# Apachectl -S says fullchain.pem does not exist or is empty but certbot says it has been saved **URL:** \ **Category:** Help\ **Created:** [June 4, 2018, 2:29pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585 "2018-06-04T14:29:25Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![luckydad](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@luckydad](https://community.letsencrypt.org/u/luckydad)\ **Post date:** [June 4, 2018, 2:29pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/1 "2018-06-04T14:29:25Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [peerpowerinc.com](http://peerpowerinc.com) I ran this command: sudo certbot --apache It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache ## Which names would you like to activate HTTPS for? ## 1: [peerpowerinc.com](http://peerpowerinc.com) 2: [www.peerpowerinc.com](http://www.peerpowerinc.com) Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter 'c' to cancel): 1,2 Cert not yet due for renewal You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry. (ref: /etc/letsencrypt/renewal/peerpowerinc.com.conf) ## What would you like to do? ## 1: Attempt to reinstall this existing certificate 2: Renew & replace the cert (limit ~5 per 7 days) Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Renewing an existing certificate Performing the following challenges: http-01 challenge for [peerpowerinc.com](http://peerpowerinc.com) http-01 challenge for [www.peerpowerinc.com](http://www.peerpowerinc.com) Waiting for verification... Cleaning up challenges Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/000-default-le-ssl.conf Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/000-default-le-ssl.conf ## Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. ## 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1 * * * Your existing certificate has been successfully renewed, and the new certificate has been installed. The new certificate covers the following domains: [https://peerpowerinc.com](https://peerpowerinc.com) and [https://www.peerpowerinc.com](https://www.peerpowerinc.com) ## You should test your configuration at: [SSL Server Test: peerpowerinc.com (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=peerpowerinc.com) [SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=www.peerpowerinc.com) IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/peerpowerinc.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/peerpowerinc.com/privkey.pem Your cert will expire on 2018-09-02. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew _all_ of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: ubuntu@ip-172-30-0-154:/var/www/html/sites/default$ apachectl -S AH00526: Syntax error on line 38 of /etc/apache2/sites-enabled/000-default-le-ssl.conf: SSLCertificateFile: file '/etc/letsencrypt/live/peerpowerinc.com/fullchain.pem' does not exist or is empty Action '-S' failed. The Apache error log may have more information. ubuntu@ip-172-30-0-154:/var/www/html/sites/default$ My web server is (include version): Server version: Apache/2.4.18 (Ubuntu) The operating system my web server runs on is (include version): Description: Ubuntu 16.04.4 LTS Release: 16.04 Codename: xenial My hosting provider, if applicable, is: AWS I can login to a root shell on my machine (yes or no, or I don't know): Yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No Hi- Thanks for letsencrypt and for this support site. I have tried many different steps, following many different tutorials to make my site 100% https. Very possible I did not do correct setup ahead of time and may still not have correct setup. This post was helpful: > [@Trouble getting started after following certbot instructions](https://community.letsencrypt.org/t/trouble-getting-started-after-following-certbot-instructions/63347): > > I… I _thought_ i had successfully installed cert due to above success message. But then when I ran apachectl -S I got: SSLCertificateFile: file '/etc/letsencrypt/live/peerpowerinc.com/fullchain.pem' does not exist or is empty Action '-S' failed. The Apache error log may have more information. So I looked in Apache2 error log and saw this: [Mon Jun 04 13:39:31.720436 2018] [ssl:warn] [pid 26899] AH01909: ip-172-30-0-154.ec2.internal:443:0 server certificate does NOT include an ID which matches the server name What started me down this whole path was after original success installing cert (according to output of certbot), I went to > **[SSL Server Test: www.peerpowerinc.com (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=www.peerpowerinc.com)** and > **[SSL Server Test: peerpowerinc.com (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=peerpowerinc.com)** and got Assessment failed: Unable to connect to the server Any help would be appreciated. Thanks in advance. