Trellis Let’s Encrypt does not yet handle changes to the domains in the certs (e.g., changing a cert from staging.example.com to just example.com). This will be addressed in roots/trellis#630 or some variant. In the meantime, you could SSH in to the remote and
- delete the CSRs in
- delete the certs in
ansible-playbook server.yml -e env=production --tags letsencrypt
(or you could rebuild the production server completely to wipe out the files above)
After completing the steps above for production (hopefully they work), try the staging again. If this new server for staging already had some Trellis Let’s Encrypt stuff on it, you may need to delete the certs and CRS on this server too.
You’ve changed the server and IP for your staging site, so be sure you’ve updated DNS with the new IP.
If trouble continues, please share some verbose log output of the problem by using
ansible-playbook server.yml -e env=staging --tags letsencrypt -vvvv
It’s great that you’re using a staging site to test. As a process comment, once staging looks good, I would generally create the production site on a new server, rather than transform the staging server into production. I think of staging not as testing/proving a server, but testing/proving my configs, Trellis playbooks, project code, etc. So, it’s not this particular server (staging) that I trust and must stick with, but the configs and code. So, I’d much prefer a new fresh untampered with server to host my tested and proven code for production.
Maybe you usually put your production sites on fresh servers but this current project required a different approach.