Can u remove and reinstall certbot

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

theoceanwindow.com

I ran this command:

certbot certificates

It produced this output:

Renewal configuration file /usr/local/etc/letsencrypt/renewal/theoceanwindow.com.conf produced an unexpected error: renewal config file {} is missing a required file reference. Skipping.

The following renewal configurations were invalid:
/usr/local/etc/letsencrypt/renewal/theoceanwindow.com.conf

My web server is (include version):
apache24
The operating system my web server runs on is (include version):
FreeBSD 14.2

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot 4.0.0

I have been abusing this server for the past couple of months

Postfix TLS Library Problem No such file

and

Using wildcard ssl certificate - #17 by barf7709

as show above, in trying to handle multiple sub domains on ip. I have REALLY REALLY messed up may cerrbot installation. I have been workin with SSLs.com. and have manage to get 4 of my subdomains uo using their trial certificate. My question is tif were is any way I can flush my cerbot installation so I can return with my head hung down to letsencrypt? My site if is basically now just a hobby/project.

2

@captcurrent I modified your original post to mention both of the apex domain names in your recent certificates. You used both in the Sectigo certs and the older ones from Let's Encrypt. Your most recent Sectigo cert is: crt.sh | 18526077112

I see you changed it back to just listing theoceanwindow. I had changed it because it is helpful for volunteers to know all the domains in a certificate. I mention it now to ensure any volunteers who wish to offer help know about that.

1 Like
3

Yeah they have confused between domain and sub domains Their "help staff". seems fixated on the oceeanwindow.com being the domain and the theoceanwindow.com, mailtheoceanwindow.com and kasdivi.com being subdomains

4

For certificates, distinguishing between "domain names" and "subdomains" is not really very important.

We focus on the fully qualified domain names as that is what is placed in the certificate. I don't think any volunteers here are confused about that :slight_smile:

Often when there are multiple apex domains involved we see problems affecting one but not the other.

2 Likes
5

well currently both "apex" domains have same ip, This the discussion in my post about wild cards. SSLs.com. and handle wildcards in a certificate for a premium cost that I can't justify. as I have disposed al my paying clients. The current server is utilizing SAN in its certificates

6

So did you edit the conf file manually or was this caused by a glitch in certbot? I'd guess that you could move that file elsewhere as a backup then start a new certificate request with certbot to get a a new certificate configuration.

You could show us the content if that file, which might help.

You don't have to reinstall certbot (the app) itself, you just need to get the configuration working again.

7

the file as it say is empty. I have damaged or killed all assoociated data

8

It would seem ok to remove that then.

9

my goal, (if possible) is to get certbot (which I broke) working again. Deletion of theoceanwindow.com.conf will help ??? guess it can't hurt

10

How did that happen?

did you do it, either accidentally or on purpose; or don't you know?

if you don't know it might happen again.

1 Like
11

thanks you for you jumping in Yes , as I said previousiy, it was all self inflicted no outside involvement

12

Unless you know how to recover, I'd backup the entire /etc/letsencrypt directory and start from scratch.

Note that your webserver might not like this (it won't start if the config refers to nonexisting certificates).

2 Likes
13

Much thanks. Will see what happens

14

just for your info. I am running Freebsd 14. 2 As predicted apache not happy camper. It is running with the certs from SSLs. That I want to replace... Should I clean them out?? Message was.

Unable to restart apache using ['apachectl', 'graceful']
Encountered exception during recovery: certbot.errors.MisconfigurationError: Error while >running apachectl graceful.
apache24 not running? (check /var/run/httpd.pid).
Error while running apachectl graceful.
apache24 not running? (check /var/run/httpd.pid).

Apachectl graceful runs from command line just fine

15

Apache wants a well-formed certificate, even a self signed snakeoil one will work. (or you can use certbot --standalone and then certbot reconfigure --apache when apache is running)

1 Like
16

Apache runs. it doesn't get along with certbot l Your idea have been good give this a try

17

had to be certbot certonly.. I received one certficate. It covers all four domain. Wow. I am back to where I was before I screwed up. Now I have to figure how to use again with postfix and dovecot. Your are a saint. I hope my experience help others

18

note that most of that software needs reloading after a certificate renewal (also, --standalone doesn't work while apache is up, that's why I say to reconfigure), you can use --deploy-hook "command to reload your daemons"

1 Like
19

would that be "certbot ---deploy-hook" ?

20

certbot reconfigure --cert-name $CERTNAME --deploy-hook "command"

(you can get $CERTNAME from certbot certificates, it should look like one of your domain names, the one in the certificate path)

1 Like