Repository: certbot/certbot

Issue:
Stop preferring TLS-SNI in the Apache, Nginx, and standalone plugins
We should still offer the challenge for now, but we should change the order they are returned in `get_chall_pref` so HTTP-01 comes before TLS-SNI-01. TLS-SNI-01 is going away.


Discussion:
Yes absolutely necessary! Just run into this issue.
``` The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested XXXXXXXXXX.acme.invalid from XXX.XXX.XXX.XXX:443. Received 1 certificate(s), first certificate had names "hostmaster", blog.XXX.XX (tls-sni-01):```

If there is a self-signed Cert installed on the IP of the the host machine, challenges will fail. 
This forced me to include "--preferred-challenges http" in every certbot call.

We're planning on blocking this on https://github.com/certbot/certbot/issues/5763 and https://github.com/certbot/certbot/issues/5764.
While switching the preference is easy, some people's renewals are going to fail by us making this simple change. We should do all we reasonably can to mitigate problems here.

Resolving patch:
diff --git a/certbot-apache/certbot_apache/configurator.py b/certbot-apache/certbot_apache/configurator.py
--- a/certbot-apache/certbot_apache/configurator.py
+++ b/certbot-apache/certbot_apache/configurator.py
@@ -2253,7 +2253,7 @@ def more_info(self):
     ###########################################################################
     def get_chall_pref(self, unused_domain):  # pylint: disable=no-self-use
         """Return list of challenge preferences."""
-        return [challenges.TLSSNI01, challenges.HTTP01]
+        return [challenges.HTTP01, challenges.TLSSNI01]
 
     def perform(self, achalls):
         """Perform the configuration related challenge.
diff --git a/certbot-nginx/certbot_nginx/configurator.py b/certbot-nginx/certbot_nginx/configurator.py
--- a/certbot-nginx/certbot_nginx/configurator.py
+++ b/certbot-nginx/certbot_nginx/configurator.py
@@ -1039,7 +1039,7 @@ def rollback_checkpoints(self, rollback=1):
     ###########################################################################
     def get_chall_pref(self, unused_domain):  # pylint: disable=no-self-use
         """Return list of challenge preferences."""
-        return [challenges.TLSSNI01, challenges.HTTP01]
+        return [challenges.HTTP01, challenges.TLSSNI01]
 
     # Entry point in main.py for performing challenges
     def perform(self, achalls):
diff --git a/certbot/plugins/standalone.py b/certbot/plugins/standalone.py
--- a/certbot/plugins/standalone.py
+++ b/certbot/plugins/standalone.py
@@ -114,7 +114,7 @@ def running(self):
         return self._instances.copy()
 
 
-SUPPORTED_CHALLENGES = [challenges.TLSSNI01, challenges.HTTP01] \
+SUPPORTED_CHALLENGES = [challenges.HTTP01, challenges.TLSSNI01] \
 # type: List[Type[challenges.KeyAuthorizationChallenge]]
 
 


Test patch:
diff --git a/certbot-nginx/certbot_nginx/tests/configurator_test.py b/certbot-nginx/certbot_nginx/tests/configurator_test.py
--- a/certbot-nginx/certbot_nginx/tests/configurator_test.py
+++ b/certbot-nginx/certbot_nginx/tests/configurator_test.py
@@ -103,7 +103,7 @@ def test_enhance(self):
             errors.PluginError, self.config.enhance, 'myhost', 'unknown_enhancement')
 
     def test_get_chall_pref(self):
-        self.assertEqual([challenges.TLSSNI01, challenges.HTTP01],
+        self.assertEqual([challenges.HTTP01, challenges.TLSSNI01],
                          self.config.get_chall_pref('myhost'))
 
     def test_save(self):
diff --git a/certbot-nginx/tests/boulder-integration.sh b/certbot-nginx/tests/boulder-integration.sh
--- a/certbot-nginx/tests/boulder-integration.sh
+++ b/certbot-nginx/tests/boulder-integration.sh
@@ -39,6 +39,8 @@ nginx -v
 reload_nginx
 certbot_test_nginx --domains nginx.wtf run
 test_deployment_and_rollback nginx.wtf
+certbot_test_nginx --domains nginx.wtf run --preferred-challenges tls-sni
+test_deployment_and_rollback nginx.wtf
 certbot_test_nginx --domains nginx2.wtf --preferred-challenges http
 test_deployment_and_rollback nginx2.wtf
 # Overlapping location block and server-block-level return 301