Can't renewal certificates

[Alex89W]

Hello,

I installed certbot on an ubuntu-server 32-bit with 3 certificates renewal worked once. Then I had an issue with operating system bit-version with wordpress. Did new installation of ubuntu server 64 bit. Apache, certbot cleared installed etc. Restoration of necessary files and configs. But it looks like something went wrong. Renewal is now not possible

For renewal subdomain testsite.wanker.co.at I have created this file successfully, which is accessible
https://testsite.wanker.co.at/.well-known/acme-challenge/test

My domain is:
Found the following certs:
Certificate Name: tauernadler.wanker.co.at
Domains: www.wanker.co.at tauernadler.wanker.co.at testsite.wanker.co.at
Expiry Date: 2020-10-08 13:16:42+00:00 (VALID: 12 days)
Certificate Path: /etc/letsencrypt/live/tauernadler.wanker.co.at/fullchain.pem
Private Key Path: /etc/letsencrypt/live/tauernadler.wanker.co.at/privkey.pem
Certificate Name: testsite.wanker.co.at
Domains: testsite.wanker.co.at
Expiry Date: 2020-10-08 13:18:30+00:00 (VALID: 12 days)
Certificate Path: /etc/letsencrypt/live/testsite.wanker.co.at/fullchain.pem
Private Key Path: /etc/letsencrypt/live/testsite.wanker.co.at/privkey.pem
Certificate Name: www.wanker.co.at
Domains: www.wanker.co.at
Expiry Date: 2020-10-08 13:17:40+00:00 (VALID: 12 days)
Certificate Path: /etc/letsencrypt/live/www.wanker.co.at/fullchain.pem
Private Key Path: /etc/letsencrypt/live/www.wanker.co.at/privkey.pem

---

//////////////////////////////////////////////////////////////////////////////////
First Try:
I ran this command:
sudo certbot certonly --cert-name testsite.wanker.co.at

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?

---

1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)

---

Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Plugins selected: Authenticator webroot, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for testsite.wanker.co.at
Input the webroot for testsite.wanker.co.at: (Enter 'c' to cancel): /var/www/testsite/
Waiting for verification...
Challenge failed for domain testsite.wanker.co.at
http-01 challenge for testsite.wanker.co.at
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: testsite.wanker.co.at
  Type: connection
  Detail: Fetching
  https://testsite.wanker.co.at/.well-known/acme-challenge/S8-j_9dxS_psrOEMqYCNdhL8y1da1bNrp22mUrr4S5E:
  Error getting validation data

  To fix these errors, please make sure that your domain name was
  entered correctly and the DNS A/AAAA record(s) for that domain
  contain(s) the right IP address. Additionally, please check that
  your computer has a publicly routable IP address and that no
  firewalls are preventing the server from communicating with the
  client. If you're using the webroot plugin, you should also verify
  that you are serving files from the webroot path you provided.

//////////////////////////////////////////////////////////////////////////////////
Second Try:
I ran this command:
sudo certbot renew --cert-name testsite.wanker.co.at -w /var/www/testsite/

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log

---

Processing /etc/letsencrypt/renewal/testsite.wanker.co.at.conf

---

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for testsite.wanker.co.at
Using the webroot path /var/www/testsite for all unmatched domains.
Waiting for verification...
Challenge failed for domain testsite.wanker.co.at
http-01 challenge for testsite.wanker.co.at
Cleaning up challenges
Attempting to renew cert (testsite.wanker.co.at) from /etc/letsencrypt/renewal/testsite.wanker.co.at.conf produced an unexpected error: Some challenges have failed.. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/testsite.wanker.co.at/fullchain.pem (failure)

---

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/testsite.wanker.co.at/fullchain.pem (failure)

---

1 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: testsite.wanker.co.at
  Type: connection
  Detail: Fetching
  https://testsite.wanker.co.at/.well-known/acme-challenge/vxH22rPerxudQcQHo0Pu0YBx5wU-qM3dJpdKUinPb7A:
  Error getting validation data

  To fix these errors, please make sure that your domain name was
  entered correctly and the DNS A/AAAA record(s) for that domain
  contain(s) the right IP address. Additionally, please check that
  your computer has a publicly routable IP address and that no
  firewalls are preventing the server from communicating with the
  client. If you're using the webroot plugin, you should also verify
  that you are serving files from the webroot path you provided.

My web server is (include version):
Server version: Apache/2.4.41 (Ubuntu)
Server built: 2020-08-12T19:46:17

The operating system my web server runs on is (include version):
Ubuntu 20.04.1 LTS (GNU/Linux 5.4.0-1016-raspi aarch64)

My hosting provider, if applicable, is:
My Domain is parked at company emerion in Austria.
I'm doing my Web-Hosting on my own webserver.
My Internet-Provider is A1.

