Cert Renew OK, HTTPS NOT!

My domain is: services.niva.it

I ran this command: certbot-auto renew

It produced this output: (please help me find it)

My web server is (include version): Apache 2.4.6

The operating system my web server runs on is (include version): Oracle Linux 7.4

My hosting provider, if applicable, is: Oracle

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): Cerbot 0.30.2


Hi all, and nice to meet you.
This is my first post here and I hope to find the solution.
I issued the command certbot-auto renew in order to renew my certificate on our server and all the process goes right.
Anyway I did this operation 5 days ago, and I still don’t have Secure access on my server via HTTPS.
On the server certificates says the following:

Certificate Name: services.niva.it
Domains: services.niva.it
Expiry Date: 2019-07-14 12:46:18+00:00 (VALID: 86 days)
Certificate Path: /etc/letsencrypt/live/services.niva.it/fullchain.pem
Private Key Path: /etc/letsencrypt/live/services.niva.it/privkey.pem

How can I solve this issue?
Thanks!

Hi @Carnialman

you have a new certificate. But you don't use it. Instead, your old certificate is used ( https://check-your-website.server-daten.de/?q=services.niva.it ):

CN=services.niva.it
	15.01.2019
	15.04.2019
4 days expired	services.niva.it - 1 entry

What's the content of

/etc/letsencrypt/renewal

If you run

certbot -d services.niva.it

Certbot should find the new certificate and ask, if you want to install it.

PS: Your chain is wrong:

Chain - duplicate certificates	
	1	CN=services.niva.it
	2	CN=services.niva.it
	3	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US

Looks like you use cert.pem and fullchain.pem, use only fullchain.

1 Like

I have a file named services.niva.it.conf

The output that I have is the following:

Last login: Fri Apr 19 08:07:54 UTC 2019 on pts/0
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Attempting to parse the version 0.33.1 renewal configuration file found at /etc/letsencrypt/renewal/services.niva.it.conf with version 0.30.2 of Certbot. This might not work.
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn’t close to expiry.
(ref: /etc/letsencrypt/renewal/services.niva.it.conf)

What would you like to do?


1: Attempt to reinstall this existing certificate
2: Renew & replace the cert (limit ~5 per 7 days)


Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel):

I choose 2 and the output is the following:

Renewing an existing certificate
Performing the following challenges:
http-01 challenge for services.niva.it
Cleaning up challenges
Unable to find a virtual host listening on port 80 which is currently needed for Certbot to prove to the
CA that you control your domain. Please add a virtual host for port 80.

I think that there is something wrong.
I have to apologize because I’m pretty new on certificate!

That's your problem. Add a port 80 vHost with services.niva.it as ServerName.

1 Like

Ok, now I’ve added to httpd.conf the following lines:

<VirtualHost *:80>
# This first-listed virtual host is also the default for *:80
ServerName services.niva.it
ServerAlias niva.it
DocumentRoot “/var/www/html”

I restarted Apache an re-done certbot -d services.niva.it, following the output:

Last login: Fri Apr 19 09:00:07 UTC 2019 on pts/0
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Attempting to parse the version 0.33.1 renewal configuration file found at /etc/letsencrypt/renewal/services.niva.it.conf with version 0.30.2 of Certbot. This might not work.
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn’t close to expiry.
(ref: /etc/letsencrypt/renewal/services.niva.it.conf)

What would you like to do?


1: Attempt to reinstall this existing certificate
2: Renew & replace the cert (limit ~5 per 7 days)


Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 2
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for services.niva.it
Waiting for verification…
Cleaning up challenges
Resetting dropped connection: acme-v02.api.letsencrypt.org
Created an SSL vhost at /etc/httpd/conf/httpd-le-ssl.conf
Deploying Certificate to VirtualHost /etc/httpd/conf/httpd-le-ssl.conf
Enabling site /etc/httpd/conf/httpd-le-ssl.conf by adding Include to root configuration

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.


1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you’re confident your site works on HTTPS. You can undo this
change by editing your web server’s configuration.


Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 2
Redirecting vhost in /etc/httpd/conf/httpd.conf to ssl vhost in /etc/httpd/conf/httpd-le-ssl.conf


Your existing certificate has been successfully renewed, and the new certificate
has been installed.

