Can't restart nginx after deleted /etc/letsencrypt/live/my_domain.com

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: datidigital.com

I ran this command: rm -rf /etc/letsencrypt/live/datidigital.com

It produced this output:

sudo nginx -t
nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/datidigital.com/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/datidigital.com/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx: configuration file /etc/nginx/nginx.conf test failed

My web server is (include version): nginx version: nginx/1.18.0 (Ubuntu)

The operating system my web server runs on is (include version): Ubuntu 22.04.2 LTS

My hosting provider, if applicable, is: Contabo

I can login to a root shell on my machine (yes or no, or I don't know): Yes, I can.

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.11.0

You deleted a cert file that is being used by nginx.

If you explain what you are trying to do we can help you. Or, review the section below about Safely Deleting Certs
https://eff-certbot.readthedocs.io/en/latest/using.html#safely-deleting-certificates

5 Likes

I just tried to renew the certificate for my domain, but experienced several errors that I forgot to log. Because I still couldn't renew the certificate, I tried deleting /etc/letsencrypt/live/datidigital.com, until now I experienced the error above.

Your first step now is to fix your broken nginx config

Follow the steps in the Safely Deleting Certs link I provided. Once the nginx -t works let us know and we can guide the remaining steps

4 Likes

I ran this command:
sudo bash -c 'grep -R live/datidigital.com /etc/{nginx,httpd,apache2}'

Then get results like this:

/etc/nginx/sites-enabled/datidigital.com:#    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem;
/etc/nginx/sites-enabled/datidigital.com:#    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem;
/etc/nginx/sites-available/datidigital.com:#    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem;
/etc/nginx/sites-available/datidigital.com:#    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem;

Then I run this command:
sudo openssl req -nodes -batch -x509 -newkey rsa:2048 -keyout /etc/letsencrypt/self-signed-privkey.pem -out /etc/letsencrypt/self-signed-cert.pem -days 356

Then I edited my nginx config:
sudo vim /etc/nginx/sites-available/datidigital.com

So now my nginx config is like this:

upstream odoo17a {
    server 127.0.0.1:8017;
}

upstream odoo17a-im {
    server 127.0.0.1:8172;
}

server {
    listen 80;
    server_name datidigital.com;
    rewrite ^(.*) https://$host$1 permanent;
}

server {
    server_name datidigital.com;
    proxy_read_timeout 720s;
    proxy_connect_timeout 720s;
    proxy_send_timeout 720s;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;


    listen 443 ssl;
#    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem;
#    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem;
    ssl_certificate /etc/letsencrypt/self-signed-cert.pem
    ssl_certificate_key /etc/letsencrypt/self-signed-privkey.pem

    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    access_log /var/log/nginx/odoo17_datidigital_access.log;
    error_log /var/log/nginx/odoo17_datidigital.error.log;

    client_max_body_size 30000M;
    client_body_buffer_size 200000k;

    keepalive_timeout 60s;

    location /longpolling {
        proxy_pass http://odoo17a-im;
    }

    location / {
        proxy_redirect off;
        proxy_pass http://odoo17a;
    }


    location ~* /web/static/ {
        proxy_cache_valid 200 60m;
        proxy_buffering on;
        expires 864000;
        proxy_pass http://odoo17a;
    }

    gzip_types text/css text/scss text/plain text/xml application/xml application/json application/javascript;
    gzip on;
}

when I run the command, use the steps from the link you provided:
sudo certbot delete --cert-name datidigital.com

I got an error like this:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificate(s) are selected for deletion:

  * datidigital.com

WARNING: Before continuing, ensure that the listed certificates are not being
used by any installed server software (e.g. Apache, nginx, mail servers).
Deleting a certificate that is still being used will cause the server software
to stop working. See https://certbot.org/deleting-certs for information on
deleting certificates safely.

Are you sure you want to delete the above certificate(s)?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
No certificate found with name datidigital.com (expected /etc/letsencrypt/renewal/datidigital.com.conf).
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

What's the next solution?

Show us the output of sudo nginx -t

3 Likes

Here is the result from sudo nginx -t before I following the link you provided:

nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/datidigital.com/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/datidigital.com/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx: configuration file /etc/nginx/nginx.conf test failed

And here is the result from sudo nginx -t after I following the link you provided.

nginx: [emerg] invalid number of arguments in "ssl_certificate" directive in /etc/nginx/sites-enabled/datidigital.com:32
nginx: configuration file /etc/nginx/nginx.conf test failed

You forgot the ; at the end of the directives.

