Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: https://italimporta.nl
I ran this command:
certbot renew --dry-run
It produced this output:
The following errors were reported by the server:
Domain: italimporta.nl
Type: connection
Detail: Fetching
http://italimporta.nl/.well-known/acme-challenge/JnRRpRVg67WczeEKezwo1XfwgZD4stQyEBMrf9Qs914:
Connection refused
My web server is (include version):
Apache2
The operating system my web server runs on is (include version):
Debian
My hosting provider, if applicable, is:
my own vps
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no, command line
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 0.28.0
I think the fact that the renew is not working is due to the fact that there is a redirect to https in my config-file for the apache2 config. Which seems strange since this has been working fine until recently?
So how to deal with this and make certbot perform the renewal again?
The renewal seems to work on some virtual host though?
The following certs were successfully renewed:
/etc/letsencrypt/live/pizzajollyovens.nl/fullchain.pem (success)
/etc/letsencrypt/live/pizzaworkshop.nl/fullchain.pem (success)
/etc/letsencrypt/live/hocom-advies.nl/fullchain.pem (success)
/etc/letsencrypt/live/server.hooghwinkel.com/fullchain.pem (success)
The following certs could not be renewed:
/etc/letsencrypt/live/italimporta.nl/fullchain.pem (failure)
/etc/letsencrypt/live/pizzajolly.nl/fullchain.pem (failure)
/etc/letsencrypt/live/italimporta.nl-0001/fullchain.pem (failure)
Also have an error on an other domain (which is a subdomain of the one which is not renewing) the error lays in that domains .conf file and is caused by a "#" in front of a line. Will get that line out and see what happens
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certbot/storage.py", line 429, in __init__
self.configfile = configobj.ConfigObj(config_filename)
File "/usr/lib/python3/dist-packages/configobj.py", line 1229, in __init__
self._load(infile, configspec)
File "/usr/lib/python3/dist-packages/configobj.py", line 1318, in _load
raise error
File "<string>", line None
configobj.ParseError: Invalid line (' /var/www/www.italimporta.nl/www') (matched as neither section nor keyword) at line 16.
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certbot/renewal.py", line 65, in _reconstitute
renewal_candidate = storage.RenewableCert(full_path, config)
File "/usr/lib/python3/dist-packages/certbot/storage.py", line 432, in __init__
"error parsing {0}".format(config_filename))
certbot.errors.CertStorageError: error parsing /etc/letsencrypt/renewal/leukvanpizzajolly.nl.conf
Renewal configuration file /etc/letsencrypt/renewal/leukvanpizzajolly.nl.conf is broken. Skipping.
The following certs could not be renewed:
/etc/letsencrypt/live/italimporta.nl/fullchain.pem (failure)
/etc/letsencrypt/live/pizzajolly.nl/fullchain.pem (failure)
So appearantly there is a problem with the two domains which belog to the same "webroot". The domains are part of a TYPO3 CMS and accessable through the same site. They do not have a different webroot. Since TYPO3 takes care of the routing/ publishing of the sites/ pages.
Thanks for your reply. I still do not understand where the fault is?
I now run certbot --standalone renew --dry-run instead of certbot renew --dry-run That produces less errors. I'm not sure if this is a correct way offcourse. Still one error left for italimporta.nl
I'v put the output in a pastebin maybe it helps. certbot_renew_erros - Pastebin.com
If I look in both the certificates in detail I can see some differences. The one for Italimporta.nl has also references to leukvanpizzajolly.nl the other certficate has only leukvanpizajolly.nl mentioned? Is that ok?
Ok ran it again without standalone:
this is the result in pastebin:
So this part is maybe important?
Attempting to renew cert (italimporta.nl) from /etc/letsencrypt/renewal/italimporta.nl.conf produced an unexpected error: Missing command line flag or config entry for this setting:
Select the webroot for leukvanpizzajolly.nl:
Choices: ['Enter a new webroot', '/var/www/www.italimporta.nl/www']
(You can set this with the --webroot-path flag). Skipping.
But if I look at the
/etc/letsencrypt/renewal/italimporta.nl.conf file it holds the correct webroot?
Attempting to renew cert (italimporta.nl) from /etc/letsencrypt/renewal/italimporta.nl.conf produced an unexpected error: Missing command line flag or config entry for this setting:
Select the webroot for leukvanpizzajolly.nl:
Choices: ['Enter a new webroot', '/var/www/www.italimporta.nl/www']
(You can set this with the --webroot-path flag). Skipping.
can't see all that is there.