The new certificate covers the following domains: https://services.niva.it

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=services.niva.it


IMPORTANT NOTES:

  • Congratulations! Your certificate and chain have been saved at:
    /etc/letsencrypt/live/services.niva.it/fullchain.pem
    Your key file has been saved at:
    /etc/letsencrypt/live/services.niva.it/privkey.pem
    Your cert will expire on 2019-07-18. To obtain a new or tweaked
    version of this certificate in the future, simply run certbot again
    with the “certonly” option. To non-interactively renew all of
    your certificates, run “certbot renew”

  • If you like Certbot, please consider supporting our work by:

    Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
    Donating to EFF: https://eff.org/donate-le

I think that now I’ll have secure https on my server (or anyway in few hours).

So what is the best way to renew a certificate?

  • certbot-auto renew
    or
  • certbot -d services.niva.it

I would like to use a crontab that run every 15 days.

1 Like

Yep, now you have a new certificate:

CN=services.niva.it
	19.04.2019
	18.07.2019
expires in 90 days	services.niva.it - 1 entry

But your chain is wrong.

Chain - duplicate certificates	
	1	CN=services.niva.it
	
	2	CN=services.niva.it
	
	3	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US

If you have a working configuration, you can always use renew.

Check, if there is already a crontab.

Normally - 2 times per day, but not fixed (00:00 or other full hours are terrible).

@JuergenAuer I really have to thank you for your support first of all.
Then, I need to understand how I could solve the wrong chain. I need to delete all certificates and create a new one?

the best way is certbot-auto renew, once your host is properly configured, you shouldn't have anymore problems renewing it.

you can try once:
# /path_to_certbot_auto/certbot-auto renew --dry-run

That should attempt to renew all certificates on your host, without actually performing the installation
Once that's working to your satisfaction, put it in a daily cron (without the --dry-run option, obviously:).

I wouldn't recommend running the cron only every 15 days, since you might miss a renewal date, and the overhead for running it is low, especially if there's no renewal. It then just checks the date vs the renewal due date (by default 30 days before expiry date) and dies with a message stating there's no renewal.

I would also put in the crontab an apachectl restart (or your system equivalent) 1 or 2 minutes after your renewal run. (normally there is no need, certbot-auto takes care of it, but I've had numerous failure on that front on several servers, leading to server downtime, because I ran the cron around 3am; think of it as wearing a belt AND suspenders :slight_smile: )

1 Like

Don't delete your certificate. It's an installation problem, not a certificate problem.

Share the content of your port 443 vHost. There are two or three rows like

 SSLCertificateFile /etc/ssl/certs/apache.crt
 SSLCertificateKeyFile /etc/ssl/private/apache.key

There is something wrong.

Yep, 15 days are too long. Letsencrypt may have an interruption, you have changed something. Daily is ok. If there is no renew required -> nothing happens.

Ok for Crontab every day, I’ll do that as soon as we solve all my problems :smiley:

Now, my https-le-ssl.conf says as follow:

# This first-listed virtual host is also the default for *:80:
ServerName services.niva.it
ServerAlias niva.it 
DocumentRoot "/var/www/html"

SSLCertificateFile /etc/letsencrypt/live/services.niva.it/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/services.niva.it/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateChainFile /etc/letsencrypt/live/services.niva.it/chain.pem

And nothing else.

That looks critical.

Check the file chain.pem (it's a text file). It may contain the content of cert.pem. So remove the row with cert.pem (add a #).

Both the files contain a certificate, but is not the same.
Should I comment (#) anyway the “SSLCertificateFile /etc/letsencrypt/live/services.niva.it/cert.pem” in my https-le-ssl.conf?

Share the content of both files.

These are only the public keys and the signature. So it's safe. Never share the privkey.pem.

