gitlabでLet's Encryptの証明書を更新しようとすると失敗する時にやった事

# gitlabでLet's Encryptの証明書を更新しようとした

失敗する・・・

```
$ sudo gitlab-ctl renew-le-certs
Starting Chef Client, version 13.6.4
resolving cookbooks for run list: ["gitlab::letsencrypt_renew"]
Synchronizing Cookbooks:
  - postgresql (0.1.0)
  - redis (0.1.0)
  - registry (0.1.0)
  - consul (0.1.0)
  - gitaly (0.1.0)
  - letsencrypt (0.1.0)
  - nginx (0.1.0)
  - runit (4.3.0)
  - crond (0.1.0)
  - package (0.1.0)
  - gitlab (0.0.1)
  - mattermost (0.1.0)
  - acme (3.1.0)
  - compat_resource (12.19.1)
Installing Cookbook Gems:
Compiling Cookbooks...
Converging 14 resources
Recipe: letsencrypt::enable
  * ruby_block[http external-url] action run (skipped due to only_if)
Recipe: <Dynamically Defined Resource>
  * service[nginx] action nothing (skipped due to action :nothing)
Recipe: nginx::enable
  * runit_service[nginx] action enable
    * ruby_block[restart_service] action nothing (skipped due to action :nothing)
    * ruby_block[restart_log_service] action nothing (skipped due to action :nothing)
    * ruby_block[reload_log_service] action nothing (skipped due to action :nothing)
    * directory[/opt/gitlab/sv/nginx] action create (up to date)
    * template[/opt/gitlab/sv/nginx/run] action create (up to date)
    * directory[/opt/gitlab/sv/nginx/log] action create (up to date)
    * directory[/opt/gitlab/sv/nginx/log/main] action create (up to date)
    * template[/opt/gitlab/sv/nginx/log/run] action create (up to date)
    * template[/var/log/gitlab/nginx/config] action create (up to date)
    * directory[/opt/gitlab/sv/nginx/env] action create (up to date)
    * ruby_block[Delete unmanaged env files for nginx service] action run (skipped due to only_if)
    * template[/opt/gitlab/sv/nginx/check] action create (skipped due to only_if)
    * template[/opt/gitlab/sv/nginx/finish] action create (skipped due to only_if)
    * directory[/opt/gitlab/sv/nginx/control] action create (up to date)
    * link[/opt/gitlab/init/nginx] action create (up to date)
    * file[/opt/gitlab/sv/nginx/down] action delete (up to date)
    * directory[/opt/gitlab/service] action create (up to date)
    * link[/opt/gitlab/service/nginx] action create (up to date)
    * ruby_block[wait for nginx service socket] action run (skipped due to not_if)
     (up to date)
  * execute[reload nginx] action nothing (skipped due to action :nothing)
Recipe: letsencrypt::enable
  * directory[/etc/gitlab/ssl] action create (up to date)
  * acme_selfsigned[サイトドメイン] action create
    * file[サイトドメイン SSL selfsigned key] action create_if_missing (up to date)
    * file[サイトドメイン SSL selfsigned crt] action create_if_missing (up to date)
    * file[サイトドメイン SSL selfsigned chain] action create_if_missing (skipped due to not_if)
     (up to date)
Recipe: letsencrypt::http_authorization
  * letsencrypt_certificate[サイトドメイン] action create
    * acme_certificate[staging] action create
      * file[サイトドメイン SSL key] action create_if_missing (up to date)
      
      ================================================================================
      Error executing action `create` on resource 'acme_certificate[staging]'
      ================================================================================
      
      Acme::Client::Error::Unauthorized
      ---------------------------------
      No registration exists matching provided key
      
      Cookbook Trace:
      ---------------
      /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/libraries/acme.rb:48:in `acme_authz_for'
      /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/providers/certificate.rb:69:in `block (2 levels) in class_from_file'
      /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/providers/certificate.rb:68:in `map'
      /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/providers/certificate.rb:68:in `block in class_from_file'
      
      Resource Declaration:
      ---------------------
      suppressed sensitive resource output
      
      Compiled Resource:
      ------------------
      suppressed sensitive resource output
      
      System Info:
      ------------
      chef_version=13.6.4
      platform=ubuntu
      platform_version=18.04
      ruby=ruby 2.5.3p105 (2018-10-18 revision 65156) [x86_64-linux]
      program_name=/opt/gitlab/embedded/bin/chef-client
      executable=/opt/gitlab/embedded/bin/chef-client
      
    
    ================================================================================
    Error executing action `create` on resource 'letsencrypt_certificate[サイトドメイン]'
    ================================================================================
    
    Acme::Client::Error::Unauthorized
    ---------------------------------
    acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 20) had an error: Acme::Client::Error::Unauthorized: No registration exists matching provided key
    
    Cookbook Trace:
    ---------------
    /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/libraries/acme.rb:48:in `acme_authz_for'
    /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/providers/certificate.rb:69:in `block (2 levels) in class_from_file'
    /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/providers/certificate.rb:68:in `map'
    /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/providers/certificate.rb:68:in `block in class_from_file'
    
    Resource Declaration:
    ---------------------
    # In /opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/recipes/http_authorization.rb
    
      3: letsencrypt_certificate site do
      4:   fullchain node['gitlab']['nginx']['ssl_certificate']
      5:   key node['gitlab']['nginx']['ssl_certificate_key']
      6:   notifies :run, "execute[reload nginx]", :immediate
      7:   notifies :run, 'ruby_block[display_le_message]'
      8: end
    
    Compiled Resource:
    ------------------
    # Declared in /opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/recipes/http_authorization.rb:3:in `from_file'
    
    letsencrypt_certificate("サイトドメイン") do
      action [:create]
      default_guard_interpreter :default
      declared_type :letsencrypt_certificate
      cookbook_name "letsencrypt"
      recipe_name "http_authorization"
      fullchain "/etc/gitlab/ssl/サイトドメイン.crt"
      key "/etc/gitlab/ssl/サイトドメイン.key"
      alt_names []
      cn "サイトドメイン"
    end
    
    System Info:
    ------------
    chef_version=13.6.4
    platform=ubuntu
    platform_version=18.04
    ruby=ruby 2.5.3p105 (2018-10-18 revision 65156) [x86_64-linux]
    program_name=/opt/gitlab/embedded/bin/chef-client
    executable=/opt/gitlab/embedded/bin/chef-client
    

Running handlers:
Running handlers complete
Chef Client failed. 0 resources updated in 05 seconds
There was an error renewing Let's Encrypt certificates, please checkout the output
```

