Dear Maintainer,

with the update of certbot and the DNS Gandi plugin, the command line
arguments for requesting a certificate have changed.

This is not taken into account during upgrade, which left all domains
that are normally being renewed via the gandi plugin broken.

Above that, no warning email was sent to the admin user about this problem.

The letsencrypt.log file contains

2023-06-18 00:49:00,298:ERROR:certbot._internal.renewal:Renewal configuration file /etc/letsencrypt/renewal/SOOME.DOMAIN.conf (cert: SOME.DOMAIN) produced an unexpected error: 'Namespace' object has no attribute 'certbot_plugin_gandi:dns_credentials'. Skipping.
2023-06-18 00:49:00,302:DEBUG:certbot._internal.renewal:Traceback was:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 501, in handle_renewal_request
    renewal_candidate = _reconstitute(lineage_config, renewal_file)
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 103, in _reconstitute
    _restore_plugin_configs(config, renewalparams)
  File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 173, in _restore_plugin_configs
    if config_item.startswith(plugin_prefix + "_") and not cli.set_by_cli(config_item):
                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/cli/__init__.py", line 489, in set_by_cli
    if not isinstance(getattr(detector, var), _Default):
                      ^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'Namespace' object has no attribute 'certbot_plugin_gandi:dns_credentials'


Solution is to run **once** per domain the correct renew line
	certbot certonly --authenticator dns-gandi --dns-gandi-credentials /etc/letsencrypt/gandi/gandi.ini -d SOME.DOMAIN

Best regards

Norbert

Hello Norbert,

Thanks for letting me know.  I've spoken with upstream about this as
well, and to see what we can do in the future to ensure something like
this doesn't happen again. I've written up a draft preinst script that
should rewrite the config files to remove the problem.

Do you still have a host that's in the buggy state, or did you fix
them all with the workaround?  Because it's going to be fixed in a
preinst, I'd like more testing (and more eyes) on it than I normally
would, just for caution's sake.

Sincerely,

Hi Harlan,

Great, thanks for taking action.

Sorry no, the domain certificates were running out, because as I mentioned,
there was also no warning message, so I only realized it when letsencrypt
send an email that the domains run out.

So all of them are now update.

You could still send me the code and I give it an eye ;-)

Best regards

Norbert

tag 1038920 +patch
thanks

Sold!  preinst file is attached.

Sincerely,

* First of all, you need to convert some - to _ since these are translated
  into python modules

* Then, does that suffice? Looking into the conf files I have, I also see lines
	authenticator = dns-gandi
coming from the calls

OLD:
	certbot certonly --certbot-plugin-gandi:dns-credential /etc/letsencrypt/gandi.ini -d DOMAIN_LIST

NEW:
	certbot certonly --authenticator dns-gandi --dns-gandi-credentials /etc/letsencrypt/gandi.ini -d DOMAIN_LIST

Now with the above you would rewrite the config file lines
	certbot-plugin-gandi:dns_credentials = ...
to
	dns_gandi_credentials = ...
(Note the _ here for dns_gandi_credentials and most probably also for
dns_credentials, but I cannot check now!)

But then still the new line
	authenticator = dns-gandi
is missing.

Just as food for thoughts.

Best

Norbert

On Fri, 30 Jun 2023 03:24:00 +0000 Harlan Lieberman-Berg <hlieberman@debian.org> wrote:

Hello,

I "bumped into" this bug on a server too. This server is still in "buggy
state".

Certificate is valid for more than 30days from now.

Can I test a new package version instead of making changes manually ?

Regards,
Fernando

Hello,

I’m the original creator of this Gandi plugin. Yes, the command line argument have
changed. Certbot changed the arguments on their side unilaterally. Like detailed
in the README, Certbot had moved to remove 3rd party plugins prefixes
since v1.7.0. Afaik, there is nothing I can do to get around that.

Moreover, Gandi has deprecated the use of API Key, meaning this plugin version
is now render useless and does not work anymore. So the choices are either to
let this Debian package dies in darkness or to update it to the latest version.

I do not have control over the release of this package, but I’m willing to maintain it if
needed, I just need a way to gain control over the package.

https://api.gandi.net/docs/authentication/

Regards,
Yohann

Having just hit this issue, here are some notes for anyone else in a
hurry to fix it before their certificates expire:

1. I have a Gandi API token, which is deprecated but still works. I've
not attempted to fix that yet.

2. I'm running Debian 12.10 with automatic updates. I currently have
python3-certbot-dns-gandi version 1.4.3-1.

3. I first modified my /etc/letsencrypt/gandi.ini to:
dns_gandi_api_key=abcdefghijklmn

4. For each domain, I then modified two lines in
/etc/letsencrypt/renewal/DOMAIN.conf to:
authenticator = dns-gandi
dns_gandi_credentials = /etc/letsencrypt/gandi.ini

5. For each domain, I then ran
letsencrypt renew --cert-name NAME
where NAME == DOMAIN in my case, but may not always be so.

This has worked for me. I don't know if it will now successfully
automatically renew in future.

It would be great if some of this happened automatically.

Note this change has coincided with Lets Encrypt deciding to stop
sending out domain expiry emails.
I only knew that something was wrong because of those emails, and would
have missed it if it had
happened in a few weeks time.

I hope this is useful to someone who finds this bug when searching for
the error message that
I found in the log file.


Regards, Phil.