Repository: certbot/certbot

Issue:
Update staging server to ACMEv2
https://acme-staging.api.letsencrypt.org/directory --> https://acme-staging-v02.api.letsencrypt.org/directory

```
$ git grep acme-staging
acme/examples/example_client.py:DIRECTORY_URL = 'https://acme-staging.api.letsencrypt.org/directory'
certbot/constants.py:STAGING_URI = "https://acme-staging.api.letsencrypt.org/directory"
certbot/tests/storage_test.py:        rp["server"] = "https://acme-staging.api.letsencrypt.org/directory"
certbot/tests/testdata/sample-renewal-ancient.conf:server = https://acme-staging.api.letsencrypt.org/directory
certbot/tests/testdata/sample-renewal.conf:server = https://acme-staging.api.letsencrypt.org/directory
docs/cli-help.txt:                        https://acme-staging.api.letsencrypt.org/directory
docs/contributing.rst:   export SERVER=https://acme-staging.api.letsencrypt.org/directory
examples/dev-cli.ini:server = https://acme-staging.api.letsencrypt.org/directory
tests/letstest/testdata/sample-config/accounts/acme-staging.api.letsencrypt.org/directory/48d6b9e8d767eccf7e4d877d6ffa81e3/regr.json:{"body": {"agreement": "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf", "key": {"e": "AQAB", "kty": "RSA", "n": "xL5HzdhU_7P-_tphpRxpDSIL2L-aAlWt6r9EVyw53Sp-jx4fHDgnYv9HQOzNeL_IpLRCLLBItMzqnBvHUdHcS3aB6fv8HSNiHdVdC-c2rPFO8DLSGLNqi9G9WshjLDsKwc__BPNX5wHFcm8TZUJ4uZ_Ax1JCe05ePHWAf8GTr8vPaKtMpUVF55HPwpJtYvFZlH1LiVo8I_trJtHl8-pGeel3zdcaDJgNZrohZG2acTg95Ry46FE4HOslAg8Z6yECPyYLInJSDcb5yCgSqtOOp7rMVSPQFhoZRt4KDfew9lqIwNQSJoDE3bJWpwkzL1tp4clG8ExI1WnA86OjW83Vvw"}}, "uri": "https://acme-staging.api.letsencrypt.org/acme/reg/566631", "new_authzr_uri": "https://acme-staging.api.letsencrypt.org/acme/new-authz", "terms_of_service": "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf"}
tests/letstest/testdata/sample-config/renewal/a.encryption-example.com.conf:server = https://acme-staging.api.letsencrypt.org/directory
tests/letstest/testdata/sample-config/renewal/b.encryption-example.com.conf:server = https://acme-staging.api.letsencrypt.org/directory
tools/deactivate.py:DIRECTORY=https://acme-staging.api.letsencrypt.org/directory python \
```

Some of these probably shouldn't be updated.
certbot renew --dry-run doesn't use ACME v2
## My operating system is (include version):

Ubuntu 16.04 (amd64)

## I installed Certbot with (certbot-auto, OS package manager, pip, etc):

certbot-auto (0.22.0)

## I ran this command and it produced this output:

`$ sudo -H certbot certonly --manual --manual-auth-hook "/opt/certbot_dns/certbot_dns.py --auth --config /opt/certbot_dns/certbot_dns.ini --route-53" --manual-cleanup-hook "/opt/certbot_dns/certbot_dns.py --cleanup --config /opt/certbot_dns/certbot_dns.ini --route-53" --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-staging-v02.api.letsencrypt.org/directory -d letsencrypt.mattnordhoff.info -d '*.letsencrypt.mattnordhoff.info'`

That's my not-open-source manual auth plugin for Route 53 DNS validation.

The certificate was successfully issued.

    $ sudo -H certbot renew --dry-run
    Saving debug log to /var/log/letsencrypt/letsencrypt.log

    [snip]

    -------------------------------------------------------------------------------
    Processing /etc/letsencrypt/renewal/letsencrypt.mattnordhoff.info.conf
    -------------------------------------------------------------------------------
    Cert not due for renewal, but simulating renewal for dry run
    Plugins selected: Authenticator manual, Installer None
    Renewing an existing certificate
    Attempting to renew cert (letsencrypt.mattnordhoff.info) from /etc/letsencrypt/renewal/letsencrypt.mattnordhoff.info.conf produced an unexpected error: The currently selected ACME CA endpoint does not support issuing wildcard certificates.. Skipping.

    [snip]

    The following certs could not be renewed:
      /etc/letsencrypt/live/letsencrypt.mattnordhoff.info/fullchain.pem (failure)
      /etc/letsencrypt/live/letsencrypt.mattnordhoff.net/fullchain.pem (failure)

    -------------------------------------------------------------------------------
    ** DRY RUN: simulating 'certbot renew' close to cert expiry
    **          (The test certificates below have not been saved.)

