400 Error When Attempting to Obtain Cert

[wcmgto]

I get the following error when it attempts to obtain a certificate. It then reverts to a self signed cert. Any ideas? The ESX hosts are part of a cluster and managed by vCenter.

Response Code: 400
Response: {'type': 'urn:ietf:params:acme:error:rejectedIdentifier', 'detail': 'Error creating new order :: Cannot issue for "example.domain.": Domain name ends in a dot', 'status': 400}

[Churro]

Domain name ends in a dot

... is the error returned by Let's Encrypt API. It should work if you modify the hostname and remove the trailing dot.

[Churro]

Yes, the error is definitely returned by Let's Encrypt and related to the domain name. What are you seeing on that ESXi machine when running hostname -f? That's the command this script is using. If it ends with a dot, it would confirm the root cause of the issue.

[wcmgto]

hostname -f does indeed return it with a dot. I'll look into that. Thanks for the tip.

[wcmgto]

I have the DNS suffix set for the ESXi server through the DCUI. It appears to append the dot at the end automatically. I see this same thing on hosts running 6.7 and 8. So I don't think it's something I can change.

[wcmgto]

I was able to bypass this by using the renew.cfg file and specifying the hostname for the DOMAIN variable. That works to get the cert and apply it successfully. However, I now have an issue with HA on the cluster. All hosts are set to Partner Supported as I did not change them when installing via SSH. Any ideas?

Error:
Cannot complete the configuration of the vSphere HA agent on the host. "Applying HA VIBs on the cluster encountered a failure". Failed installing HA component on the host: host-11 A VIB package cannot be installed due to the current host acceptance level configuration.

[Churro]

Presumably, the easiest option would be to switch to CommunitySupported -> https://github.com/w2c/letsencrypt-esxi/wiki/Troubleshooting