## グーグル先生に頼る！
「Acme::Client::Error::Unauthorized」
https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4656

acmeをアップグレードする必要あるとのこと

## アップグレードする

```
$ sudo gitlab-ctl upgrade

省略！！！

     _______ __  __          __
    / ____(_) /_/ /   ____ _/ /_
   / / __/ / __/ /   / __ `/ __ \
  / /_/ / / /_/ /___/ /_/ / /_/ /
  \____/_/\__/_____/\__,_/_.___/
  

Upgrade complete! If your GitLab server is misbehaving try running
  sudo gitlab-ctl restart
before anything else.
If you need to roll back to the previous version you can use the database
backup made during the upgrade (scroll up for the filename).

```

途中で証明書の更新エラーは起きるものの、、、モジュールは更新できたみたい

## 再度、証明書を更新してみる

```
$ sudo gitlab-ctl renew-le-certs
```

今度はエラーなく成功しました。

## 念の為、最後にgitlabを再起動してみる

```
$ sudo gitlab-ctl restart
ok: run: alertmanager: (pid 15088) 0s
ok: run: crond: (pid 15114) 1s
ok: run: gitaly: (pid 15122) 0s
ok: run: gitlab-monitor: (pid 15142) 0s
ok: run: gitlab-workhorse: (pid 15150) 1s
ok: run: logrotate: (pid 15165) 0s
ok: run: nginx: (pid 15172) 1s
ok: run: node-exporter: (pid 15254) 0s
ok: run: postgres-exporter: (pid 15274) 0s
ok: run: postgresql: (pid 15283) 1s
ok: run: prometheus: (pid 15303) 0s
ok: run: redis: (pid 15314) 1s
ok: run: redis-exporter: (pid 15373) 0s
ok: run: sidekiq: (pid 15408) 0s
ok: run: unicorn: (pid 15420) 1s
```

無事、ブラウザからもアクセスできる様になりました。
良かった