cannot indicate an order replaces certificate with serial <serial>, which already has a replacement order

[amo13]

Welcome

• Yes, I'm using a binary release within 2 latest releases.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).

What did you expect to see?

I try to renew a wildcard certificate:

NAMECHEAP_API_USER=myuser \
NAMECHEAP_API_KEY=mykey \
LEGO_DISABLE_CNAME_SUPPORT=true \
/path/to/lego \
--email support@mydomain.com \
--dns namecheap \
--domains *.mydomain.com \
--dns.resolvers=8.8.8.8 \
--accept-tos \
--path /path/to/.lego \
renew

Obviously, I expect the receive a new certificate.

---

Doing some research on that error, I was able to find

• https://community.letsencrypt.org/t/error-handling-for-ari-replaces-conflict/223504
• https://fossies.org/linux/boulder/wfe2/wfe.go
• Cannot indicate an order replaces certificate with serial <code>, which already has a replacement order rmbolger/Posh-ACME#560

I do not fully understand their contents and the problem I am facing, but maybe that is of some help for some lego maintainer/contributor?

---

Workaround was to request a new certificate. That worked fine, but I thought I'd just leave this note here.

What did you see instead?

2025/03/09 07:28:07 [INFO] [*.mydomain.com] acme: renewalInfo endpoint indicates that renewal is needed
2025/03/09 07:28:07 [INFO] [*.mydomain.com] acme: Trying renewal with 399 hours remaining
2025/03/09 07:28:07 [INFO] renewal: random delay of 4m44.820140431s
2025/03/09 07:32:52 [INFO] [*.mydomain.com] acme: Obtaining bundled SAN certificate
2025/03/09 07:32:52 acme: error: 409 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:acme:error:conflict :: While validating order as a replacement an error occurred :: cannot indicate an order replaces certificate with serial <serial>, which already has a replacement order

How do you use lego?

Binary

Reproduction steps

see above

Effective version of lego

lego version 4.22.2 linux/amd64

Logs

see above

Go environment (if applicable)

not applicable

[ldez]

Hello,

as a workaround you can disable ARI: --ari-disable

[amo13]

Ah, cool, thanks for the hint.
Maybe lego should handle that automatically instead of failing?