# Cannot get rid of supposed self signed cert **URL:** \ **Category:** Help\ **Created:** [January 22, 2020, 5:31am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233 "2020-01-22T05:31:16Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![tenraek](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tenraek](https://community.letsencrypt.org/u/tenraek)\ **Post date:** [January 22, 2020, 5:31am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/1 "2020-01-22T05:31:16Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [cprcommunity.net](http://cprcommunity.net) I ran this command: certbot It produced this output: It allowed me to choose www,[cprcommunity.net](http://cprcommunity.net) and [cprcommunity.net](http://cprcommunity.net) domains to instal cert on, and says cert was successfully installed. My web server is (include version): Apache/2.4.6 (CentOS) The operating system my web server runs on is (include version): CentOS 7 My hosting provider, if applicable, is: allowed me to choose I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): certbot 1.0.0. I’ve had a LE cert running on this site for months with no issue and just moved the site, along with a few others, of to a GC VM. (all clean install including apache and then migrate web files over). Somehow, possibly in my exhaustion I seem to have ended up getting a self assigned cert. This did not happen on any of the other sites I migrated doing the same process. There’s no other sites running on this server so while apache is configured with Virtual Hosts, there’s not other VH configs. I’ve tried revoking and reissuing and somehow thre self assigned one keeps coming back. I’ve followed help articles that say to disable VH and Listening in /etc/httpd/conf.d/ssl.conf Output of trying to renew showscorrect response: Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/cprcommunity.net/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/cprcommunity.net/privkey.pem Your cert will expire on 2020-04-21. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the “certonly” option. To non-interactively renew _all_ of your certificates, run “certbot renew” I’m at my wits end, please assist. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 6:00am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/2 "2020-01-22T06:00:03Z")
Please show output of: `apachectl -S` `grep -Eri 'virtualhost|servername|serveralias|sslcert|include' /etc/apache2/` `certbot certificates` `cat /etc/apache2/sites-available/default-ssl.conf` `ls -l /etc/apache2/sites-enabled/*` ---
**Author:** ![tenraek](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tenraek](https://community.letsencrypt.org/u/tenraek)\ **Post date:** [January 22, 2020, 6:19am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/3 "2020-01-22T06:19:29Z")
- Thank you in advance\* * * * Found the following certs: Certificate Name: [cprcommunity.net](http://cprcommunity.net) Domains: [cprcommunity.net](http://cprcommunity.net) [www.cprcommunity.net](http://www.cprcommunity.net) Expiry Date: 2020-04-21 04:13:08+00:00 (VALID: 89 days) Certificate Path: /etc/letsencrypt/live/cprcommunity.net/fullchain.pem Private Key Path: /etc/letsencrypt/live/cprcommunity.net/privkey.pem * * * ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 6:22am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/4 "2020-01-22T06:22:13Z")
That’s good. Can you get the other four requested? [you may need to use `sudo`] ---
**Author:** ![tenraek](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tenraek](https://community.letsencrypt.org/u/tenraek)\ **Post date:** [January 22, 2020, 6:27am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/5 "2020-01-22T06:27:32Z")
[root@cprcommunity jbeauchaine]# apachectl -S [root@cprcommunity jbeauchaine]# cat /etc/apache2/sites-available/default-ssl.conf cat: /etc/apache2/sites-available/default-ssl.conf: No such file or directory [root@cprcommunity jbeauchaine]# grep -Eri ‘virtualhost|servername|serveralias|sslcert|include’ /etc/apache2/ grep: /etc/apache2/: No such file or directory [root@cprcommunity jbeauchaine]# ls -l /etc/apache2/sites-enabled/\* ls: cannot access /etc/apache2/sites-enabled/\*: No such file or directory [root@cprcommunity jbeauchaine]# ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 6:31am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/6 "2020-01-22T06:31:49Z")
OK so your apache isn’t in the default deirectory ("`/etc/apache2/`")… Let’s find where it’s @: `which apache2` `find / -name sites-enabled` ---