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [June 4, 2018, 2:42pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/2 "2018-06-04T14:42:48Z")
Try with sudo `sudo apachectl -S` ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [June 4, 2018, 2:43pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/3 "2018-06-04T14:43:27Z")
Hi @luckydad, > [@luckydad](#): > > apachectl -S > > I got: > > SSLCertificateFile: file ‘/etc/letsencrypt/live/peerpowerinc.com/fullchain.pem’ does not exist or is empty > Action ‘-S’ failed. You get this error because you are running the command as a normal user, use sudo or directly the user root: Also, are you sure your firewall is not blocking port 443?. Cheers, sahsanu ---
**Author:** ![luckydad](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@luckydad](https://community.letsencrypt.org/u/luckydad)\ **Post date:** [June 4, 2018, 3:09pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/4 "2018-06-04T15:09:00Z")
Hi sahsanu- Thanks for the quick reply, I really appreciate it. 1. I ran sudo apachectl -S and got the following output: ubuntu@ip-172-30-0-154:/var/www/html/sites/default$ sudo apachectl -S VirtualHost configuration: \*:80 [peerpowerinc.com](http://peerpowerinc.com) (/etc/apache2/sites-enabled/000-default.conf:1) \*:443 is a NameVirtualHost default server [peerpowerinc.com](http://peerpowerinc.com) (/etc/apache2/sites-enabled/000-default-le-ssl.conf:2) port 443 namevhost [peerpowerinc.com](http://peerpowerinc.com) (/etc/apache2/sites-enabled/000-default-le-ssl.conf:2) alias [www.peerpowerinc.com](http://www.peerpowerinc.com) alias [www.peerpowerinc.com](http://www.peerpowerinc.com) alias [peerpowerinc.com](http://peerpowerinc.com) port 443 namevhost [peerpowerinc.com](http://peerpowerinc.com) (/etc/apache2/sites-enabled/000-default.conf:10) alias [www.peerpowerinc.com](http://www.peerpowerinc.com) port 443 namevhost ip-172-30-0-154.ec2.internal (/etc/apache2/sites-enabled/default-ssl.conf:2) ServerRoot: “/etc/apache2” Main DocumentRoot: “/var/www/html” Main ErrorLog: “/var/log/apache2/error.log” Mutex default: dir="/var/lock/apache2" mechanism=fcntl Mutex mpm-accept: using\_defaults Mutex watchdog-callback: using\_defaults Mutex rewrite-map: using\_defaults Mutex ssl-stapling-refresh: using\_defaults Mutex ssl-stapling: using\_defaults Mutex ssl-cache: using\_defaults PidFile: “/var/run/apache2/apache2.pid” Define: DUMP\_VHOSTS Define: DUMP\_RUN\_CFG User: name=“www-data” id=33 Group: name=“www-data” id=33 1. I am not sure my firewall is not blocking port 443 Does this help: ubuntu@ip-172-30-0-154:/var/www/html/sites/default$ netstat -tuplen (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:\* LISTEN 0 15428 - tcp 0 0 127.0.0.1:3306 0.0.0.0:\* LISTEN 112 44338 - tcp6 0 0 :::22 :::\* LISTEN 0 15430 - tcp6 0 0 :::443 :::\* LISTEN 0 223693 - tcp6 0 0 :::80 :::\* LISTEN 0 223689 - udp 0 0 0.0.0.0:68 0.0.0.0:\* 0 12230 - Cheers, luckydad ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [June 4, 2018, 3:39pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/5 "2018-06-04T15:39:33Z")
@luckydad, show the output of this command: `sudo ufw status` ---
**Author:** ![luckydad](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@luckydad](https://community.letsencrypt.org/u/luckydad)\ **Post date:** [June 4, 2018, 3:41pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/6 "2018-06-04T15:41:19Z")
thanks, @sahsanu here it is: ubuntu@ip-172-30-0-154:/var/www/html/sites/default$ sudo ufw status Status: active To Action From * * * Apache Full ALLOW Anywhere OpenSSH ALLOW Anywhere Apache Full (v6) ALLOW Anywhere (v6) OpenSSH (v6) ALLOW Anywhere (v6) -luckydad ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [June 4, 2018, 4:12pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/7 "2018-06-04T16:12:46Z")
