57:03Z (03b3)', 'account2@2018-05-05T10:41:18Z (ebb1)']

03b3 и ebb1 это начала имен аккаунтов

Один аккаунт v02 временно перенес (а в будущем нужно удалить и заменить все на один в конфигах renew) из папки

/etc/letsencrypt/accounts/acme-staging.api.letsencrypt.org/directory

после этого повтор теста

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator webroot, Installer None

Attempting to parse the version 0.28.0 renewal configuration file found at /etc/letsencrypt/renewal/domain.tld.conf with version 0.23.0 of Certbot. This might not work.

Cert is due for renewal, auto-renewing...

Renewing an existing certificate

Performing the following challenges:

http-01 challenge for mail.domain.tld

Using the webroot path /home/www/acme for all unmatched domains.

Waiting for verification...

Cleaning up challenges

IMPORTANT NOTES:

 - The dry run was successful.

тест прошел, можно продлевать

/usr/bin/certbot certonly --webroot -w /home/www/acme -d mail.domain.tld --email testcert@cba.pl --non-interactive --agree-tos

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator webroot, Installer None

Attempting to parse the version 0.28.0 renewal configuration file found at /etc/letsencrypt/renewal/domain.tld.conf with version 0.23.0 of Certbot. This might not work.

Cert is due for renewal, auto-renewing...

Renewing an existing certificate

Performing the following challenges:

http-01 challenge for mail.domain.tld

Using the webroot path /home/www/acme for all unmatched domains.

Waiting for verification...

Cleaning up challenges

IMPORTANT NOTES:

 - Congratulations! Your certificate and chain have been saved at:

   /etc/letsencrypt/live/mail.domain.tld/fullchain.pem

   Your key file has been saved at:

   /etc/letsencrypt/live/mail.domain.tld/privkey.pem

   Your cert will expire on 2019-06-30. To obtain a new or tweaked

   version of this certificate in the future, simply run certbot

   again. To non-interactively renew *all* of your certificates, run

   "certbot renew"

 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate

   Donating to EFF:                    https://eff.org/donate-le

После этого нужно сделать reload для postfix