**Author:** ![tenraek](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tenraek](https://community.letsencrypt.org/u/tenraek)\ **Post date:** [January 22, 2020, 6:35am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/7 "2020-01-22T06:35:54Z")
Oh, it’s centos so it’s under “httpd” not “apache2” [root@cprcommunity /]# find / -name sites-enabled /etc/httpd/sites-enabled [root@cprcommunity /]# which httpd /sbin/httpd [root@cprcommunity /]# ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 6:37am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/8 "2020-01-22T06:37:35Z")
DOH! CentOS! Try: `grep -Eri 'virtualhost|servername|serveralias|sslcert|include' /etc/httpd/` `ls -l /etc/httpd/sites-enabled/*` ---
**Author:** ![tenraek](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tenraek](https://community.letsencrypt.org/u/tenraek)\ **Post date:** [January 22, 2020, 6:39am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/9 "2020-01-22T06:39:52Z")
/etc/httpd/conf/httpd.conf:# ports, instead of the default. See also the /etc/httpd/conf/httpd.conf:Include conf.modules.d/_.conf /etc/httpd/conf/httpd.conf:# definition. These values also provide defaults for /etc/httpd/conf/httpd.conf:# any containers you may define later in the file. /etc/httpd/conf/httpd.conf:# All of these directives may appear inside containers, /etc/httpd/conf/httpd.conf:# ServerName gives the name and port that the server uses to identify itself. /etc/httpd/conf/httpd.conf:#ServerName [www.example.com:80](http://www.example.com:80) /etc/httpd/conf/httpd.conf: # Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews /etc/httpd/conf/httpd.conf:# If you do not specify an ErrorLog directive within a /etc/httpd/conf/httpd.conf:# logged here. If you do define an error logfile for a /etc/httpd/conf/httpd.conf:# Possible values include: debug, info, notice, warn, error, crit, /etc/httpd/conf/httpd.conf: # If you do not define any access logfiles within a /etc/httpd/conf/httpd.conf: # define per- access logfiles, transactions will be /etc/httpd/conf/httpd.conf: # If you include a trailing / on /webpath then the server will /etc/httpd/conf/httpd.conf: # To parse .shtml files for server-side includes (SSI): /etc/httpd/conf/httpd.conf: # (You will also need to add “Includes” to the “Options” directive.) /etc/httpd/conf/httpd.conf: AddOutputFilter INCLUDES .shtml /etc/httpd/conf/httpd.conf:IncludeOptional conf.d/_.conf /etc/httpd/conf/httpd.conf:IncludeOptional sites-enabled/\*.conf /etc/httpd/conf/httpd.conf:Include /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf /etc/httpd/conf.d/autoindex.conf:# directory must include “Indexes”, and the directory must not contain /etc/httpd/conf.d/autoindex.conf:# We include the /icons/ alias for FancyIndexed directory listings. If /etc/httpd/conf.d/autoindex.conf:# and not include in the listing. Shell-style wildcarding is permitted. /etc/httpd/conf.d/userdir.conf: Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec /etc/httpd/conf.d/ssl.conf: /etc/httpd/conf.d/ssl.conf:#ServerName [www.example.com:443](http://www.example.com:443) /etc/httpd/conf.d/ssl.conf:# Point SSLCertificateFile at a PEM encoded certificate. If /etc/httpd/conf.d/ssl.conf:SSLCertificateFile /etc/pki/tls/certs/localhost.crt /etc/httpd/conf.d/ssl.conf:SSLCertificateKeyFile /etc/pki/tls/private/localhost.key /etc/httpd/conf.d/ssl.conf:# Point SSLCertificateChainFile at a file containing the /etc/httpd/conf.d/ssl.conf:# the referenced file can be the same as SSLCertificateFile /etc/httpd/conf.d/ssl.conf:#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt /etc/httpd/conf.d/ssl.conf: /etc/httpd/conf.modules.d/00-base.conf:# This file loads most of the modules included with the Apache HTTP /etc/httpd/conf.modules.d/00-base.conf:LoadModule include\_module modules/mod\_include.so /etc/httpd/sites-available/cprcommunity.net.conf:\ /etc/httpd/sites-available/cprcommunity.net.conf: ServerName [cprcommunity.net](http://cprcommunity.net) /etc/httpd/sites-available/cprcommunity.net.conf: ServerAlias [www.cprcommunity.net](http://www.cprcommunity.net) /etc/httpd/sites-available/cprcommunity.net.conf: /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf:\ /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf: ServerName [cprcommunity.net](http://cprcommunity.net) /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf: ServerAlias [www.cprcommunity.net](http://www.cprcommunity.net) /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf:Include /etc/letsencrypt/options-ssl-apache.conf /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf:SSLCertificateFile /etc/letsencrypt/live/cprcommunity.net/c ert.pem /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf:SSLCertificateKeyFile /etc/letsencrypt/live/cprcommunity.ne t/privkey.pem /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf:SSLCertificateChainFile /etc/letsencrypt/live/cprcommunity. net/chain.pem /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf: lrwxrwxrwx. 1 root root 48 Jan 22 03:21 /etc/httpd/sites-enabled/cprcommunity.net.conf -\> /etc/httpd/sites-available/cprcommunity.net.conf ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 6:42am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/10 "2020-01-22T06:42:45Z")
