Repository: certbot/certbot

Issue:
--dry-run on renew didn't work
Hello,

I just try to test the renew like this:
./letsencrypt-auto renew -v --dry-run
and the log says:

```
2016-05-12 21:03:20,463:DEBUG:certbot.main:Root logging level set at 20
2016-05-12 21:03:20,464:INFO:certbot.main:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2016-05-12 21:03:20,464:DEBUG:certbot.main:certbot version: 0.6.0
2016-05-12 21:03:20,464:DEBUG:certbot.main:Arguments: ['-v', '--dry-run']
2016-05-12 21:03:20,464:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#webroot,PluginEntryPoint#null,PluginEntryPoint#manual,PluginEntryPoint#standalone)
2016-05-12 21:03:20,465:DEBUG:certbot.main:Exiting abnormally:
Traceback (most recent call last):
  File "/root/.local/share/letsencrypt/bin/letsencrypt", line 11, in <module>
    sys.exit(main())
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/main.py", line 693, in main
    return config.func(config, plugins)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/main.py", line 538, in renew
    renewal.renew_all_lineages(config)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/renewal.py", line 305, in renew_all_lineages
    raise errors.Error("Currently, the renew verb is only capable of "
Error: Currently, the renew verb is only capable of renewing all installed certificates that are due to be renewed; individual domains cannot be specified with this action. If you would like to renew specific certificates, use the certonly command. The renew verb may provide other options for selecting certificates to renew in the future.
```

I use a cli.ini with 
authenticator = webroot
webroot-map = {....some domains which are correctly installed with certonly command }

Any idea?

Thanks, Alex



Discussion:
Thanks for this bug report! Related: #2305

The available workarounds should be:

1.test and renew with `certonly` rather than `renew` (see [the docs](https://certbot.eff.org/docs/using.html#renewal) for a full writeup): 
2. remove the `webroot-map` from cli.ini

@pde  I'm getting the following error

```
.conf produced an unexpected error: Failed authorization procedure. www.mydomain.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain
```

I tested from the browser I have access. I'm wondering if it's because I have a redirect from http to https

example certbot try to fetch a file from

```
http://www.mydomain.com/.well-known/acme-challenge/0mxXzrutzBAg2zyRjwH3pnsypbUDUCb2SIS55COiRd4
```

is it possible that certbot doesn't follow the redirect link?

@rkmax, that error comes from the Let's Encrypt CA and it does follow redirects from HTTP to HTTPS. Are you still having the problem?


Resolving patch:
diff --git a/certbot/renewal.py b/certbot/renewal.py
--- a/certbot/renewal.py
+++ b/certbot/renewal.py
@@ -301,7 +301,10 @@ def _renew_describe_results(config, renew_successes, renew_failures,
 def renew_all_lineages(config):
     """Examine each lineage; renew if due and report results"""
 
-    if config.domains != []:
+    # This is trivially False if config.domains is empty
+    if any(domain not in config.webroot_map for domain in config.domains):
+        # If more plugins start using cli.add_domains,
+        # we may want to only log a warning here
         raise errors.Error("Currently, the renew verb is only capable of "
                            "renewing all installed certificates that are due "
                            "to be renewed; individual domains cannot be "


Test patch:
diff --git a/certbot/tests/cli_test.py b/certbot/tests/cli_test.py
--- a/certbot/tests/cli_test.py
+++ b/certbot/tests/cli_test.py
@@ -712,6 +712,12 @@ def test_renew_plugin_config_restoration(self):
         self._test_renew_common(renewalparams=renewalparams,
                                 assert_oc_called=True)
 
+    def test_renew_with_webroot_map(self):
+        renewalparams = {'authenticator': 'webroot'}
+        self._test_renew_common(
+            renewalparams=renewalparams, assert_oc_called=True,
+            args=['renew', '--webroot-map', '{"example.com": "/tmp"}'])
+
     def test_renew_reconstitute_error(self):
         # pylint: disable=protected-access
         with mock.patch('certbot.main.renewal._reconstitute') as mock_reconstitute: