load_entry_point('certbot==1.11.0', 'console_scripts', 'certbot')()  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 15, in main    return internal_main.main(cli_args)  File "/usr/lib/python2.7/site-packages/certbot/_internal/main.py", line 1421, in main    return config.func(config, plugins)  File "/usr/lib/python2.7/site-packages/certbot/_internal/main.py", line 1318, in renew    renewal.handle_renewal_request(config)  File "/usr/lib/python2.7/site-packages/certbot/_internal/renewal.py", line 497, in handle_renewal_request    len(renew_failures), len(parse_failures))) Error: 1 renew failure(s), 0 parse failure(s) 2021-10-17 23:53:33,650:ERROR:certbot._internal.log:1 renew failure(s), 0 parse failure(s)
```
---
### Author:  [@schoen](https://community.letsencrypt.org/u/schoen)
#### Post date: [October 19, 2021, 1:44am UTC](https://community.letsencrypt.org/t/ca-root-do-lets-encrypt-expirou-certificado-nao-renovou-centos-7/163470/4 "2021-10-19T01:44:01Z")
@_az what do you think of this type error way down inside the Certbot client implementation? It does seem to have been triggered when first trying to connect to the API, and, being CentOS, may suggest difficulty validating the API's certificate—but it didn't produce a very useful error message.
@SergioFisco obrigado pelas informações. No contexto acho provável que seja um dos problemas descrito no tópico
> [@RHEL/CentOS 7 OpenSSL client compatibility after new chain](https://community.letsencrypt.org/t/rhel-centos-7-openssl-client-compatibility-after-new-chain/151969/1):
>
> A…
e que uma das soluções lá possa resolver. A mais comumente útil solução lá foi atualizar o pacote `ca-certificates` no seu servidor CentOS. Entretanto, a mensagem de erro que você recebeu é distinto da mensagem que os usuários do Certbot costumam receber nesse caso e não sei porque, também não sei se isso indica outro tipo de problema.
Outra coisa que pode tentar, para comparação, é `curl -v https://acme-v02.api.letsencrypt.org/directory` na mesma máquina, só para ver se der um erro de verificação ao se conectar à API.
---
### Author:  [@\_az](https://community.letsencrypt.org/u/_az)
#### Post date: [October 19, 2021, 2:12am UTC](https://community.letsencrypt.org/t/ca-root-do-lets-encrypt-expirou-certificado-nao-renovou-centos-7/163470/5 "2021-10-19T02:12:08Z")
> [@schoen](#):
>
> but it didn't produce a very useful error message
Yeah it's unfortunate that the underlying error was swallowed in this way.
Edit: oh whoops, of course the error will still be swallowed with the command I suggested. Hmm. ~~I'll try think of something~~. I think the curl command should _probably_ reveal the true error. CentOS 7's curl does use nss instead of libssl, but hopefully it won't be relevant.
---
### Author:  [@SergioFisco](https://community.letsencrypt.org/u/SergioFisco)
#### Post date: [October 19, 2021, 12:25pm UTC](https://community.letsencrypt.org/t/ca-root-do-lets-encrypt-expirou-certificado-nao-renovou-centos-7/163470/6 "2021-10-19T12:25:13Z")
[root@fiscodatalapp01 ~]# curl -v [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)
- About to connect() to [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org) port 443 (#0)
- Trying 172.65.32.248...
- Connected to [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org) (172.65.32.248) port 443 (#0)
- Initializing NSS with certpath: sql:/etc/pki/nssdb
- CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
- Server certificate:
-
```
subject: CN=acme-v01.api.letsencrypt.org
```
-
```
start date: Oct 17 20:22:16 2021 GMT
```
-
```
expire date: Jan 15 20:22:15 2022 GMT
```
-
```
common name: acme-v01.api.letsencrypt.org
```
-
```
issuer: CN=R3,O=Let's Encrypt,C=US
```
- NSS error -8179 (SEC\_ERROR\_UNKNOWN\_ISSUER)
- Peer's Certificate issuer is not recognized.
- Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.
More details here: [curl - SSL CA Certificates](http://curl.haxx.se/docs/sslcerts.html)
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
---
### Author:  [@\_az](https://community.letsencrypt.org/u/_az)
#### Post date: [October 19, 2021, 10:35pm UTC](https://community.letsencrypt.org/t/ca-root-do-lets-encrypt-expirou-certificado-nao-renovou-centos-7/163470/7 "2021-10-19T22:35:55Z")
> [@SergioFisco](#):
>
> NSS error -8179 (SEC\_ERROR\_UNKNOWN\_ISSUER)
Thank you!
Could you check these two commands as well:
```
rpm -q ca-certificates
```
and
```
trust list --filter="pkcs11:id=%79%b4%59%e6%7b%b6%e5%e4%01%73%80%08%88%c8%1a%58%f6%e9%9b%6e;type=cert"
```
---
### Author:  [@SergioFisco](https://community.letsencrypt.org/u/SergioFisco)
#### Post date: [October 20, 2021, 12:52pm UTC](https://community.letsencrypt.org/t/ca-root-do-lets-encrypt-expirou-certificado-nao-renovou-centos-7/163470/8 "2021-10-20T12:52:34Z")
[root@fiscodatalapp01 ~]# rpm -q ca-certificates
ca-certificates-2015.2.6-70.1.el7\_2.noarch
[root@fiscodatalapp01 ~]#
[root@fiscodatalapp01 ~]# trust list --filter="pkcs11:id=%79%b4%59%e6%7b%b6%e5%e4%01%73%80%08%88%c8%1a%58%f6%e9%9b%6e;type=cert"
p11-kit: uri contained unrecognized components, nothing will be extracted
---
### Author:  [@\_az](https://community.letsencrypt.org/u/_az)
#### Post date: [October 20, 2021, 8:54pm UTC](https://community.letsencrypt.org/t/ca-root-do-lets-encrypt-expirou-certificado-nao-renovou-centos-7/163470/9 "2021-10-20T20:54:25Z")
> [@SergioFisco](#):
>
> ca-certificates-2015.2.6-70.1.el7\_2.noarch
This is very out of date and probably explains the issue. Update the package and try again:
```
yum -y install ca-certificates
```
---
### Author:  [@SergioFisco](https://community.letsencrypt.org/u/SergioFisco)
#### Post date: [October 22, 2021, 2:51pm UTC](https://community.letsencrypt.org/t/ca-root-do-lets-encrypt-expirou-certificado-nao-renovou-centos-7/163470/10 "2021-10-22T14:51:13Z")
Atualizei o pacote como "\_az" indicou e a renovação se fez OK;
Obrigado pelas dicas importantes.