let's encrypt certificate renewal on mail fails

Question

I have to renew the email certificate but it does not renew when I try to do manually.

root@ubuntu:/etc/postfix# certbot -d mail.gamesyap.com --manual --preferred-challenges dns certonly
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for mail.gamesyap.com

-------------------------------------------------------------------------------
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
-------------------------------------------------------------------------------
(Y)es/(N)o: y

-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.mail.gamesyap.com with the following value:

9He32h8kCKBOXp67WHh4e927qaSBeVoNxQXLTUqispA

Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. mail.gamesyap.com (dns-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect TXT record "hYExcCMnSyNbDeoO5-CM40CPD6BirJP_8yAKI29Chh8" found at _acme-challenge.mail.gamesyap.com

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: mail.gamesyap.com
   Type:   unauthorized
   Detail: Incorrect TXT record
   "hYExcCMnSyNbDeoO5-CM40CPD6BirJP_8yAKI29Chh8" found at
   _acme-challenge.mail.gamesyap.com

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

But the renewal of the certificate doesn't work.

Any ideas?

Answer 1

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: mail.gamesyap.com
   Type:   unauthorized
   Detail: Incorrect TXT record
   "hYExcCMnSyNbDeoO5-CM40CPD6BirJP_8yAKI29Chh8" found at
   _acme-challenge.mail.gamesyap.com

This part says exactly what the error is.

The verification process expected to find 9He32h8kCKBOXp67WHh4e927qaSBeVoNxQXLTUqispA, but actually found hYExcCMnSyNbDeoO5-CM40CPD6BirJP_8yAKI29Chh8. Did you actually follow the on screen instructions, and update the TXT record? If not, then that's the problem.

If you followed the on screen instructions and updated the TXT record, you either set it to the wrong value, or your DNS provider has a issue.

You can verify the record manually by using dig:

[~]$ dig +short txt _acme-challenge.mail.gamesyap.com
"hYExcCMnSyNbDeoO5-CM40CPD6BirJP_8yAKI29Chh8"
[~]$ 

dig is part of the dnsutils package, and can be installed with sudo apt-get install dnsutils

Note that the challenge code will be a new one on each run of the certbot.