【发布时间】：2018-07-12 13:12:10
【问题描述】：
我在 AWS 上托管一个网站。我通过letsencrypt为我的域xxxxx.com和www.xxxxx.com创建了SSL证书。 （在这篇文章中，我将 'xxxx' 用于潜在的敏感信息，但如果需要这些信息来提供帮助，我可以提供）。
大约一周前，证书过期了。我正在尝试更新证书，这就是我得到的：
ubuntu:~$ sudo certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Processing /etc/letsencrypt/renewal/xxxxx.com.conf
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator nginx, Installer nginx
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for xxxxx.com
tls-sni-01 challenge for www.xxxxx.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (xxxxx.com) from /etc/letsencrypt/renewal/xxxxx.com.conf produced an unexpected error: Failed authorization procedure. www.xxxxx.com (tls-sni-01): urn:acme:error:dns :: DNS problem: NXDOMAIN looking up A for www.xxxxx.com. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/xxxxx.com/fullchain.pem (failure)
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/xxxxx.com/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: www.xxxxx.com
Type: None
Detail: DNS problem: NXDOMAIN looking up A for www.xxxxx.com
最初的想法显然是我的 A 记录有问题。但是执行 dig 命令会发现：
ubuntu:~$ dig xxxxx.com any
xxxxx.com. 60 IN TXT "MS=msxxxxxx"
xxxxx.com. 60 IN MX 0 xxxxx.mail.protection.outlook.com.
xxxxx.com. 60 IN SOA ns-xxxx.awsdns-xx.org. awsdnshostmaster.amazon.com. x xxxx xxxx xxxxx xxxxx
xxxxx.com. 60 IN NS ns1.bdm.microsoftonline.com.
xxxxx.com. 60 IN NS ns2.bdm.microsoftonline.com.
xxxxx.com. 60 IN NS ns3.bdm.microsoftonline.com.
xxxxx.com. 60 IN NS ns4.bdm.microsoftonline.com.
xxxxx.com. 60 IN A xx.xx.xxx.xxx
还有：
ubuntu:~$ dig www.xxxxx.com any
www.xxxxx.com. 60 IN A xx.xx.xxx.xxx
所以似乎存在 A 记录。是我的域的 www 版本没有 NS 记录吗？我不确定如何解决这个问题。谢谢！
【问题讨论】：
-
我认为这更适合服务器故障，因为它是服务器配置问题而不是编程问题。但是先查看他们的帮助部分，如果已经有任何类似的问题，请进行搜索
-
嗯，您缺少 www.xxxxx.com 的 A 区。
-
谢谢@DamirKasipovic。你能详细说明一下吗？我该如何解决这个问题？
-
通过（严重）混淆名称可以获得什么（除了不太好的答案）？
-
不要使用
ANY伪记录类型，它肯定不会像您认为的那样做，它是一个糟糕且具有误导性的故障排除工具。当您使用dig时，始终使用@指定您查询的名称服务器。您应该首先查询权威的，然后只查询递归的。
标签： nginx dns ssl-certificate lets-encrypt certbot