After my web server worked for a few days, I wanted to add additional domain. Easy enough, done it before - I though. However, I got hit by an error as I tried to get Let's Encrypt certificate in place: The server experienced a TLS error during domain verification :: remote error: tls: handshake failure.
The most interesting thing was that I haven't changed anything on the web server. So I tried a few old commands (history is handy here) with the Let's Encrypt's staging server. Although I was sure they worked when I was originally setting up the server, I was suddenly presented with the same error for all of them. And nothing changed!
After looking at the error message a bit more, I suddenly remembered that one thing did change - I moved my domain records to CloudFlare. Certbot was trying to authenticate my web server but ended up contacting CloudFlare and fetching their TLS certificate for my web site instead. Solution was simple - just temporarily disable caching on CloudFlare and certbot will successfully issue the certificate.
While solution was simple, it wasn't ideal as this also meant I would need to repeat the same disabling every 90 days in order to do certificate renewal. I wanted solution that would allow automating renewal without the need for any manual action. This came by slightly altering how certbot performs verification.
# certbot renew --cert-name example.com --webroot --webroot-path /var/www/html/ --post-hook "apachectl graceful"Alternative approach above stores certificate into .well-known directory under the root web site path and thus works nicely with the CloudFlare caching.