[SOLVED] 2nd subdomain breaks certbot: "please choose an account"

Support
1

Hi all.

I’m running:

You are running Debian GNU/Linux 13 (trixie) and FreedomBox version 26.9.1. FreedomBox is up to date.

Problem Description

Tl;dr: Adding a second subdomain to my setup breaks LetsEncrypt.

  • I own a domain example.org with two subdomains both pointing at my FreedomBox (same A and AAAA entries in DNS):
    • box.example.org has been working fine for years
    • cloud.example.org is new, I’ve just added it (DNS first, now on Plinth)

In Plinth I’ve configured the subdomains as:

image
image1570×427 35 KB

When trying to obtain LetsEncrypt certificates for the new subdomain I get the following error (real domain names edited for privacy):

Error running action: letsencrypt..obtain("cloud.example.org"): CalledProcessError(1, ["certbot", "certonly", "--non-interactive", "--text", "--agree-tos", "--register-unsafely-without-email", "--domain", "cloud.example.org", "--authenticator", "webroot", "--webroot-path", "/var/www/html", "--renew-by-default"])
Stderr:
║ Saving debug log to /var/log/letsencrypt/letsencrypt.log
║ Missing command line flag or config entry for this setting:
║ Please choose an account
║ Choices: ['fbox.box.example.org@2024-01-24T17:15:12Z (7ea7)', 'box.example.org@2020-08-13T15:49:44Z (ceed)']
║ Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
Action traceback:
╞   File "/usr/lib/python3/dist-packages/plinth/actions.py", line 501, in _privileged_call
╞     return_values = func(*arguments['args'], **arguments['kwargs'])
╞   File "/usr/lib/python3/dist-packages/plinth/modules/letsencrypt/privileged.py", line 136, in obtain
╞     action_utils.run(command, check=True)
╞     ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
╞   File "/usr/lib/python3/dist-packages/plinth/action_utils.py", line 868, in run
╞     raise exception
╞   File "/usr/lib/python3/dist-packages/plinth/action_utils.py", line 855, in run
╞     process = subprocess.run(command, **kwargs)
╞   File "/usr/lib/python3.13/subprocess.py", line 577, in run
╞     raise CalledProcessError(retcode, process.args,
╞                              output=stdout, stderr=stderr)

It seems as if the second subdomain is breaking the non-interactive certbot call. Auto-renewals for box.example.org have been working fine for years.

Also, the name fbox.box.example.org seems to be off - why should it prepend the local hostname to the domain (I believe this existed before adding the new cloud subdomain). Can this be a stray issue with certbox confusing the local hostname with an external domain?

Any ideas how to get a certificate for my new second subdomain? I want to use it to proxy through to another service on my network and am stuck here :confused:

Thanks!
Axel

2

Update: The confusing bit about fbox.box.example.org had be check the configured accounts in
/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory.

I found two entries there and moved the one with the weird name out of the way, only keeping box.example.org (I’ve backed up the other in case I want to move it back).

Afterwards I re-ran Certbot through Plinth, and this time it was successful!

I still wonder where this weird entry came from and if I am breaking something by removing it. I’ll keep an eye on diagnostics and everything for a bit.