3 Likes

Hi @Osiris , thanks for the reminder, now here is my config snippet:

server {
    server_name datidigital.com;
    proxy_read_timeout 720s;
    proxy_connect_timeout 720s;
    proxy_send_timeout 720s;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;


    listen 443 ssl;
#    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem;
#    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem;
    ssl_certificate /etc/letsencrypt/self-signed-cert.pem;
    ssl_certificate_key /etc/letsencrypt/self-signed-privkey.pem;

    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    ...
    ...

After I added ; I ran sudo nginx -t and this is the result:

nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/datidigital.com/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/datidigital.com/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx: configuration file /etc/nginx/nginx.conf test failed

What's the next step?

1 Like

Search where there are other ssl_certificate pointing to /etc/letsencrypt/live/datidigital.com/fullchain.pem are being used. Apparently this wasn't the only one.

2 Likes

I just generated when I following this:
https://eff-certbot.readthedocs.io/en/latest/using.html#safely-deleting-certificates
As suggested by @MikeMcQ.

Well, only thing I can say from that nginx error is that nginx thinks there's still a ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem somewhere :man_shrugging:

1 Like

I have tried commenting all the lines like this:

    listen 443 ssl;
#    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem;
#    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem;
#    ssl_certificate /etc/letsencrypt/self-signed-cert.pem;
#    ssl_certificate_key /etc/letsencrypt/self-signed-privkey.pem;

#    include /etc/letsencrypt/options-ssl-nginx.conf;
#    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

Even I have tried deleting the nginx config in /etc/nginx/sites-enabled/ and /etc/nginx/sites-available/

rm -rf /etc/nginx/sites-enabled/datidigital.com
rm -rf /etc/nginx/sites-available/datidigital.com

When I run sudo nginx -t I still get the same error as above.

What is the solution should I do now?

It looks like you are doing these steps correctly so it is very odd you still get an error.

Would you please always show the error message with sudo nginx -t. Sometimes there are slight differences that help to identify what is wrong

Also, does this show anything now?

sudo grep -R ssl_certificate /etc/nginx
4 Likes

Here is the result:

