Linode renew no longer working in releases 5+

[ceamac]

Welcome

• Yes, I'm using a binary release or the library within the two latest releases.
• Yes, I've searched for similar issues on GitHub and didn't find any.

How do you use lego?

go install

Effective version of lego

5.1.0

Logs

Details

2026-05-31T09:34:10.611691970+03:00 INFO  Renewing certificate cert-name=xxxxx.ro
2026-05-31T09:34:11.382408536+03:00 INFO  Trying renewal. cert-name=xxxxx.ro time-remaining=26d18h33m58s617601126ns
2026-05-31T09:34:11.382657819+03:00 INFO  Obtaining bundled SAN certificate. domains="xxxxx.ro, *.xxxxx.ro"
2026-05-31T09:34:11.746815134+03:00 WARN  retry: acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Could not validate ARI 'replaces' field :: requester account did not request the certificate being replaced by this order
2026-05-31T09:34:11.747085460+03:00 ERROR Error error="renew certificate: could not obtain the certificate for \"xxxxx.ro\": unable to communicate with the API server: error: Post \"https://acme-v02.api.letsencrypt.org/acme/new-order\": POST https://acme-v02.api.letsencrypt.org/acme/new-order giving up after 1 attempt(s): acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Could not validate ARI 'replaces' field :: requester account did not request the certificate being replaced by this order"

What did you expect to see?

Keys being renewed

What did you see instead?

2026-05-31T09:34:11.746815134+03:00 WARN  retry: acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Could not validate ARI 'replaces' field :: requester account did not request the certificate being replaced by this order
2026-05-31T09:34:11.747085460+03:00 ERROR Error error="renew certificate: could not obtain the certificate for \"xxxxx.ro\": unable to communicate with the API server: error: Post \"https://acme-v02.api.letsencrypt.org/acme/new-order\": POST https://acme-v02.api.letsencrypt.org/acme/new-order giving up after 1 attempt(s): acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Could not validate ARI 'replaces' field :: requester account did not request the certificate being replaced by this order"

Reproduction steps

With 5.1.0 and with 5.0.4 it fails with the message above:
LINODE_TOKEN_FILE=/.lego/.lego-linode-api-key LINODE_PROPAGATION_TIMEOUT=300 lego run --dns linode renew -d 'xxxxx.ro,*.xxxxx.ro' --email my@email

Same result with
LINODE_TOKEN_FILE=/.lego/.lego-linode-api-key LINODE_PROPAGATION_TIMEOUT=300 lego run --dns linode renew -d 'xxxxx.ro' -d '*.xxxxx.ro' --email my@email

With 4.35.2:
LINODE_TOKEN_FILE=/.lego/.lego-linode-api-key LINODE_PROPAGATION_TIMEOUT=300 lego -d 'xxxxx.ro,*.xxxxx.ro' --email my@email --dns linode renew

It renewed my keys.

Go environment (if applicable)

Details

# paste output here

In which context are you using lego?

Personal use

🌱 Supporting the Maintainer

• Yes, I find this project useful, and it has saved me time in my workflow/business.
• Yes, I have starred this repository to help others find it.
• Yes, I have sponsored this project to keep the project stable and maintained.

Confirmation

• Yes, I've included all the information above (version, usage, etc.).

[ldez]

Hello,

Have you followed the migration guide?

The error is not related to the DNS provider, but to wrong information about the local state of the certificate.

[ceamac]

Oops, I missed the migration guide. Thanks!