SSL certificates not renewed with TLJH

JupyterHub The Littlest JupyterHub
,
1

Hi,

I have setup TLJH with SSL using the following documentation:

Enable HTTPS — The Littlest JupyterHub v0.1 documentation

I received an e-mail that the SSL certificates need to be renewed. Why did they not get renewed automatically?

Your certificate (or certificates) for the names listed below will expire in 10 days. Please make sure to renew your certificate before then, or visitors to your website will encounter errors.

We recommend renewing certificates automatically when they have a third of their
total lifetime left.

I see the following messages keep repeating in the logs:

$ sudo journalctl -u traefik

Nov 05 16:29:12 navajo traefik[70417]: time="2020-11-05T16:29:12Z" level=warning msg="A new release has been found: 2.3.2. Please consider updating."
Nov 06 16:29:12 navajo traefik[70417]: time="2020-11-06T16:29:12Z" level=info msg="Testing certificate renew..."
Nov 06 16:29:12 navajo traefik[70417]: time="2020-11-06T16:29:12Z" level=warning msg="A new release has been found: 2.3.2. Please consider updating."
Nov 07 16:29:12 navajo traefik[70417]: time="2020-11-07T16:29:12Z" level=info msg="Testing certificate renew..."
Nov 07 16:29:12 navajo traefik[70417]: time="2020-11-07T16:29:12Z" level=warning msg="A new release has been found: 2.3.2. Please consider updating."
Nov 08 16:29:12 navajo traefik[70417]: time="2020-11-08T16:29:12Z" level=info msg="Testing certificate renew..."
Nov 08 16:29:12 navajo traefik[70417]: time="2020-11-08T16:29:12Z" level=warning msg="A new release has been found: 2.3.2. Please consider updating."
Nov 09 16:29:12 navajo traefik[70417]: time="2020-11-09T16:29:12Z" level=info msg="Testing certificate renew..."

How to resolve the same?

1 Like
2

Did you find a solution to this issue? I have the same problem on google cloud.

I have disabled http traffic for the server. Can this be the cause of the issue?

3

Yes, http is required (at least for the initial certificate, I’m not sure about renewal).

4

It is clear that http is required for the initial certificate :slight_smile:

Can anyone answer if it’s required for auto renewals as well?

5

Using the http challenge, port 80 must be used for both first issue and renewal. If you switch to the TLS challenge, certificate requests will use 443.

more info from Let’s Encrypt, with various caveats.

1 Like