Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:engineersneedart.com
I ran this command:
It produced this output:
My web server is (include version):
The operating system my web server runs on is (include version):
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
When I first set up Let's Encrypt (using certbot) I followed the instructions and, I believe, set up a kind of auto-renewal for the certificate(s)? Perhaps it was a cron job that would kick it off? I don't recall.
Recently though, some months back and then again now, I am being prompted to manually renew the certification.
The only thing I can think that may have "broke" it was that one of my original domains I let expire.
Any pointers to how I can find the issue, get my auto-certify going again?
Sure, I can see your cert history points to a change with lainecalhoun.com. Is that still yours? I ask because an nginx server replies to HTTP requests for that domain. But, your other domains are handled by Apache.
Also where are you being prompted? Are you getting an email from Let's Encrypt or is it something else? Currently your certs for that domain seem sot be renewing based on crt.sh | engineersneedart.com
Yes lainecalhoun.com was the domain I let expire. I had heard people might snap up expired domains because they think they'll get the "traffic"? Yeah, looks like it might be a Chinese site now, ha ha.
It was email. Perhaps it is just the missing lainecalhoun.com domain then that is kicking off the email (I really don't think it's phishing). Perhaps the others are being renewed (engineersneedart.com, kardland.com, mooncraft2000.com are the ones that come to mind.)
What do you make of it? I see the three domains I expect (with www. variants). Perhaps then the cron job is also trying to renew lainecalhoun.com and failing? Just a guess.
Yeah, getting further. lainecalhoun.com is somehow still the gremlin somewhere in the server:
ChatGPT suggested we test one of the domains: sudo certbot renew --cert-name www.mooncraft2000.com --dry-run
And errors ensued — with lainecalhoun.com the stickler (even though that was not the domain we were trying to renew):
:
Processing /etc/letsencrypt/renewal/www.mooncraft2000.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Error while running apachectl configtest.
AH00526: Syntax error on line 12 of /etc/httpd/conf/httpd-le-ssl.conf:
SSLCertificateFile: file '/etc/letsencrypt/live/lainecalhoun.com/fullchain.pem' does not exist or is empty
Failed to renew certificate www.mooncraft2000.com with error: The apache plugin is not working; there may be problems with your existing configuration.
The error was: MisconfigurationError("Error while running apachectl configtest.\n\nAH00526: Syntax error on line 12 of /etc/httpd/conf/httpd-le-ssl.conf:\nSSLCertificateFile: file '/etc/letsencrypt/live/lainecalhoun.com/fullchain.pem' does not exist or is empty\n")
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All simulated renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/www.mooncraft2000.com/fullchain.pem (failure)
: