# Cannot Renew Certificate **URL:** \ **Category:** Help\ **Created:** [February 5, 2023, 12:29am UTC](https://community.letsencrypt.org/t/cannot-renew-certificate/192250 "2023-02-05T00:29:14Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![WalmartDeli](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/walmartdeli/32/67520_2.png) [@WalmartDeli](https://community.letsencrypt.org/u/WalmartDeli)\ **Post date:** [February 5, 2023, 12:29am UTC](https://community.letsencrypt.org/t/cannot-renew-certificate/192250/1 "2023-02-05T00:29:14Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: csg.utdallas.edu I ran this command: `certbot renew --dry-run --nginx --cert-name csg.utdallas.edu` It produced this output: ```plaintext Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/csg.utdallas.edu.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Simulating renewal of an existing certificate for csg.utdallas.edu Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems: Domain: csg.utdallas.edu Type: connection Detail: 129.110.92.18: Fetching http://csg.utdallas.edu/.well-known/acme-challenge/s4wOa1Iwu0_OOZZnpJjCKVuJprIpXi-X_9icxIuHCd4: Connection reset by peer Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet. Failed to renew certificate csg.utdallas.edu with error: Some challenges have failed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - All simulated renewals failed. The following certificates could not be renewed: /etc/letsencrypt/live/csg.utdallas.edu/fullchain.pem (failure) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 renew failure(s), 0 parse failure(s) Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. ``` My web server is (include version): nginx/1.14.1 The operating system my web server runs on is (include version): CentOS Stream release 8 I can login to a root shell on my machine (yes or no, or I don't know): yes The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 1.22.0 Here is our nginx serverblock: /etc/nginx/sites-available/ghost ```plaintext server { server_name csg.utdallas.edu; # managed by Certbot listen 80; location / { root /var/www/ghost; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_pass http://127.0.0.1:2368; } client_max_body_size 50m; listen [::]:443 ssl ipv6only=on; # managed by Certbot listen 443 ssl default_server ssl; # managed by Certbot ssl_certificate /etc/letsencrypt/live/csg.utdallas.edu/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/csg.utdallas.edu/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot } ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 5, 2023, 1:49am UTC](https://community.letsencrypt.org/t/cannot-renew-certificate/192250/2 "2023-02-05T01:49:55Z")
Hi @WalmartDeli, and welcome to the LE community forum 🙂 > [@WalmartDeli](#): > > ```nohighlight > listen 80; > listen [::]:443 > > ``` How did you end up with both listens in the same server block? Also, I see "`renew`" and "`--nginx`" in the command line... Why? Please show the output of: `certbot certificates` And show the file: `/etc/letsencrypt/renewal/csg.utdallas.edu.conf` ---
**Author:** ![WalmartDeli](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/walmartdeli/32/67520_2.png) [@WalmartDeli](https://community.letsencrypt.org/u/WalmartDeli)\ **Post date:** [February 5, 2023, 4:04am UTC](https://community.letsencrypt.org/t/cannot-renew-certificate/192250/3 "2023-02-05T04:04:09Z")
Hello, > [@rg305](#): > > How did you end up with both listens in the same server block? When I remove the listen 443 the site no longer posts. Could this be firewall issues on port 80? I inherited this site from the previous manager and am not the most familiar with nginx. * * * > [@rg305](#): > > Also, I see "`renew`" and "`--nginx`" in the command line... > Why? I think I read that somewhere but I'm guessing that's wrong. When I run `'certbot renew --cert-name csg.utdallas.edu --dry-run` I get the output: ```nohighlight Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/csg.utdallas.edu.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Simulating renewal of an existing certificate for csg.utdallas.edu Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems: Domain: csg.utdallas.edu Type: connection Detail: 129.110.92.18: Fetching http://csg.utdallas.edu/.well-known/acme-challenge/2JpH-vvT4DVWxBuD6wQYE_rlVdvO7w2XNLDphkmjOfI: Connection refused Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet. Failed to renew certificate csg.utdallas.edu with error: Some challenges have failed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - All simulated renewals failed. The following certificates could not be renewed: /etc/letsencrypt/live/csg.utdallas.edu/fullchain.pem (failure) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 renew failure(s), 0 parse failure(s) Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. ``` * * * Certbot Certificates Output ````nohighlight Found the following certs: Certificate Name: csg.utdallas.edu Serial Number: 3e45aea5e6872bc69b89f19a50a77b9c42f Key Type: RSA Domains: csg.utdallas.edu Expiry Date: 2022-05-11 16:46:37+00:00 (INVALID: EXPIRED) Certificate Path: /etc/letsencrypt/live/csg.utdallas.edu/fullchain.pem Private Key Path: /etc/letsencrypt/live/csg.utdallas.edu/privkey.pem``` ```` * * * Output of `/etc/letsencrypt/renewal/csg.utdallas.edu.conf` ```nohighlight # renew_before_expiry = 30 days version = 1.6.0 archive_dir = /etc/letsencrypt/archive/csg.utdallas.edu cert = /etc/letsencrypt/live/csg.utdallas.edu/cert.pem privkey = /etc/letsencrypt/live/csg.utdallas.edu/privkey.pem chain = /etc/letsencrypt/live/csg.utdallas.edu/chain.pem fullchain = /etc/letsencrypt/live/csg.utdallas.edu/fullchain.pem # Options used in the renewal process [renewalparams] account = 487574e4ce6c432dc4d5e47cebf49ead authenticator = nginx installer = nginx server = https://acme-v02.api.letsencrypt.org/directory ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [February 5, 2023, 4:19am UTC](https://community.letsencrypt.org/t/cannot-renew-certificate/192250/4 "2023-02-05T04:19:29Z")
> [@WalmartDeli](#): > > Could this be firewall issues on port 80? Yes, it looks like a firewall is blocking port 80. Let's Encrypt requires port 80 be open for the HTTP Challenge (which --nginx authenticator uses). And, LE recommends it be open anyway ([link here](https://letsencrypt.org/docs/allow-port-80/)) See these results: ```nohighlight (request using HTTPS port 443 works if I ignore the cert error) curl -Ik https://csg.utdallas.edu HTTP/1.1 200 OK Server: nginx/1.14.1 X-Powered-By: Express (request with HTTP port 80 fails. Even just to home page) curl -Ik -m8 http://csg.utdallas.edu curl: (7) Failed to connect to csg.utdallas.edu port 80 after 38 ms: Connection refused ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 5, 2023, 5:31am UTC](https://community.letsencrypt.org/t/cannot-renew-certificate/192250/5 "2023-02-05T05:31:48Z")
You should have left the listen 443 [since that vhost was using a certificate]. And then create a new vhost fot HTTP [with listen 80]. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 7, 2023, 5:32am UTC](https://community.letsencrypt.org/t/cannot-renew-certificate/192250/6 "2023-03-07T05:32:05Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.