    The following certs were successfully renewed:
    [snip]

    The following certs could not be renewed:
      /etc/letsencrypt/live/letsencrypt.mattnordhoff.info/fullchain.pem (failure)
      /etc/letsencrypt/live/letsencrypt.mattnordhoff.net/fullchain.pem (failure)
    ** DRY RUN: simulating 'certbot renew' close to cert expiry
    **          (The test certificates above have not been saved.)
    -------------------------------------------------------------------------------
    2 renew failure(s), 0 parse failure(s)

(The `letsencrypt.mattnordhoff.net` certificate failed for the same reason.)

## Certbot's behavior differed from what I expected because:

Certbot tries to renew an ACME v2 staging wildcard certificate using the ACME v1 server, and naturally fails.

## Here is a Certbot log showing the issue (if available):
###### Logs are stored in `/var/log/letsencrypt` by default. Feel free to redact domains, e-mail and IP addresses as you see fit.

https://mn0.us/vPfhms7t_h2YLEaWk_AHaGK/letsencrypt.log (other certificates snipped)

I don't know if this is a known issue or expected behavior, but I didn't see anything. :confused:


Discussion:

+1, same experience, --dry-run doesn't accept wildcard certificates for certbot 0.22
the --dry-run & --server are not allowed together.
Can confirm the same behaviour with 0.22.0 on CentOS 7.

I used this command initially which worked to generate the wildcard certificate:
`certbot certonly --manual --manual-auth-hook '/etc/acme-dns/acme-dns-certbot-hook -config /etc/acme-dns/acme_dns.json' --manual-public-ip-logging-ok --no-eff-email --server https://acme-v02.api.letsencrypt.org/directory --preferred-challenges dns -d *.mydomain.co.uk
`

However doing `certbot renew --dry-run` results in it using the wrong endpoint:
```
Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org
Renewing an existing certificate
Attempting to renew cert (mydomain.co.uk-0001) from /etc/letsencrypt/renewal/mydomain.co.uk-0001.conf produced an unexpected error: The currently selected ACME CA endpoint does not support issuing wildcard certificates.. Skipping.
```

`/etc/letsencrypt/renewal/mydomain.co.uk-0001.conf` contains the correct endpoint listed as `server`:

```
# renew_before_expiry = 30 days
version = 0.22.0
archive_dir = /etc/letsencrypt/archive/mydomain.co.uk-0001
cert = /etc/letsencrypt/live/mydomain.co.uk-0001/cert.pem
privkey = /etc/letsencrypt/live/mydomain.co.uk-0001/privkey.pem
chain = /etc/letsencrypt/live/mydomain.co.uk-0001/chain.pem
fullchain = /etc/letsencrypt/live/mydomain.co.uk-0001/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = MYACCOUNTKEY
manual_public_ip_logging_ok = True
manual_auth_hook = /etc/acme-dns/acme-dns-certbot-hook -config /etc/acme-dns/acme_dns.json
server = https://acme-v02.api.letsencrypt.org/directory
authenticator = manual
installer = None
pref_challs = dns-01,
```

So, I'm guessing the `server` setting here is just being ignored when `--dry-run` is used?
Thanks for reporting this. There's currently no good way to handle this, as `--dry-run` updates the `--server`  contents to `acme-staging`. We'll definitely have a fix for this when we [update the default](https://github.com/certbot/certbot/issues/5369) to ACMEv2, and possible before then.

Resolving patch:
diff --git a/certbot/constants.py b/certbot/constants.py
--- a/certbot/constants.py
+++ b/certbot/constants.py
@@ -107,7 +107,7 @@
     dns_route53=False
 
 )
-STAGING_URI = "https://acme-staging.api.letsencrypt.org/directory"
+STAGING_URI = "https://acme-staging-v02.api.letsencrypt.org/directory"
 
 # The set of reasons for revoking a certificate is defined in RFC 5280 in
 # section 5.3.1. The reasons that users are allowed to submit are restricted to


Test patch:
diff --git a/certbot/tests/storage_test.py b/certbot/tests/storage_test.py
--- a/certbot/tests/storage_test.py
+++ b/certbot/tests/storage_test.py
@@ -726,7 +726,7 @@ def test_is_test_cert(self):
         self.test_rc.configuration["renewalparams"] = {}
         rp = self.test_rc.configuration["renewalparams"]
         self.assertEqual(self.test_rc.is_test_cert, False)
-        rp["server"] = "https://acme-staging.api.letsencrypt.org/directory"
+        rp["server"] = "https://acme-staging-v02.api.letsencrypt.org/directory"
         self.assertEqual(self.test_rc.is_test_cert, True)
         rp["server"] = "https://staging.someotherca.com/directory"
         self.assertEqual(self.test_rc.is_test_cert, True)
diff --git a/certbot/tests/testdata/sample-renewal.conf b/certbot/tests/testdata/sample-renewal.conf
--- a/certbot/tests/testdata/sample-renewal.conf
+++ b/certbot/tests/testdata/sample-renewal.conf
@@ -61,7 +61,7 @@ chain_path = /home/ubuntu/letsencrypt/chain.pem
 break_my_certs = False
 standalone = True
 manual = False
-server = https://acme-staging.api.letsencrypt.org/directory
+server = https://acme-staging-v02.api.letsencrypt.org/directory
 standalone_supported_challenges = "tls-sni-01,http-01"
 webroot = False
 os_packages_only = False