I can login to a root shell on my machine (yes or no, or I don't know):
Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No, only terminal on ubuntu server

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 0.40.0

Thanks for your help.

[griffin]

Welcome to the Let's Encrypt Community, Alex

It looks like there's a problem with the ipv6 address associated with wanker.home.dyndns.org. Try removing/fixing that AAAA record.

testsite.wanker.co.at. 3599 IN CNAME wanker.home.dyndns.org.

wanker.home.dyndns.org. 59 IN AAAA 2001:870:258:1a65:0:be:a1:aced

As for your certbot command, you might try the following, ensuring that your webroots are all correct:

sudo certbot certonly --cert-name wanker.co.at -a webroot -w /var/www/testsite/ -d testsite.wanker.co.at -w /var/www/tauernadler/ -d tauernadler.wanker.co.at -w /var/www/www/ -d www.wanker.co.at --dry-run

If this works, remove the --dry-run and run it again.

If that works, try this:
sudo certbot run --cert-name wanker.co.at -i apache

[Alex89W]

Hello griffin

thanks for you fast anwer and help!

I have checked current ipv6 settings on my router.
The ipv6 seems to be correct and forwarded to dyndns AAAA record.
But maybe there is a problem at port forwarding.
I have disable IPv6.

Let's debug -> All OK!

Then tried the first command. --> Try-run was successful.
--> Without try-run --> Certs new expire date -> 2020-12-25

But as I tried this command:
sudo certbot run --cert-name wanker.co.at -i apache

I got this:
What does this command do?

////////////
How would you like to authenticate with the ACME CA?

---

1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)

---

Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
The requested apache plugin does not appear to be installed
////////////

There are the certification-files for testsite subdomain:
SSLCertificateFile /etc/letsencrypt/live/www.wanker.co.at/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.wanker.co.at/privkey.pem

When I check this files, they where not updated.

So with the last request it has created new certificate at new folder "wanker.co.at". So I can use this certificate for all "VirtualHosts" / Subdomains? That would be fine.

Thank you

[Alex89W]

Hello again,

I have configured apache2 and set the new certificate for "wanker.co.at" for all virtualhosts.
The certificate looks good now.

Only this command didn't worked:
sudo certbot run --cert-name wanker.co.at -i apache

[griffin]

Hey Alex

Just finished checking all three of your sites. Redirects look good, but they're still serving the old certificates. This is to be expected because of the command you used. I'll explain.

sudo certbot certonly --cert-name wanker.co.at -a webroot -w /var/www/testsite/ -d testsite.wanker.co.at -w /var/www/tauernadler/ -d tauernadler.wanker.co.at -w /var/www/www/ -d www.wanker.co.at --dry-run

certonly acquires a certificate, but does not install it

--cert-name specifies a friendly name to be used for managing your certificate (e.g. wanker.co.at), which becomes the directory name used for the certificate's information

-a specifies which method to use to acquire/authenticate the certificate (e.g. webroot)

-w specifies which webroot directory (e.g. /var/www/testsite/) is to be used for all upcoming -d parameters (hence why there are multiple -w parameters if your domains don't all use the same webroot)

-d specifies which domain(s) to certify (e.g. testsite.wanker.co.at)

As for the next command, it was an attempt to actually install the certificate.

sudo certbot run --cert-name wanker.co.at -i apache

-i specifies which method to use to install the certificate (e.g. apache)

@Alex89W

What does this command do?

That's my fault. I assumed something about the run command. I'm in the midst of drafting the upcoming certbot handbook and clearly have a great many things to discuss with the developers... The command should have been:

sudo certbot install --cert-name wanker.co.at -i apache

The challenge with installation (and why in the handbook I am making it a point to split acquisition and installation) is that it can screw up your webserver configuration. If it does, you can reverse the damage with:

sudo certbot rollback

[griffin]

Excellent!

Glad you got the certificate installed successfully.

I just rechecked all three sites and can confirm that they're all serving the new certificates from my end.

You should only need to use the following next time (to only renew that one certificate):
sudo certbot renew --cert-name wanker.co.at

By the by, you can view your certificates with the following and note their names:
sudo certbot certificates

Then you can delete what you don't need:
sudo certbot delete name

[Alex89W]

Hey griffin,

thank you very much for your support and explication.
I have deleted all old certificates.

Done,
Thanks and
have a nice weekend.
Alex