# Let's Encrypt issue when adding new domain to multisite **URL:** https://discourse.roots.io/t/lets-encrypt-issue-when-adding-new-domain-to-multisite/7021 **Category:** trellis **Created:** 2016-06-21T08:57:14Z **Posts:** 16 ## Post 1 by @Foazino — 2016-06-21T08:57:15Z I have a multisite setup. The point of this website means that it involves adding new domain names on a regular basis. I do this by adding the new domain name, for example `domain2.com`, to the `wordpress_sites.yml` file like this: ``` site_hosts: - domain1.com - domain2.com ``` I use Let’s Encrypt for SSL certificates, which worked like a charm for the initial domains – but not for the domains I added later. At first I got an error when running `ansible-playbook server.yml -e env=production` that the DNS record should point to the webserver (which it already did), but I solved that by setting ``` ssl: enabled: false ``` Then running `ansible-playbook server.yml -e env=production`, change it back to ``` ssl: enabled: true ``` And then running `ansible-playbook server.yml -e env=production` again. I think the DNS Let’s Encrypt error stopped Nginx from updating the vhost. This way Let’s Encrypt had no way to reach the webserver to verify it. After that verification worked like a charm and I got all greens when running the server playbook. The problem is that Chrome returns a red lock saying the certificate is not valid for `domain2.com`. Yet is still is valid for `domain1.com`. Is this because there was already a certificate issued for the main domain? If so, how do I go about fixing this? --- ## Post 2 by @Foazino — 2016-06-24T12:32:08Z Do I need to provide more information or am I being to impatient :slight_smile: --- ## Post 3 by @Simeon — 2016-07-12T20:47:00Z I’m having this exact issue. I’ve got the following in my site\_hosts, and like you resolved the error about all the domains DNS records not pointing at the server. But now still get warnings in Chrome for everything but the first domain ``` site_hosts: - domain1.com - subdomain.domain1.com - domain2.com ``` Error in chrome is ERR\_CERT\_COMMON\_NAME\_INVALID --- ## Post 4 by @cfx — 2016-07-12T23:01:45Z You [both] might get some use out of the troubleshooting steps [here](https://discourse.roots.io/t/lets-encrypt-certificate-expired/7171). --- ## Post 5 by @Simeon — 2016-07-12T23:07:31Z Thanks for the link, I tried `cd /var/lib/letsencrypt && sudo ./renew-certs.py` And get… ``` Certificate file /etc/nginx/ssl/letsencrypt/domain1.cert already exists The certificate is younger than 60 days. Not creating a new certificate. ``` So something must be up with the configuration just not recognising the other two domains and creating certificates for them. Which is odd because I was having issues with the DNS yesterday where it was asking to double check that correct A Records all existed – and they do now – so some part of the server provisioning understands that there’s three domains but something else doesn’t recognise them. --- ## Post 6 by @cfx — 2016-07-12T23:22:34Z There are other troubleshooting steps in that thread, did you try any? --- ## Post 7 by @Simeon — 2016-07-12T23:36:54Z Yeah but that was the only one that yielded a noteworthy result… And the OP in that thread resolved the issue because the DNS was incorrectly configured, which I’m almost certainly sure isn’t the case here since I can correctly ping the root and www. versions of all three domains in my site\_hosts. --- ## Post 8 by @Simeon — 2016-07-13T00:52:28Z “Solved” this by wiping the development server and starting over. Not ideal, but it worked, and the site was only new so nothing lost. There must have been some config file or something to do with Let’s Encrypt being left on the server and not being removed or overwritten once site\_hosts was updated. Is there a way to forcibly remove all existing traces of Let’s Encrypt from the server and have the certificates remade? --- ## Post 9 by @cfx — 2016-07-13T21:12:48Z Just got to this part of my multisite journey and was able to figure it out without a complete reprovision. Here’s what I did: 1. SSH to remote. 2. `$ sudo rm -rf /var/lib/letsencrypt /usr/local/letsencrypt /srv/www/letsencrypt /etc/nginx/ssl/letsencrypt /etc/ssl/certs/lets-encrypt-x3-cross-signed.pem` which should remove all remnants of the existing certificates. 3. On local machine in your Trellis project dir run `$ ansible-playbook server.yml -e environment= --tags "letsencrypt"` which should generate new certificates. 4. It wasn’t necessary on my setup, but power cycling your remote may be necessary in some cases: `$ sudo shutdown -r now`. After that my main domain and subdomain were all super green :thumbsup: --- ## Post 10 by @Simeon — 2016-07-13T23:55:55Z That totally looks like it would work. I wonder if a future version of Trellis might be smart enough to detect if there’s new `site_hosts` and remove all existing `letsencrypt` data… but that’s above my pay grade. I ended up taking a lot of notes during my multisite install, was thinking of writing them up somewhere since the official docs are a bit light on … and I came across a few of the same errors over and over. --- ## Post 11 by @cfx — 2016-07-14T05:19:45Z Yes, my journey through multisite has given me the same ideas. It could just as easily be turned into its own playbook that you just run when needed. `new_ssl.yml` or something similar. Also, @Simeon, feel free to contribute to the docs :thumbsup: Btw so far I only tried this with subdomains. I may try it with subfolders and domain mapping shortly, just to be adventurous. I should also mention that I’m using [a mu-plugin for Bedrock](https://github.com/felixarntz/bedrock/blob/b899d0e84b6ad0044b9b6280ea6329dc5452ac03/web/app/mu-plugins/ms-url-fixer.php) from [a pending Github pull request](https://github.com/roots/bedrock/pull/251) to fix main site URLs which eliminates the need for db URL tweaking and @darjanpanic’s fix [here](https://discourse.roots.io/t/wp-multisite-primary-site-accessible-using-wp/5312/13?u=cfx). That fix does the trick but ends up removing `/wp/` from the admin paths and that creeps me out. --- ## Post 12 by @dorvidas — 2017-08-17T08:34:12Z This worked. I didn’t need step 4. --- ## Post 14 by @rinat — 2017-10-19T18:36:53Z If anyone struggles with this issue, the easiest way to work around that is using certbot - [https://certbot.eff.org/](https://certbot.eff.org/) I had issues where Ansible hangs on “Test ACME challenges”, and then if I comment that out of the letsencrypt role, it failed on “Generate certificates”. Turning ssl off and on and re-provisioning will take your https version offline. Certbot has nginx plugin and generating new certficates is as easy as `sudo certbot --nginx` and following instructions, no downtime, takes like 30 seconds. --- ## Post 15 by @strarsis — 2017-10-19T20:23:33Z Yes, it would be great if Trellis could switch to certbox nginx plugin now. --- ## Post 16 by @hit_jethva — 2020-08-26T09:14:20Z I am getting the following error while installing Let’s Encrypt certificate on my domain: Saving debug log to /var/log/letsencrypt/letsencrypt.log Obtaining a new certificate Performing the following challenges: http-01 challenge for [linuxbuz.com](http://linuxbuz.com) http-01 challenge for [www.linuxbuz.com](http://www.linuxbuz.com) Using the webroot path /var/www/html for all unmatched domains. Waiting for verification… Cleaning up challenges Failed authorization procedure. [linuxbuz.com](http://linuxbuz.com) (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from [http://linuxbuz.com/.well-known/acme-challenge/pYpAC6kT25C0itcTNKd8hwb\_0VaoPxJVIkVg5\_xn-N4](http://linuxbuz.com/.well-known/acme-challenge/pYpAC6kT25C0itcTNKd8hwb_0VaoPxJVIkVg5_xn-N4) [77.111.240.95]: 403