# Ceritficate is not working, how do i creat a new one?
**URL:** https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292
**Category:** Help
**Created:** [April 27, 2024, 10:28am UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292 "2024-04-27T10:28:50Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@CasR](https://community.letsencrypt.org/u/CasR)
#### Post date: [April 27, 2024, 10:28am UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/1 "2024-04-27T10:28:50Z")
It looks like my ceritficate is corrupted. How can I fix this ?
My domain is:renooij.net
I ran this command: certbot renew
It produced this output:
Processing /etc/letsencrypt/renewal/renooij.net.conf
* * *
Encountered error while loading certificate or csr: [('PEM routines', '', 'no start line')]
Renewal configuration file /etc/letsencrypt/renewal/renooij.net.conf (cert: [renooij.net](http://renooij.net)) produced an unexpected error: [('PEM routines', '', 'no start line')]. Skipping.
My web server is (include version):
Apache version 2.4.56
The operating system my web server runs on is (include version):
Debian Linux 11
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):
certbot 2.10.0
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [April 27, 2024, 1:14pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/2 "2024-04-27T13:14:10Z")
> [@CasR](#):
>
> It looks like my ceritficate is corrupted. How can I fix this ?
I agree your certs look missing or damaged. Can you show output of these commands:
```nohighlight
ls -l /etc/letsencrypt/live/renooij.net
sudo certbot certificates
```
and the contents of each file in this folder. Based on your history I am expecting to see two conf files. Please mark the names of each when you post them here
```nohighlight
/etc/letsencrypt/renewal
```
---
### Author:  [@CasR](https://community.letsencrypt.org/u/CasR)
#### Post date: [April 27, 2024, 2:02pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/3 "2024-04-27T14:02:36Z")
> [@MikeMcQ](#):
>
> ```nohighlight
> ls -l /etc/letsencrypt/live/renooij.net
> sudo certbot certificates
>
> ```
Thank you for your help.
```nohighlight
cas@webserver2021:~$ sudo ls -l /etc/letsencrypt/live/renooij.net
total 4
lrwxrwxrwx 1 root root 35 Apr 25 01:36 cert.pem -> ../../archive/renooij.net/cert2.pem
lrwxrwxrwx 1 root root 36 Apr 25 01:36 chain.pem -> ../../archive/renooij.net/chain2.pem
lrwxrwxrwx 1 root root 40 Apr 25 01:36 fullchain.pem -> ../../archive/renooij.net/fullchain2.pem
lrwxrwxrwx 1 root root 38 Apr 25 01:36 privkey.pem -> ../../archive/renooij.net/privkey2.pem
-rw-r--r-- 1 root root 692 Jun 19 2023 README
cas@webserver2021:~$ sudo certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
verifying the signature of the certificate located at /etc/letsencrypt/live/renooij.net/cert.pem has failed. Details: Unable to load PEM file. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details. MalformedFraming
Traceback (most recent call last):
File "/snap/certbot/3700/lib/python3.8/site-packages/certbot/crypto_util.py", line 303, in verify_renewable_cert_sig
chain = x509.load_pem_x509_certificate(chain_file.read(), default_backend())
ValueError: Unable to load PEM file. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details. MalformedFraming
Renewal configuration file /etc/letsencrypt/renewal/renooij.net.conf produced an unexpected error: verifying the signature of the certificate located at /etc/letsencrypt/live/renooij.net/cert.pem has failed. Details: Unable to load PEM file. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details. MalformedFraming. Skipping.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: presensus.nl
Serial Number: 380d5e2922eeb55048943f216614e7b39e7
Key Type: ECDSA
Domains: presensus.nl reanski.nl renooij.net www.presensus.nl www.reanski.nl
Expiry Date: 2024-07-26 08:43:00+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/presensus.nl/fullchain.pem
Private Key Path: /etc/letsencrypt/live/presensus.nl/privkey.pem
Certificate Name: reanski.nl
Serial Number: 4ac411ae266f049193e62837b07a1e1bdec
Key Type: ECDSA
Domains: presensus.nl reanski.nl thuis.renooij.com www.presensus.nl www.reanski.nl
Expiry Date: 2024-07-18 06:26:58+00:00 (VALID: 81 days)
Certificate Path: /etc/letsencrypt/live/reanski.nl/fullchain.pem
Private Key Path: /etc/letsencrypt/live/reanski.nl/privkey.pem
The following renewal configurations were invalid:
/etc/letsencrypt/renewal/renooij.net.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
cas@webserver2021:~$
cas@webserver2021:/etc/letsencrypt/renewal$ ls -al
total 28
drwxr-xr-x 3 root root 4096 Apr 27 11:52 .
drwxr-xr-x 9 root root 4096 Apr 27 15:58 ..