Here you are

CERT.PEM

-----BEGIN CERTIFICATE-----
MIIFWDCCBECgAwIBAgISA+Bh2RMo/iQ/Boc9tyxXWLDkMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xOTA0MTkwODAwNDFaFw0x
OTA3MTgwODAwNDFaMBsxGTAXBgNVBAMTEHNlcnZpY2VzLm5pdmEuaXQwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD0WKtSReg8MDfZQoPI0dGPdccObk+i
VFLJiTAkcCzj2qN7aA5Ff31OmQWLpBmPNCVMIL9Y0kAygXgIqIK72RdrOMpmyD2C
nRyUnYhwOYD0BvXHEykVFwBYg9XimJ2p+GX7xpAqafvEQ5ocysKoxXCsJFKuujPJ
+CF7CK+4iWbV7L+cOX/o31cIf2IdWnYye4QypVzyYLmywJpE3hnZ3iNAhMorQPjJ
gqRco/Kc2ad6C2oZLg5IT8e26ILo9F6eI50eBik0Kk8ay0y9xU5KkxcwQuF1rLDG
E1srfi10NoTondjMSrlemujppUoLoG0vuRchwkqyQgyxiQMqnJ60E5tRAgMBAAGj
ggJlMIICYTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFCbm6kob8IaEsCPwrGW6R1RI
MGUqMB8GA1UdIwQYMBaAFKhKamMEfd265tE5t6ZFZe/zqOyhMG8GCCsGAQUFBwEB
BGMwYTAuBggrBgEFBQcwAYYiaHR0cDovL29jc3AuaW50LXgzLmxldHNlbmNyeXB0
Lm9yZzAvBggrBgEFBQcwAoYjaHR0cDovL2NlcnQuaW50LXgzLmxldHNlbmNyeXB0
Lm9yZy8wGwYDVR0RBBQwEoIQc2VydmljZXMubml2YS5pdDBMBgNVHSAERTBDMAgG
BmeBDAECATA3BgsrBgEEAYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3Bz
LmxldHNlbmNyeXB0Lm9yZzCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB2AOJpS64m
6OlACeiGG7Y7g9Q+5/50iPukjyiTAZ3d8dv+AAABajTTkdcAAAQDAEcwRQIhAO8u
gUmTVgUu7jeZW9TeDyduySBzk1nd9hpCtggbW1kdAiA6EXbUq0Cfb5sn9rrYVTLS
BiU+RhdBpZ+8dpOwNGF0FQB2ACk8UZZUyDlluqpQ/FgH1Ldvv1h6KXLcpMMM9OVF
R/R4AAABajTTkfcAAAQDAEcwRQIgD+RrR2Paq6qUSnCTB6LrrdZyKxNh5Lskj9If
kZZb/nwCIQCvRUeDlj/fGS4OW0FGHkrEJD3SGEOaHOztsWB9MrNrDjANBgkqhkiG
9w0BAQsFAAOCAQEADkPoqAVOwOZ4UzsO7849STRrdu50AbSivV97tc5XnPjhgx0h
UDzonIlwvagALdjDtZ7O5waFgP4d/QUj9adIPGJf5IZQDANa3vQQNfJfyuGFPo/n
7uC9mCR9AoY0VDTd5ePvAFAFL1+hVNnTUcQ3FaIcOeGT5VhtxCrjvTSVarTuTsVQ
7npCHWQOenOkanhirAvVaHwWeSUZrRHOX0Xz53MTIwtMtZn6HnpBBj1aTWlT8+ZT
mWgA9S01hWYSgFRlVkpySU6MA6uhhnFKinsBWvN1frOpcQa31dYi+jA6wvm1xnh5
XhGmn20lGhHVkNz6c+1LqH593A47hiVIzk89sQ==
-----END CERTIFICATE-----

CHAIN.PEM

-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
-----END CERTIFICATE-----

The first is your certificate, the second is the Letsencrypt intermediate (Windows: Save the content as file with .crt - open it, then you see the certificate).

So this isn’t the problem.

Looks that this vHost isn’t used.

What says

apachectl -S

Thanks, below the output:

VirtualHost configuration:
*:80 services.niva.it (/etc/httpd/conf/httpd.conf:368)
*:443 is a NameVirtualHost
default server services.niva.it (/etc/httpd/conf.d/ssl.conf:56)
port 443 namevhost services.niva.it (/etc/httpd/conf.d/ssl.conf:56)
port 443 namevhost services.niva.it (/etc/httpd/conf/httpd-le-ssl.conf:2)
alias niva.it
ServerRoot: “/etc/httpd”
Main DocumentRoot: “/var/www/html”
Main ErrorLog: “/etc/httpd/logs/error_log”
Mutex default: dir="/run/httpd/" mechanism=default
Mutex mpm-accept: using_defaults
Mutex authdigest-opaque: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex rewrite-map: using_defaults
Mutex authdigest-client: using_defaults
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex authn-socache: using_defaults
Mutex ssl-cache: using_defaults
PidFile: “/run/httpd/httpd.pid”
Define: _RH_HAS_HTTPPROTOCOLOPTIONS
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name=“apache” id=48
Group: name=“apache” id=48

You have two vHosts with the same name. Remove one and recheck your config.

Copy cert.pem and chain.pem in one file, use that.

We have this server on production environment, so I have to be sure :smiley:
Some replies ago I sent you the output of /etc/httpd/conf/httpd-le-ssl.conf.
Could I comment the line “ServerName services.niva.it” to solve it?

Anyway I don’t understand very well what I have to do with cert.pem and chain.pem: I have to copy both in a single file, and this file must have a specific name? Should I link it in some configuration?

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.