Order's status ("valid") is not acceptable for finalization: crontab mass renewal: 4 failed: 1 succeeded

[dgaastra]

Welcome

• Yes, I'm using a binary release within 2 latest releases.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).

What did you expect to see?

[www.my-domain3.com] Server responded with a certificate.

What did you see instead?

error: one or more domains had a problem:

Nov  8 02:00:07 web2 renew-certificates: [my-domain1.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944551000 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("valid") is not acceptable for finalization
Nov  8 02:00:07 web2 renew-certificates: [www.my-domain1.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944551000 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("valid") is not acceptable for finalization

How do you use lego?

Binary

Reproduction steps

crontab renewal of 5 domains. See Log below. Domain names have been simplified.

Version of lego

lego version 4.5.3 linux/amd64
on newest Debian 11.1

Logs

Nov  8 02:00:02 web2 renew-certificates: 2021/11/08 02:00:02 [INFO] [www.my-domain1.com] acme: Trying renewal with 1991 hours remaining
Nov  8 02:00:02 web2 renew-certificates: 2021/11/08 02:00:02 [INFO] [www.my-domain1.com, my-domain1.com] acme: Obtaining bundled SAN certificate
Nov  8 02:00:03 web2 renew-certificates: 2021/11/08 02:00:03 [INFO] [my-domain1.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/39991287880
Nov  8 02:00:03 web2 renew-certificates: 2021/11/08 02:00:03 [INFO] [www.my-domain1.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/42102748431
Nov  8 02:00:03 web2 renew-certificates: 2021/11/08 02:00:03 [INFO] [my-domain1.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:03 web2 renew-certificates: 2021/11/08 02:00:03 [INFO] [www.my-domain1.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:03 web2 renew-certificates: 2021/11/08 02:00:03 [INFO] [www.my-domain1.com, my-domain1.com] acme: Validations succeeded; requesting certificates
Nov  8 02:00:07 web2 renew-certificates: 2021/11/08 02:00:07 error: one or more domains had a problem:
Nov  8 02:00:07 web2 renew-certificates: [my-domain1.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944551000 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("valid") is not acceptable for finalization
Nov  8 02:00:07 web2 renew-certificates: [www.my-domain1.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944551000 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("valid") is not acceptable for finalization
Nov  8 02:00:08 web2 renew-certificates: 2021/11/08 02:00:08 [INFO] [www.my-domain2.com] acme: Trying renewal with 1991 hours remaining
Nov  8 02:00:08 web2 renew-certificates: 2021/11/08 02:00:08 [INFO] [www.my-domain2.com, my-domain2.com] acme: Obtaining bundled SAN certificate
Nov  8 02:00:09 web2 renew-certificates: 2021/11/08 02:00:09 [INFO] [my-domain2.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/45091138910
Nov  8 02:00:09 web2 renew-certificates: 2021/11/08 02:00:09 [INFO] [www.my-domain2.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/45091138920
Nov  8 02:00:09 web2 renew-certificates: 2021/11/08 02:00:09 [INFO] [my-domain2.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:09 web2 renew-certificates: 2021/11/08 02:00:09 [INFO] [www.my-domain2.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:09 web2 renew-certificates: 2021/11/08 02:00:09 [INFO] [www.my-domain2.com, my-domain2.com] acme: Validations succeeded; requesting certificates
Nov  8 02:00:11 web2 renew-certificates: 2021/11/08 02:00:11 error: one or more domains had a problem:
Nov  8 02:00:11 web2 renew-certificates: [my-domain2.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944582150 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("valid") is not acceptable for finalization
Nov  8 02:00:11 web2 renew-certificates: [www.my-domain2.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944582150 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("valid") is not acceptable for finalization
Nov  8 02:00:12 web2 renew-certificates: 2021/11/08 02:00:12 [INFO] [www.my-domain3.com] acme: Trying renewal with 1991 hours remaining
Nov  8 02:00:12 web2 renew-certificates: 2021/11/08 02:00:12 [INFO] [www.my-domain3.com, my-domain3.com] acme: Obtaining bundled SAN certificate
Nov  8 02:00:12 web2 renew-certificates: 2021/11/08 02:00:12 [INFO] [my-domain3.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/42102889621
Nov  8 02:00:12 web2 renew-certificates: 2021/11/08 02:00:12 [INFO] [www.my-domain3.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/42102889631
Nov  8 02:00:12 web2 renew-certificates: 2021/11/08 02:00:12 [INFO] [my-domain3.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:12 web2 renew-certificates: 2021/11/08 02:00:12 [INFO] [www.my-domain3.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:12 web2 renew-certificates: 2021/11/08 02:00:12 [INFO] [www.my-domain3.com, my-domain3.com] acme: Validations succeeded; requesting certificates
Nov  8 02:00:16 web2 renew-certificates: 2021/11/08 02:00:16 [INFO] [www.my-domain3.com] Server responded with a certificate.
Nov  8 02:00:16 web2 renew-certificates: 2021/11/08 02:00:16 [INFO] [www.my-domain4.com] acme: Trying renewal with 1991 hours remaining
Nov  8 02:00:16 web2 renew-certificates: 2021/11/08 02:00:16 [INFO] [www.my-domain4.com, my-domain4.com] acme: Obtaining bundled SAN certificate
Nov  8 02:00:17 web2 renew-certificates: 2021/11/08 02:00:17 [INFO] [my-domain4.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/45091245610
Nov  8 02:00:17 web2 renew-certificates: 2021/11/08 02:00:17 [INFO] [www.my-domain4.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/45091245620
Nov  8 02:00:17 web2 renew-certificates: 2021/11/08 02:00:17 [INFO] [my-domain4.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:17 web2 renew-certificates: 2021/11/08 02:00:17 [INFO] [www.my-domain4.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:17 web2 renew-certificates: 2021/11/08 02:00:17 [INFO] [www.my-domain4.com, my-domain4.com] acme: Validations succeeded; requesting certificates
Nov  8 02:00:21 web2 renew-certificates: 2021/11/08 02:00:21 error: one or more domains had a problem:
Nov  8 02:00:21 web2 renew-certificates: [my-domain4.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944622850 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("processing") is not acceptable for finalization
Nov  8 02:00:21 web2 renew-certificates: [www.my-domain4.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944622850 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("processing") is not acceptable for finalization
Nov  8 02:00:21 web2 renew-certificates: 2021/11/08 02:00:21 [INFO] [www.my-domain5.com] acme: Trying renewal with 1991 hours remaining
Nov  8 02:00:21 web2 renew-certificates: 2021/11/08 02:00:21 [INFO] [www.my-domain5.com, my-domain5.com] acme: Obtaining bundled SAN certificate
Nov  8 02:00:22 web2 renew-certificates: 2021/11/08 02:00:22 [INFO] [my-domain5.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/45091308510
Nov  8 02:00:22 web2 renew-certificates: 2021/11/08 02:00:22 [INFO] [www.my-domain5.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/45091308520
Nov  8 02:00:22 web2 renew-certificates: 2021/11/08 02:00:22 [INFO] [my-domain5.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:22 web2 renew-certificates: 2021/11/08 02:00:22 [INFO] [www.my-domain5.com] acme: authorization already valid; skipping challenge
Nov  8 02:00:22 web2 renew-certificates: 2021/11/08 02:00:22 [INFO] [www.my-domain5.com, my-domain5.com] acme: Validations succeeded; requesting certificates
Nov  8 02:00:28 web2 renew-certificates: 2021/11/08 02:00:28 error: one or more domains had a problem:
Nov  8 02:00:28 web2 renew-certificates: [my-domain5.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944637080 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("valid") is not acceptable for finalization
Nov  8 02:00:28 web2 renew-certificates: [www.my-domain5.com] acme: error: 403 :: POST :: https://acme-v02.api.letsencrypt.org/acme/finalize/53531646/37944637080 :: urn:ietf:params:acme:error:orderNotReady :: Order's status ("valid") is not acceptable for finalization