drwxr-xr-x 2 root root 4096 Jun 19 2023 archief
-rw-r--r-- 1 root root 536 Apr 27 11:43 presensus.nl.conf
-rw-r--r-- 1 root root 526 Apr 19 09:27 reanski.nl.conf
-rw-r--r-- 1 root root 531 Apr 27 11:47 renooij.net.conf
-rw-r--r-- 1 root root 539 Apr 25 01:36 renooij.net.conf.old
cas@webserver2021:/etc/letsencrypt/renewal$ cat renooij.net.conf
# renew_before_expiry = 30 days
version = 2.10.0
archive_dir = /etc/letsencrypt/archive/renooij.net
cert = /etc/letsencrypt/live/renooij.net/cert.pem
privkey = /etc/letsencrypt/live/renooij.net/privkey.pem
chain = /etc/letsencrypt/live/renooij.net/chain.pem
fullchain = /etc/letsencrypt/live/renooij.net/fullchain.pem
# Options used in the renewal process
[renewalparams]
account = 21edafac05c8e45635dc91655d23125f
authenticator = apache
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
installer = apache
```
```nohighlight
cas@webserver2021:/etc/letsencrypt/renewal$ cat reanski.nl.conf
# renew_before_expiry = 30 days
version = 2.10.0
archive_dir = /etc/letsencrypt/archive/reanski.nl
cert = /etc/letsencrypt/live/reanski.nl/cert.pem
privkey = /etc/letsencrypt/live/reanski.nl/privkey.pem
chain = /etc/letsencrypt/live/reanski.nl/chain.pem
fullchain = /etc/letsencrypt/live/reanski.nl/fullchain.pem
# Options used in the renewal process
[renewalparams]
account = 21edafac05c8e45635dc91655d23125f
authenticator = apache
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
installer = apache
cas@webserver2021:/etc/letsencrypt/renewal$
```
reanski.nl is working fine, [renooij.net](http://renooij.net) is not
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [April 27, 2024, 2:08pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/4 "2024-04-27T14:08:40Z")
Can you show this now.
> [@CasR](#):
>
> sudo ls -l /etc/letsencrypt/archive/renooij.net
---
### Author:  [@CasR](https://community.letsencrypt.org/u/CasR)
#### Post date: [April 27, 2024, 2:33pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/5 "2024-04-27T14:33:31Z")
```nohighlight
[sudo] password for cas:
total 36
-rw-r--r-- 1 root root 1480 Jun 19 2023 cert1.pem
-rw-r--r-- 1 root root 1480 Apr 25 01:36 cert2.pem
-rw-r--r-- 1 root root 3749 Jun 19 2023 chain1.pem
-rw-r--r-- 1 root root 1826 Apr 25 01:36 chain2.pem
-rw-r--r-- 1 root root 5229 Jun 19 2023 fullchain1.pem
-rw-r--r-- 1 root root 3306 Apr 25 01:36 fullchain2.pem
-rw------- 1 root root 241 Jun 19 2023 privkey1.pem
-rw------- 1 root root 241 Apr 25 01:36 privkey2.pem
cas@webserver2021:/etc/letsencrypt/renewal$
```
Just noticed that cert2.pem contains ascii not belonging to a key which probably accounts for the corrupted key.
Should I just delete _2._ ?
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [April 27, 2024, 2:47pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/6 "2024-04-27T14:47:52Z")
> [@CasR](#):
>
> Just noticed that cert2.pem contains ascii not belonging to a key which probably accounts for the corrupted key.
Maybe but don't just delete that file. What do you mean it has unknown ascii? The file length matches your older cert and the timestamp matches the symlink and your other files. Do you know how it got damaged then? I don't want to recreate it just to have it happen again.
But, yes, probably easier to delete and re-create. Your Apache is not using that cert (yet) and if it is damaged no one else could be either. So, deleting should be done like
```nohighlight
sudo certbot delete --cert-name renooij.net
```
Then re-create it with
```nohighlight
sudo certbot --apache -d renooij.net
```
It is possible the `certbot delete` will fail if it pre-checks the cert validity. In which case you need to delete manually:
1. the conf file for it in the /renewal folder (leave the other conf files there)
2. the /archive/renooij.net folder
3. the /live/renooij.net folder
---
### Author:  [@CasR](https://community.letsencrypt.org/u/CasR)
#### Post date: [April 27, 2024, 2:55pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/7 "2024-04-27T14:55:14Z")
file length may have had to do with an inode issue I had earlier, I think that corrupted the cert.
delete and recreate did it.. now to fix the permissions, but that is another issue 🙂
thanks very much, I really appreciate it!
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [April 27, 2024, 9:54pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/8 "2024-04-27T21:54:05Z")
> [@CasR](#):
>
> ```nohighlight
> -rw-r--r-- 1 root root 531 Apr 27 11:47 renooij.net.conf
> -rw-r--r-- 1 root root 539 Apr 25 01:36 renooij.net.conf.old
>
> ```
I don't think you should keep copies/backups in this same directory.
---
### Author:  [@CasR](https://community.letsencrypt.org/u/CasR)
#### Post date: [April 29, 2024, 1:39pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/9 "2024-04-29T13:39:34Z")
Neither do I, that .old file was the corrupted one containing ascii coming from some other conf file. I kept it for investigative purposes, it was not intended as a backup.
But thanks for the reminder to remove it .
cheers,
Cas..
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [April 29, 2024, 4:20pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/10 "2024-04-29T16:20:32Z")
Cheers from Miami 🍻
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [May 29, 2024, 4:21pm UTC](https://community.letsencrypt.org/t/ceritficate-is-not-working-how-do-i-creat-a-new-one/217292/11 "2024-05-29T16:21:14Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.