Resolved Let's Encrypt - 403

[Solarom]

Hello,

When I try to renew the certificate for one of my domains, an error with status 403 appears :

Error: Could not issue a Let's Encrypt SSL/TLS certificate for as-sellerie.fr
Authorization for the domain failed.
Details Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/13732064593.
Details:
Type: urn:ietfarams:acme:error:unauthorized
Status: 403
Detail: Incorrect TXT record "EiLQK-WtYAANG7V-VEB0vQqubN6yFgyvEzjzbWLIHGY" found at _acme-challenge.as-sellerie.fr

This error only occurs with this domain. The _acme-challenge.as-sellerie.fr DNS record updates in Plesk, but it doesn't propagate.

When I run the command "dig TXT _acme-challenge.as-sellerie.fr + short" in SSH, it returns: "EiLQK-WtYAANG7V-VEB0vQqubN6yFgyvEzjzbWLIHGY". It doesn't match the new recording.

I followed Plesk's advice on this link :

Unable to issue or renew Let's Encrypt certificate when external DNS server is used: Incorrect TXT record

Applicable to: Plesk for Linux Symptoms It is not posible to issue or renew Let's Encrypt SSL/TLS certificate. The following error appears in Plesk or in a mail sent to the user's mailbox: Err...

support.plesk.com

But I don't know how to do step 6 of solving :

6 - If it does not resolve, add the record to the external DNS server, removing other existing acme-challenge records from there.

Can you help me please ?

 

[Solarom]

UP, please :'(

 

[Monty]

Your DNS zone is not delegated to your Plesk server:
# dig +short as-sellerie.fr NS
ns8.lwsdns.com.
ns5.lwsdns.com.
ns6.lwsdns.com.
ns7.lwsdns.com.

So anything you do in the DNS zone in Plesk will not have any effect on the "real world".

Solution 1: Delegate the zone as-sellerie.fr to your Plesk server at your registrar

Solution 2: Update the TXT record manually at your DNS provider and re-perform the validation

Solution 3: Check if your DNS provider has an API that is supported by Plesk (see the comments in the KB article you posted)

Solution 4: Do not create a wildcard Let's Encrypt certificate (which uses the DNS-challenge) but use the HTTP-challenge instead, eliminating the need for DNS updates to your zone for the certificate validation

 

[pleskpanel]

Solution 4: Do not create a wildcard Let's Encrypt certificate (which uses the DNS-challenge) but use the HTTP-challenge instead, eliminating the need for DNS updates to your zone for the certificate validation

Truly one of the best approaches to a seamless issuance/renewal process!

 

[Solarom]

Thanks for your help.
The problem was resolved.