Ah yes, that is a new error. Reading the error message suggests that we'll need to update the API URL that Dehydrated uses. According to a Let's Encrypt announcement disallowing new registrations for APIv1 wasn't supposed to happen until next month. Existing users have until June 2020 apparently, although this early breakage of v1 suggests that it's probably best not to wait...

I documented on the bug report how to install from upstream (it's a bit dirty, but in this case it's not "unsafe"). Not sure if you've done that, or the just "fixed" the single line (i.e. adjusting the single line in Dehydrated)?

Regardless, either of those will resolve the Nonce issue, but without further changes, it will still attempt to use the v1 API. I haven't done any testing yet, but a quick google suggests that we'll need to adjust the URL that Dehydrated connects to (stored in the CA variable). Currently it is:

CA="https://acme-v01.api.letsencrypt.org/directory"

For new users, that now needs to be:

CA="https://acme-v02.api.letsencrypt.org/directory"

It's probably also worth existing users changing that too and double checking that everything works as it should.

It's probably worth noting that there is now a newer version of Dehydrated in stretch-backports now (actually, it's the latest version). So installing from backports is another (cleaner) way to upgrade it.

As noted above, I'm yet to do any testing to confirm my understanding, but essentially, these steps should resolve the issue(s):

1. upgrade dehydrated (either from upstream or via stretch-backports)
2. update the confconsole hook script (from TurnKey's GH)
3. update the API URL (to v2)

And then everything should be all systems go!

I'll aim to look into this further ASAP (within the next few days) but I'm currently a bit bogged down with other stuff.

PS - I hope you don't mind me editing your post to make it a bit easier to read... :)

Judging from the error message "this_hookscript_is_broken__dehydrated_is_working_fine__please_ignore_unknown_hooks_in_your_script", I'm guessing that you haven't updated the hook script. To do that (as per step 2 of the workaround noted on the issue):

GH_URL=https://raw.githubusercontent.com/turnkeylinux/confconsole/master
GH_HOOK=share/letsencrypt/dehydrated-confconsole.hook.sh
CC_HOOK="$DEHYD_ETC/confconsole.hook.sh"
SH_HOOK=$SHARE/dehydrated-confconsole.hook.sh

wget $GH_URL/$GH_HOOK -O $SH_HOOK
cp $SH_HOOK $CC_HOOK

Hopefully that should get you up and running...

If you use the same FQDN for both sites, then it should work fine. Although as I say, unless it's a paid for certificate, the advantages of swapping the cert are limited (because it will expire and without the fix, it won't be able to renew)...

Thanks too for your kind words. Good luck with it. :)

FWIW, I'm currently observing AEDT (UTC+11) so it's now day over for me now! :)

Looking at your screenshot, it appears that you still have the old hook script (see the line that says "this_hooks_script_is_broken"). I'm not quite sure why you hit that, but if you followed step 1 in the "How to install/update" instructions, all the old scripts/config should have been removed (and then first run should have reinstated the new ones). Rerunning these lines (then rerunning the "get certificate process) should get things working for you:

rm -rf /etc/dehydrated/confconsole{.config,.hook.sh}
rm -rf /etc/cron.daily/confconsole-dehydrated

So hopefully that fixes everything and you're good to go. Please let me know if you continue to have issues. Although unless it's directly related to this Let's Encrypt issue, probably best to start a new thread.

[update] just after posting this message I noticed your note about using Webmin. Apologies that I missed that before. Yes, I suspect that may be a part of the issue (I never use Webmin myself...). I would encourage you to always use SSH for terminal commands as the terminal in Webmin is not a proper interactive shell (although Webshell, on port 12320 IS a proper interactive shell). FWIW on an Ubuntu host, it should be really easy to access via SSH, e.g. open a terminal and:

ssh root@VM_IP_ADDRESS