Ok I see: `/etc/httpd/conf.d/ssl.conf:SSLCertificateFile /etc/pki/tls/certs/localhost.crt` `/etc/httpd/conf.d/ssl.conf:SSLCertificateKeyFile /etc/pki/tls/private/localhost.key` [most likely the self-signed cert] Can you show: `ls -l /etc/httpd/sites-enabled/*` If sites-enabled only has: `/etc/httpd/sites-enabled/cprcommunity.net.conf` That is the problem! You need to enable the site: `/etc/httpd/sites-available/cprcommunity.net-le-ssl.conf` [which has the cert you need] ---
**Author:** ![tenraek](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tenraek](https://community.letsencrypt.org/u/tenraek)\ **Post date:** [January 22, 2020, 6:43am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/11 "2020-01-22T06:43:36Z")
lrwxrwxrwx. 1 root root 48 Jan 22 03:21 /etc/httpd/sites-enabled/cprcommunity.net.conf -\> /etc/httpd/sites-available/cprcommunity.net.conf ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 6:46am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/12 "2020-01-22T06:46:29Z")
Try: `sudo a2ensite cprcommunity.net` [then restart apache/httpd] ---
**Author:** ![tenraek](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tenraek](https://community.letsencrypt.org/u/tenraek)\ **Post date:** [January 22, 2020, 6:48am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/13 "2020-01-22T06:48:20Z")
Ahh! I think I follow you, OK. Let me give that a shot. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 6:50am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/14 "2020-01-22T06:50:03Z")
If you can’t “enable” it, just mv it to the folder `/etc/httpd/conf.d/` [all the files in there are automatically included] Or go all old-school on it: ```auto sudo ln -s /etc/httpd/sites-available/cprcommunity.net-le-ssl.conf /etc/httpd/sites-enabled/cprcommunity.net-le-ssl.conf ``` ---
**Author:** ![tenraek](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tenraek](https://community.letsencrypt.org/u/tenraek)\ **Post date:** [January 22, 2020, 6:55am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/15 "2020-01-22T06:55:18Z")
yup, that what I did, alas that hasn’t resolved ☹ even restarted httpd and reran certbot ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 6:56am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/16 "2020-01-22T06:56:03Z")
OK there is NO need to rerun `certbot`. `certbot certificates` shows the cert is ready for use. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 6:57am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/17 "2020-01-22T06:57:31Z")
It must be a really old version of apache… Let me re-review the included folders. in the meantime, please show: `ls -l /etc/httpd/conf.d/*` ---
**Author:** ![tenraek](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tenraek](https://community.letsencrypt.org/u/tenraek)\ **Post date:** [January 22, 2020, 6:58am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/18 "2020-01-22T06:58:19Z")
-rw-r–r--. 1 root root 2926 Aug 8 11:41 /etc/httpd/conf.d/autoindex.conf -rw-r–r--. 1 root root 1252 Jan 21 11:35 /etc/httpd/conf.d/php.conf -rw-r–r--. 1 root root 366 Aug 8 11:42 /etc/httpd/conf.d/README -rw-r–r--. 1 root root 9443 Jan 22 05:15 /etc/httpd/conf.d/ssl.conf -rw-r–r--. 1 root root 1252 Aug 6 13:44 /etc/httpd/conf.d/userdir.conf -rw-r–r--. 1 root root 824 Aug 6 13:44 /etc/httpd/conf.d/welcome.conf ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 22, 2020, 7:10am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/19 "2020-01-22T07:10:37Z")
> [@tenraek](#): > > yup, that what I did, alas that hasn’t resolved Which did you do? [I don't see the file in the conf.d folder] So I repeat myself: > [@rg305](#): > > If you can’t “enable” it, just mv it to the folder `/etc/httpd/conf.d/` > [all the files in there are automatically included] as per (from above): `/etc/httpd/conf/httpd.conf:IncludeOptional conf.d/*.conf` ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [February 21, 2020, 7:10am UTC](https://community.letsencrypt.org/t/cannot-get-rid-of-supposed-self-signed-cert/111233/20 "2020-02-21T07:10:41Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.