Let’s Encryptの更新に失敗する

最近はこんな感じでLet’s Encryptの証明書の更新を更新しているのですが今回失敗しました．
（DocumenteRootをFQDNにしている前提）

$ sudo /bin/sh -c "/usr/bin/find /etc/letsencrypt/renewal/*.conf -type f | /usr/bin/xargs /usr/bin/basename -s .conf | xargs -n1 -I{} /usr/bin/letsencrypt renew --webroot -w /var/www/{}/ -d {}"

こんなふうに怒られます．
(仕様が変わった?)

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Currently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command. The renew verb may provide other options for selecting certificates to renew in the future.

とりあえずはletsencrypt renewをletsencrypt certonlyにしたら通りました．

$ sudo /bin/sh -c "/usr/bin/find /etc/letsencrypt/renewal/*.conf -type f | /usr/bin/xargs /usr/bin/basename -s .conf | xargs -n1 -I{} /usr/bin/letsencrypt certonly --webroot -w /var/www/{}/ -d {}"

これで更新できたと思ったら1つのドメインで失敗しています．

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for files.matoken.org
Using the webroot path /var/www/files.matoken.org for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. files.matoken.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://files.matoken.org/.well-known/acme-challenge/Be7Aiai4UH9CDqacTaEZOMH4SxSQbtFqxFcPXcCtJEs: "

404 Not Found

Not Found
<p"

IMPORTANT NOTES:
- The following errors were reported by the server:

Domain: files.matoken.org
Type: unauthorized
Detail: Invalid response from
http://files.matoken.org/.well-known/acme-challenge/Be7Aiai4UH9CDqacTaEZOMH4SxSQbtFqxFcPXcCtJEs:
"

404 Not Found

Not Found
<p"

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.

ファイルをDoumentRootに置いてLet’s Encryptからアクセスされるのですがそこでそのファイルが見つからないと失敗しています．このドメインはhttpを設定していませんでした．
てことでapacheでRewriteの設定をしてあげると

RewriteEngine On
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]

通りました．

$ sudo /usr/bin/letsencrypt certonly --webroot -w /var/www/files.matoken.org/ -d files.mato
ken.org
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for files.matoken.org
Using the webroot path /var/www/files.matoken.org for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0003_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0003_csr-certbot.pem

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/files.matoken.org/fullchain.pem. Your cert
will expire on 2018-05-31. To obtain a new or tweaked version of
this certificate in the future, simply run certbot again. To
non-interactively renew *all* of your certificates, run "certbot
renew"
- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

certbotのversionがかなり古いですね……．

$ dpkg -l|grep -i certbot
ii certbot 0.10.2-1 all automatically configure HTTPS using Let's Encrypt
ii python-certbot 0.10.2-1 all main library for certbot

てことでbackportのものに入れ替え．

$ sudo apt remove certbot
$ sudo apt install python-certbot-apache -t stretch-backports
$ apt show certbot
Package: certbot
Version: 0.21.1-1~bpo9+1
Priority: optional
Section: web
Source: python-certbot
Maintainer: Debian Let's Encrypt <letsencrypt-devel@lists.alioth.debian.org>
Installed-Size: 53.2 kB
Provides: letsencrypt
Depends: python3-certbot (= 0.21.1-1~bpo9+1), python3:any
Suggests: python3-certbot-apache, python3-certbot-nginx, python-certbot-doc
Breaks: letsencrypt (<= 0.6.0)
Replaces: letsencrypt
Homepage: https://certbot.eff.org/
Download-Size: 20.4 kB
APT-Manual-Installed: no
APT-Sources: http://ftp.jp.debian.org/debian stretch-backports/main amd64 Packages
Description: automatically configure HTTPS using Let's Encrypt
The objective of Certbot, Let's Encrypt, and the ACME (Automated
Certificate Management Environment) protocol is to make it possible
to set up an HTTPS server and have it automatically obtain a
browser-trusted certificate, without any human intervention. This is
accomplished by running a certificate management agent on the web
server.
.
This agent is used to:
.
- Automatically prove to the Let's Encrypt CA that you control the website
- Obtain a browser-trusted certificate and set it up on your web server
- Keep track of when your certificate is going to expire, and renew it
- Help you revoke the certificate if that ever becomes necessary.
.
This package contains the main application, including the standalone
and the manual authenticators.

N: There is 1 additional record. Please use the '-a' switch to see it

てことでclientが古かったのであまり参考になら無さそうなメモでした．