user@vmi1316667:~$ sudo grep -R ssl_certificate /etc/nginx
/etc/nginx/sites-enabled/furniture.datidigital.com:    ssl_certificate /etc/letsencrypt/live/furniture.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/furniture.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/furniture.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-enabled/demov16.datidigital.com:#    ssl_certificate /etc/letsencrypt/live/demov16.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/demov16.datidigital.com:#    ssl_certificate_key /etc/letsencrypt/live/demov16.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-enabled/demov16.datidigital.com:    #ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem;
/etc/nginx/sites-enabled/demov16.datidigital.com:    #ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem;
/etc/nginx/sites-enabled/durrath.datidigital.com:    ssl_certificate /etc/letsencrypt/live/durrath.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/durrath.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/durrath.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-enabled/datidigital.com:#    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem;
/etc/nginx/sites-enabled/datidigital.com:#    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem;
/etc/nginx/sites-enabled/datidigital.com:    ssl_certificate /etc/letsencrypt/self-signed-cert.pem;
/etc/nginx/sites-enabled/datidigital.com:    ssl_certificate_key /etc/letsencrypt/self-signed-privkey.pem;
/etc/nginx/sites-enabled/trial-abudkebab.datidigital.com:    ssl_certificate /etc/letsencrypt/live/trial-abudkebab.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/trial-abudkebab.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/trial-abudkebab.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-enabled/trial-abudkebab.datidigital.com:    #ssl_certificate /etc/letsencrypt/live/demov16-abud-kebab.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/trial-abudkebab.datidigital.com:    #ssl_certificate_key /etc/letsencrypt/live/demov16-abud-kebab.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-enabled/triple-rose.datidigital.com:    ssl_certificate /etc/letsencrypt/live/triple-rose.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/triple-rose.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/triple-rose.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-enabled/ihya-ath-tholibin.site:    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/ihya-ath-tholibin.site:    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-enabled/v14.datidigital.com:    ssl_certificate /etc/letsencrypt/live/v14.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/v14.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/v14.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-enabled/test-durrath.datidigital.com:    ssl_certificate /etc/letsencrypt/live/test-durrath.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/test-durrath.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/test-durrath.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/furniture.datidigital.com:    ssl_certificate /etc/letsencrypt/live/furniture.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/furniture.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/furniture.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/demov16.datidigital.com:#    ssl_certificate /etc/letsencrypt/live/demov16.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/demov16.datidigital.com:#    ssl_certificate_key /etc/letsencrypt/live/demov16.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/demov16.datidigital.com:    #ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem;
/etc/nginx/sites-available/demov16.datidigital.com:    #ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem;
/etc/nginx/sites-available/durrath.datidigital.com:    ssl_certificate /etc/letsencrypt/live/durrath.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/durrath.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/durrath.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/datidigital.com:#    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem;
/etc/nginx/sites-available/datidigital.com:#    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem;
/etc/nginx/sites-available/datidigital.com:    ssl_certificate /etc/letsencrypt/self-signed-cert.pem;
/etc/nginx/sites-available/datidigital.com:    ssl_certificate_key /etc/letsencrypt/self-signed-privkey.pem;
/etc/nginx/sites-available/najd-al-dilam.datidigital.com:    ssl_certificate /etc/letsencrypt/live/najd-al-dilam.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/najd-al-dilam.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/najd-al-dilam.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/trial-abudkebab.datidigital.com:    ssl_certificate /etc/letsencrypt/live/trial-abudkebab.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/trial-abudkebab.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/trial-abudkebab.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/trial-abudkebab.datidigital.com:    #ssl_certificate /etc/letsencrypt/live/demov16-abud-kebab.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/trial-abudkebab.datidigital.com:    #ssl_certificate_key /etc/letsencrypt/live/demov16-abud-kebab.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/demov16-abud-kebab.datidigital.com:    ssl_certificate /etc/letsencrypt/live/demov16-abud-kebab.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/demov16-abud-kebab.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/demov16-abud-kebab.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/triple-rose.datidigital.com:    ssl_certificate /etc/letsencrypt/live/triple-rose.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/triple-rose.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/triple-rose.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/ayyubicoffee.datidigital.com:    ssl_certificate /etc/letsencrypt/live/ayyubicoffee.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/ayyubicoffee.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/ayyubicoffee.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/dania-al-baraka.datidigital.com:    ssl_certificate /etc/letsencrypt/live/dania-al-baraka.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/dania-al-baraka.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/dania-al-baraka.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/ihya-ath-tholibin.site:    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/ihya-ath-tholibin.site:    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/v14.datidigital.com:    ssl_certificate /etc/letsencrypt/live/v14.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/v14.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/v14.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/sites-available/test-durrath.datidigital.com:    ssl_certificate /etc/letsencrypt/live/test-durrath.datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-available/test-durrath.datidigital.com:    ssl_certificate_key /etc/letsencrypt/live/test-durrath.datidigital.com/privkey.pem; # managed by Certbot
/etc/nginx/snippets/snakeoil.conf:ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
/etc/nginx/snippets/snakeoil.conf:ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

Sorry if the results are too long because they also contain other domain configurations on my server, but I want to show the original results without snippets so that you can understand them more accurately.

1 Like

Looks like you still have references to that cert file you deleted. Yes?

/etc/nginx/sites-enabled/ihya-ath-tholibin.site:    ssl_certificate /etc/letsencrypt/live/datidigital.com/fullchain.pem; # managed by Certbot
/etc/nginx/sites-enabled/ihya-ath-tholibin.site:    ssl_certificate_key /etc/letsencrypt/live/datidigital.com/privkey.pem; # managed by Certbot
3 Likes

Oh yes, I checked the config for the domain, and I just realized that the domain was using the same certificate as the one I had deleted. After I comment ssl_certificate in the domain config now sudo nginx -t result is successful:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

But when I access my domain, why is it not https?

1 Like

When I regenerate the certificate for the datidigital.com domain, it displays an error like this:

sudo certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: datidigital.com
2: demov16.datidigital.com
3: durrath.datidigital.com
4: furniture.datidigital.com
5: test-durrath.datidigital.com
6: trial-abudkebab.datidigital.com
7: triple-rose.datidigital.com
8: v14.datidigital.com
9: ihya-ath-tholibin.site
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1
Requesting a certificate for datidigital.com
archive directory exists for datidigital.com-0001
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

What's the next step @MikeMcQ?

For the issue above, I followed this suggestion:

rm -rf /etc/letsencrypt/archive/datidigital.com-001

And now the domain is active again with https.
Thank you for your help @MikeMcQ and @Osiris.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.