After renewal, domain.com:8XXX uses old cert

My domain is: reggaespace.com

I ran this command: certbot renew

It produced this output: /etc/letsencrypt/live/reggaespace.com/fullchain.pem expires on 2022-01-15 (skipped)

My web server is (include version): nginx version: nginx/1.14.2

The operating system my web server runs on is (include version): NAME="Ubuntu"
VERSION="16.04.6 LTS (Xenial Xerus)"

My hosting provider, if applicable, is: Linode VPS

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 0.31.0

Hi folks,

I have website running at domain.com
After renewal the new certificate works

Audio stream at domain.com:8XXX
Cert info:
This cert has expired or is not vaild
Valid from: dates for previous cert

Can anyone help me make renewal work on domain.com:8XXX smoothly?

Thanks in advance

1 Like

It would help if you provided the port and domain name for the server that is failing. Also, is that alternate port 8XXX served by your nginx or is nginx just a proxy to something else that serves your audio stream?

Note the renew command in your post worked but did not update your certificate. There was no reason to as it does not expire for 58 more days. That is why the message said "skipped" - there was nothing necessary to do.

Without more info it is hard to advise. You can check your own certs with a site like the one below. Enter the domain name and port to see your certs. Maybe that will be enough for you to see and fix your problem.
https://decoder.link/sslchecker
Note that site shows your 443 server certificates for reggaespace.com as being just fine.

3 Likes

Did you renew the audio stream service so it actually loads and uses the renewed certificate?

3 Likes

https://reggaespace.com:8012/live.mp3

This would be used to listen to our audio stream. It worked up until the certificate for reggaespace.com renewed two days ago. This is preferred as it avoids ‘mixed content’ issues on the player page (https://www.reggaespace.com/wrs-audio/).

The alternative stream url is http://97.107.136.190:8010/live.mp3. This works but can lead to ‘mixed content’ issues.

nginx serves both the website (reggaespace.com) and audio streaming.

I am running on a Linode VPS and I assume the audio stream service restarts when I reboot the VPS. Which I have done.

Hmm. Yes, I see now the cert that is sent from your 8012 server expired 3 days ago.

It looks like nginx is using a different certificate file for the server with "listen 8012;" compared to the one with "listen 443;". If you want us to look at it please post the results of this command: sudo nginx -T (omit sudo if you are already root, capital T is important)

When you paste the results please use the preformatted text option in the menu (Ctrl-E).

An important thing to note is your cert history shown here. You have issued various combinations of cert names - some with just reggaespace.com and others with www, stream, and so on.

Your port 443 server is using the one issued on Oct17 but your 8012 server looks like it is using one of them issued on Aug18. Maybe this is enough for you to see what is going wrong. If not, please post the nginx -T as I described.

3 Likes

How is the TLS certificate configured in your IceCast?

3 Likes

If nginx is involved at all:

curl -Iki https://reggaespace.com:8012/
Server: Icecast 2.4.4 (MSCP)

Perhaps just restarting Icecast (or the server) will suffice.

3 Likes

nginx seems unrelated to Icecast.

Perhaps just restarting Icecast (or the server) will suffice.

2 Likes

Yeah, agreed. I was relying on their comment that nginx was serving audio but you and Osiris are right that is not the case.

@Tuzongo I am not familiar with Icecast but you need to review its configuration and make sure it refers to the current certificates. That is, that it uses the same ones that nginx is using for your 443 servers. The Icecast docs say it needs a "bundle" containing the privkey.pem along with the fullchain.pem so you must have manually created that at one point (or maybe as a deploy hook?). You need to repeat what you did for that. See:
https://icecast.org/docs/icecast-2.4.1/config-file.html

Search that page for ssl-certificate for the config location and the description of the bundle

3 Likes

I issued this command but it seems to have made no difference.

systemctl restart icecast2
1 Like

If this is the actual correct place for IceCast to configure TLS certificates, this path is not automatically updated by certbot. You probably copied the certificate from /etc/letsencrypt/ to that /etc/icecast2/ location. If possible, use the path in /etc/letsencrypt/live/${name_of_certificate}/fullchain.pem directly(Edit: as @MikeMcQ already pointed out and what I missed is that it requires the certificate bundle and private key) and if that's not possible (e.g. due to permission issues), make a script which takes care of all the copying, chown-ing and reloading IceCast stuff and configure that script as a --deploy-hook in certbot.

3 Likes
<!-- The certificate file needs to contain both public and private part.
     Both should be PEM encoded.
-->
<ssl-certificate>/etc/icecast2/bundle.pem</ssl-certificate>

You must have followed a guide/instructions that had you combine the (fullchain) cert and key files into this file: /etc/icecast2/bundle.pem

You will have to update that bundle file and also systemctl restart icecast2 each time a new cert is issued (there is --deploy-hook option in certbot to help with this step).

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.