Let’s encrypt更新SSL证书提示It seems the CA server is busy now的问题

今天突然收到一封SSL证书监控的告警邮件，翻开内容原来证书过期了。该网站的SSL证书是let's encrypt免费证书，有效期3个月，但我已经使用acme脚本配置了自动更新，一年多运行下来也没有出现过问题。只能登录服务器查看原因了。发现日志中有类似“It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.”的错误，这个错误导致证书没有定时更新。

[Mon Jan  6 00:46:02 CST 2020] Renew: 'nbhao.org'
[Mon Jan  6 00:46:03 CST 2020] Multi domain='DNS:nbhao.org,DNS:*.nbhao.org'
[Mon Jan  6 00:46:03 CST 2020] Getting domain auth token for each domain
[Mon Jan  6 00:51:03 CST 2020] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Mon Jan  6 00:56:07 CST 2020] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Mon Jan  6 01:01:10 CST 2020] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Mon Jan  6 01:06:11 CST 2020] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Mon Jan  6 01:11:13 CST 2020] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Mon Jan  6 01:16:18 CST 2020] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.
[Mon Jan  6 01:21:23 CST 2020] It seems the CA server is busy now, let's wait and retry. Sleeping 1 seconds.

根据错误提示，字面上的意思是CA服务器连接出现了问题。但是let's encrypt作为全球最知名的免费SSL证书，CA服务器应该不大可能出现问题，即使出现问题，应该也会抓紧恢复，不会那么多天过去还无法连接。最后去官方找到新闻，找资料，发现let's encrypt升级了api的cdn。那么问题应该好办了，尝试升级acme脚本。

cd /root/jobs/acme
./acme.sh --upgrade

升级成功

再次运行更新ssl证书的计划任务，问题解决。

为了防止这个问题再次出现，添加定时更新脚本的计划任务，再添加这个https网站的ssl证书监控。

如果有碰到相同问题无法解决，其他SSL证书的问题或购买，欢迎咨询。

参考文章：

《非80端口不支持Http验证域名签发let’s encrypt ssl证书》：https://zhangnq.com/2633.html

《Zabbix 增加HTTPS网站SSL证书过期时间监控》：https://zhangnq.com/3106.html

1. 还没有Trackbacks