Wrong agreement URL

[michaelborn]

I get the following error from letsencrypt:

Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]

Is this something I can help fix? I looked, but I don't see any agreement URL hard-coded in the source.

Full error info:

myUser@server:~$ docker run -e "DOMAINS=michaelborn.me *.michaelborn.me" -e TOKEN=`cat ~/.my-access-token` -v ${HOME}/letsencrypt-dns:/mnt -e "ODIR=/mnt/certs" gibby/letsencrypt-dns-digitalocean
# INFO: Using main config file /srv/letsencrypt/config
+ Generating account key...
+ Registering account key with letsencrypt...
  + ERROR: An error occurred while sending post-request to https://acme-staging.api.letsencrypt.org/acme/new-reg (Status 400)

Details:
{
  "type": "urn:acme:error:malformed",
  "detail": "Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]",
  "status": 400
}

Error registering account key. See message above for more information.
Sleeping for 300

[michaelborn]

Here is a lot more info on that error, and explanations of how to properly architect the agreement url: acmesh-official/acme.sh#1112

And here's roughly how to grab that current agreement URL:
https://github.com/Neilpang/acme.sh/blob/master/acme.sh#L2322-L2326

ACME_AGREEMENT=$(echo "$response" | _egrep_o 'terms-of-service" *: *"[^"]*"' | cut -d '"' -f 3)
if [ -z "$ACME_AGREEMENT" ]; then
  ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_AGREEMENT

Looks to me like we'd want to do that ^^ after this line: https://github.com/Gibby/docker-letsencrypt-dns-digitalocean/blob/master/container-files/run.sh#L14

#Default to STAGING CA
STAGING=${STAGING:-yes}
if [ "${STAGING}" = "yes" ]; then
    echo 'CA="https://acme-staging.api.letsencrypt.org/directory"' > /srv/letsencrypt/config
fi

[michaelborn]

@Gibby mind if I take a crack at this?

[michaelborn]

The terms of service agreement url is plainly returned here: https://acme-staging.api.letsencrypt.org/directory

{
  "8dHrmIRnU54": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "key-change": "https://acme-staging.api.letsencrypt.org/acme/key-change",
  "meta": {
    "caaIdentities": [
      "letsencrypt.org"
    ],
    "terms-of-service": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",
    "website": "https://letsencrypt.org/docs/staging-environment/"
  },
  "new-authz": "https://acme-staging.api.letsencrypt.org/acme/new-authz",
  "new-cert": "https://acme-staging.api.letsencrypt.org/acme/new-cert",
  "new-reg": "https://acme-staging.api.letsencrypt.org/acme/new-reg",
  "revoke-cert": "https://acme-staging.api.letsencrypt.org/acme/revoke-cert"
}

... but I'm just not seeing the actual letsencrypt commands where this is pulled.

[Gibby]

@mborn319 go ahead and do a PR if you need it. I actually don't use this anymore but left it up if anybody else was using it.

letsencrypt.sh is coming from https://github.com/lukas2511/letsencrypt.sh so if it is working from there it should work in the container.

[Gibby]

@mborn319 is this still an issue?

[michaelborn]

I never got this working, and I couldn't figure what a "proper" fix would be in the source code. I'd be happy to help if I knew what to fix!

If this plugin is using dehydrated, perhaps it's a problem with them or even simply a matter of updating the dependency?