# Auto renew failed. Certficates expired **URL:** \ **Category:** Help\ **Created:** [June 19, 2024, 5:05pm UTC](https://community.letsencrypt.org/t/auto-renew-failed-certficates-expired/220374 "2024-06-19T17:05:52Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Michal2](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@Michal2](https://community.letsencrypt.org/u/Michal2)\ **Post date:** [June 19, 2024, 5:05pm UTC](https://community.letsencrypt.org/t/auto-renew-failed-certficates-expired/220374/1 "2024-06-19T17:05:52Z")
Hi guys, pleas help me ... My domain is: raminet.cz I ran this command: certbot --apache It produced this output: Plugins selected: Authenticator apache, Installer apache An unexpected error occurred: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 453, in wrap\_socket cnx.do\_handshake() File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1915, in do\_handshake self.\_raise\_ssl\_error(self.\_ssl, result) File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1647, in \_raise\_ssl\_error \_raise\_current\_error() File "/usr/lib/python3/dist-packages/OpenSSL/\_util.py", line 54, in exception\_from\_error\_queue raise exception\_type(errors) OpenSSL.SSL.Error: [('SSL routines', 'tls\_process\_server\_certificate', 'certificate verify failed')] During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 601, in urlopen chunked=chunked) File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 344, in \_make\_request self.\_validate\_conn(conn) File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 846, in _validate\_conn conn.connect() File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 358, in connect ssl\_context=context) File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 347, in ssl\_wrap\_socket return context.wrap\_socket(sock, server\_hostname=server\_hostname) File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 459, in wrap\_socket raise ssl.SSLError('bad handshake: %r' % e) ssl.SSLError: ("bad handshake: Error([('SSL routines', 'tls\_process\_server\_certificate', 'certificate verify failed')])",) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/requests/adapters.py", line 449, in send timeout=timeout File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 639, in urlopen \_stacktrace=sys.exc\_info()[2]) File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 399, in increment raise MaxRetryError(\_pool, url, error or ResponseError(cause)) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='[acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org)', port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls\_process\_server\_certificate', 'certificate verify failed')])"))) During handling of the above exception, another exception occurred: requests.exceptions.SSLError: HTTPSConnectionPool(host='[acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org)', port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls\_process\_server\_certificate', 'certificate verify failed')])"))) Please see the logfiles in /var/log/letsencrypt for more details. My web server is (include version): Apache The operating system my web server runs on is (include version): Linux mail 4.19.0-26-amd64 #1 SMP Debian 4.19.304-1 (2024-01-09) x86\_64 GNU/Linux I can login to a root shell on my machine (yes or no, or I don't know): yes The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 0.31.0 ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [June 19, 2024, 8:41pm UTC](https://community.letsencrypt.org/t/auto-renew-failed-certficates-expired/220374/2 "2024-06-19T20:41:50Z")
> [@Michal2](#): > > OpenSSL.SSL.Error: [('SSL routines', 'tls\_process\_server\_certificate', 'certificate verify failed')] Welcome @Michal2 That error indicates something wrong with your system or package CA trust store. Because of that validation fails for the cert and chain used by the Let's Encrypt API. What changes have there been since your last good cert on Mar21? Did you have any operating system upgrades, or have you modified your python version, or things like that? Your Certbot version 0.31 is extremely old. You may be able to fix this by upgrading to the snap version. See: [https://certbot.eff.org](https://certbot.eff.org) As further debug info, what do these show ```nohighlight curl https://acme-v02.api.letsencrypt.org/directory echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head ``` ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [June 20, 2024, 3:44am UTC](https://community.letsencrypt.org/t/auto-renew-failed-certficates-expired/220374/3 "2024-06-20T03:44:09Z")
@Michal2 as a general tip, make sure the email address you use when setting up certbot etc is real and monitored, that way you get email notifications if a certificate is about to expire and you haven't renewed it. ---
**Author:** ![Michal2](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@Michal2](https://community.letsencrypt.org/u/Michal2)\ **Post date:** [June 20, 2024, 5:34pm UTC](https://community.letsencrypt.org/t/auto-renew-failed-certficates-expired/220374/4 "2024-06-20T17:34:09Z")
Finished .... snap and new version certbot installed : certbot 2.11.0 root@server : certbot certonly --apache Saving debug log to /var/log/letsencrypt/letsencrypt.log An unexpected error occurred: requests.exceptions.SSLError: HTTPSConnectionPool(host='[acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org)', port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed: certificate is not yet valid (\_ssl.c:1131)'))) Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [June 20, 2024, 5:50pm UTC](https://community.letsencrypt.org/t/auto-renew-failed-certficates-expired/220374/5 "2024-06-20T17:50:28Z")
Please also show the output of the debug commands shown by Mike. ---
**Author:** ![Michal2](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@Michal2](https://community.letsencrypt.org/u/Michal2)\ **Post date:** [June 20, 2024, 5:53pm UTC](https://community.letsencrypt.org/t/auto-renew-failed-certficates-expired/220374/6 "2024-06-20T17:53:40Z")
Jesus ... i found the problem ... board batery failed ... The system time and the board time were not the same ... i am stupid idiot ... batery changed and all works now ... Thank you all for the tips ... ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [June 20, 2024, 5:57pm UTC](https://community.letsencrypt.org/t/auto-renew-failed-certficates-expired/220374/7 "2024-06-20T17:57:19Z")
Ah yes, the error message changed.. Didn't notice the "certificate is not yet valid" just now. Makes sense the date wasn't correct. Appears the latest version of Certbot presents some more useful error messages. (Just have to notice it.. 😛) ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 20, 2024, 5:57pm UTC](https://community.letsencrypt.org/t/auto-renew-failed-certficates-expired/220374/8 "2024-07-20T17:57:40Z")
Closed on July 20, 2024, 5:57pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.