> [@luckydad](#): > > Apache Full ALLOW Anywhere Show the output of: `sudo iptables --list-rules` and the output of: `sudo cat /etc/apache2/sites-enabled/default-ssl.conf` You can use some service like [pastebin.com](http://pastebin.com) to paste the outputs. ---
**Author:** ![luckydad](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@luckydad](https://community.letsencrypt.org/u/luckydad)\ **Post date:** [June 4, 2018, 4:22pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/8 "2018-06-04T16:22:24Z")
Hi @sahsanu- I shared output from iptables and default-ssl in this pastebin: [https://pastebin.com/0S0utCY0](https://pastebin.com/0S0utCY0) Thanks. ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [June 4, 2018, 4:33pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/9 "2018-06-04T16:33:32Z")
Regarding this: > [@sahsanu](#): > > Show the output of: > > `sudo iptables --list-rules` Forget it, I realized you allow Apache Full so that covers ports 80 and 443. I don't use AWS but maybe there is an external firewall that you need to configure...?. Just a test, try to connect to your domain from the same machine: ``` curl -ikL https://peerpowerinc.com curl -ikL https://127.0.0.1 -H "Host: peerpowerinc.com" echo | openssl s_client -connect 127.0.0.1:443 -servername peerpowerinc.com 2>/dev/null | openssl x509 -noout -text | grep -E '(Issuer:|Not After|DNS:)' ``` ---
**Author:** ![luckydad](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@luckydad](https://community.letsencrypt.org/u/luckydad)\ **Post date:** [June 4, 2018, 4:41pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/10 "2018-06-04T16:41:01Z")
ubuntu@ip-172-30-0-154:/var/www/html/sites/default$ curl -ikL [https://peerpowerinc.com](https://peerpowerinc.com) curl: (7) Failed to connect to [peerpowerinc.com](http://peerpowerinc.com) port 443: Connection timed out ---
**Author:** ![luckydad](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@luckydad](https://community.letsencrypt.org/u/luckydad)\ **Post date:** [June 4, 2018, 4:42pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/11 "2018-06-04T16:42:01Z")
ubuntu@ip-172-30-0-154:/var/www/html/sites/default$ curl -ikL [https://127.0.0.1](https://127.0.0.1) -H “Host: [peerpowerinc.com](http://peerpowerinc.com)” HTTP/1.1 301 Moved Permanently Date: Mon, 04 Jun 2018 16:41:21 GMT Server: Apache/2.4.18 (Ubuntu) Location: [https://www.peerpowerinc.com/](https://www.peerpowerinc.com/) Content-Length: 320 Content-Type: text/html; charset=iso-8859-1 ---
**Author:** ![luckydad](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@luckydad](https://community.letsencrypt.org/u/luckydad)\ **Post date:** [June 4, 2018, 4:43pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/12 "2018-06-04T16:43:05Z")
ubuntu@ip-172-30-0-154:/var/www/html/sites/default$ echo | openssl s\_client -connect 127.0.0.1:443 -servername [peerpowerinc.com](http://peerpowerinc.com) 2\>/dev/null | openssl x509 -noout -text | grep -E ‘(Issuer:|Not After|DNS:)’ Issuer: C=US, O=Let’s Encrypt, CN=Let’s Encrypt Authority X3 Not After : Sep 2 13:10:11 2018 GMT DNS:peerpowerinc.com, DNS:www.peerpowerinc.com ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [June 4, 2018, 5:01pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/13 "2018-06-04T17:01:04Z")
You firewall rules allow connections to ports 80 and 443, your web server is listening on ports 80 and 443 and it is serving the right site with the right certificate, double check whether there is some external firewall blocking connections to port 443. ---
**Author:** ![luckydad](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@luckydad](https://community.letsencrypt.org/u/luckydad)\ **Post date:** [June 4, 2018, 5:26pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/14 "2018-06-04T17:26:31Z")
Hi @sahsanu- Looks like it was an EC2 thing. Found another post where person solved it by: “…I hadn’t opened up port 443 in my EC2 instance Security Group.” Once I did that in AWS dashboard I was able to load https. Getting mixed http and https content but when I did Qualys check finally passed! Thank you SO MUCH. -luckydad ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 4, 2018, 5:28pm UTC](https://community.letsencrypt.org/t/apachectl-s-says-fullchain-pem-does-not-exist-or-is-empty-but-certbot-says-it-has-been-saved/63585/15 "2018-07-04T17:28:10Z")
Closed on July 4, 2018, 5:28pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.