[andy/dehydrated.git] / docs / troubleshooting.md

# Troubleshooting

Generally if the following information doesn't provide a solution to your problem please take a look at existing issues (search for keywords) before creating a new one.

## "No registration exists matching provided key"

You probably changed from staging-CA to production-CA (or the other way).

Currently dehydrated.sh doesn't detect a missing registration on the selected CA,
the current workaround is to move `private_key.pem` (and, if you care, `private_key.json`) out of the way so the scripts generates and registers a new one.

This will hopefully be fixed in the future.

## "Provided agreement URL [LICENSE1] does not match current agreement URL [LICENSE2]"

Set LICENSE in your config to the value in place of "LICENSE2".

LICENSE1 and LICENSE2 are just placeholders for the real values in this troubleshooting document!

## "Error creating new cert :: Too many certificates already issued for: [...]"

This is not an issue with dehydrated.sh but an API limit with boulder (the ACME server).

At the time of writing this you can only create 5 certificates per domain in a sliding window of 7 days.

## "Certificate request has 123 names, maximum is 100."

This also is an API limit from boulder, you are requesting to sign a certificate with way too many domains.

## Invalid challenges

There are a few factors that could result in invalid challenges.

If you are using http validation make sure that the path you have configured with WELLKNOWN is readable under your domain.

To test this create a file (e.g. `test.txt`) in that directory and try opening it with your browser: `http://example.org/.well-known/acme-challenge/test.txt`.

If you get any error you'll have to fix your webserver configuration.
Commit	Line	Data
12c77ca5 LS	1	# Troubleshooting
	2
	3	Generally if the following information doesn't provide a solution to your problem please take a look at existing issues (search for keywords) before creating a new one.
	4
	5	## "No registration exists matching provided key"
	6
	7	You probably changed from staging-CA to production-CA (or the other way).
	8
64e35463	9	Currently dehydrated.sh doesn't detect a missing registration on the selected CA,
12c77ca5 LS	10	the current workaround is to move `private_key.pem` (and, if you care, `private_key.json`) out of the way so the scripts generates and registers a new one.
	11
	12	This will hopefully be fixed in the future.
	13
cf80ccc5 LS	14	## "Provided agreement URL [LICENSE1] does not match current agreement URL [LICENSE2]"
	15
	16	Set LICENSE in your config to the value in place of "LICENSE2".
	17
	18	LICENSE1 and LICENSE2 are just placeholders for the real values in this troubleshooting document!
	19
12c77ca5 LS	20	## "Error creating new cert :: Too many certificates already issued for: [...]"
12c77ca5 LS	21
64e35463	22	This is not an issue with dehydrated.sh but an API limit with boulder (the ACME server).
12c77ca5 LS	23
	24	At the time of writing this you can only create 5 certificates per domain in a sliding window of 7 days.
	25
7838191d LS	26	## "Certificate request has 123 names, maximum is 100."
7838191d LS	27
64e35463	28	This also is an API limit from boulder, you are requesting to sign a certificate with way too many domains.
7838191d	29
12c77ca5 LS	30	## Invalid challenges
	31
	32	There are a few factors that could result in invalid challenges.
	33
	34	If you are using http validation make sure that the path you have configured with WELLKNOWN is readable under your domain.
	35
	36	To test this create a file (e.g. `test.txt`) in that directory and try opening it with your browser: `http://example.org/.well-known/acme-challenge/test.txt`.
	37
	38	If you get any error you'll have to fix your webserver configuration.