Go environment (if applicable)

$ go version && go env
# paste output here

[ldez]

Hello,

could you provide the detailed command and your launch context?

[dgaastra]

Sure, here is the snippet: this has worked for about 4-5 years.

for DOMAIN in "${DOMAINS_WWW_WEBROOT[@]}"
do
    sudo $LEGO_BIN --email="$EMAIL" --domains="www.$DOMAIN" --domains="$DOMAIN" --http --http.webroot="/htdocs/$DOMAIN" --path="$LEGO_PATH" --key-type="$KEY_TYPE" --accept-tos $RUN_OR_RENEW --days 90
done

root@web2:/home/webmaster# env
SHELL=/bin/bash
SUDO_GID=1000
LANGUAGE=en_US.UTF-8
SUDO_COMMAND=/usr/bin/bash
SUDO_USER=webmaster
PWD=/home/webmaster
LOGNAME=root
HOME=/root
LANG=en_US.UTF-8
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
TERM=xterm-256color
USER=root
SHLVL=1
LC_CTYPE=UTF-8
LC_ALL=en_US.UTF-8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
SUDO_UID=1000
MAIL=/var/mail/root
_=/usr/bin/env

[ldez]

Have you tried with a previous version of lego?
Have you tried with the LE stagging?

As there are no changes in the ACME RFC and no major changes in Let's Encrypt or lego, I'm thinking about a change in your environment.

[my-domain4.com] acme: authorization already valid; skipping challenge

I recommend cleaning (don't delete the folder) your .lego folder and waiting a few minutes because the log says that you are using the cache.

[dgaastra]

Hi Idez,

Thanks for looking into this. :-) The previous version was 4.4.0, in which sometimes the first renewal failed, but the others were OK. With this version 4.5.3, running crontab, as you can see, only 1 out of 5 worked. We have not tried staging since this crontab renewal has always worked for us since the last 4-5 years.

Just ran our stack's bash script manually as root user, and guess what? All of them worked: 5x

Server responded with a certificate.

Could it be a crontab environment issue; or, the running time of 02:00 CET?

Sorry, I do not understand what you mean by cleaning the .lego folder. In the whole filesystem, there is only one empty .lego folder sitting within the certificates.

Thanks
Dennis