Skip to content

Cannot renew Let's Encrypt cert due to ACMEv1

Apologies in advance if the GitLab Community Edition issue tracker is a more appropriate place to file this issue, let me know if that is the case and I will move the issue there.

My instance (gitlab-ce=11.10.4-ce.0 from gitlab.com's Debian repo) is unable to renew its SSL certificates. When running gitlab-ctl reconfigure, the following is returned:

Running handlers:
There was an error running gitlab-ctl reconfigure:

letsencrypt_certificate[gitlab.<redacted>.com] (letsencrypt::http_authorization line 3) had an error: Acme::Client::Error::Unauthorized: acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 20) had an error: Acme::Client::Error::Unauthorized: Account creation on ACMEv1 is disabled. Please upgrade your ACME client to a version that supports ACMEv2 / RFC 8555. See https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430 for details.

It seems to me that the acme-client gem (version 0.4.0 on my install) used by the acme cookbook (version 3.1.0) requires an update, but due to my unfamiliarity with the GitLab ecosystem I am not sure what the best way is to upgrade it. Simply upgrading the entire GitLab package fails since that requires the last gitlab-ctl reconfigure run to be successful. What would the proper approach be for this issue?