Hey everyone, hope this message finds you well! 
After having run my home server for a few months successfully using Let's Encrypt in combination with Certbot, I'd first of all want to thank you for all your efforts; it truly made switching to SSL certificates incredibly easy!!
Now, today, my certificates would have been due for removal, and it seems like the renewal process via certbot failed. I'll use your template to further describe this issue.
If you need anything else (e.g. the (full) logfile[s]), please let me know
But as a layman looking in from the outside, I'd assume that the most interesting pointer would indeed be the Content-Type given for "POST /acme/new-order HTTP/2.0", as indicated from this section within the log:
2025-09-25 11:32:26,574:DEBUG:acme.client:Received response:
HTTP 400
server: nginx
date: Thu, 25 Sep 2025 09:32:26 GMT
content-type: application/problem+json
content-length: 194
cache-control: public, max-age=0, no-cache
link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
replay-nonce: qRkKkMTFyzmKT0qGoob8ZlXER7hAX2gE_4t42jOScfyU3m4oruQ
{
"type": "urn:ietf:params:acme:error:malformed",
"detail": "Unable to validate JWS :: Invalid Content-Type header on POST. Content-Type must be \"application/jose+json\"",
"status": 400
}
Well, this, and the weird Apache version mismatch (see below: "It produced this output")
My domain is:
bmn.ddns.net
I ran this command:
sudo /home/[me]/bin/miniforge3/envs/core/bin/certbot renew
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/bmn.ddns.net.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unable to read ssl_module file; not disabling session tickets.
Certbot has detected that apache version < 2.4.11 or compiled against openssl < 1.0.2l. Since these are deprecated, the configuration file being installed at /etc/letsencrypt/options-ssl-apache.conf will not receive future updates. To get the latest configuration version, update apache.
Renewing an existing certificate for bmn.ddns.net
Failed to renew certificate bmn.ddns.net with error: urn:ietf:params:acme:error:malformed :: The request message was malformed :: Unable to validate JWS :: Invalid Content-Type header on POST. Content-Type must be "application/jose+json"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/bmn.ddns.net/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version):
Apache/2.4.65 (Linux/SUSE)
Build timestamp: 2025-09-23
The operating system my web server runs on is (include version):
openSUSE Leap 15.6 (patched up)
My hosting provider, if applicable, is:
N/A
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no (all via ssh / cockpit)
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
5.0.0 (via conda-forge)
To see what's actually being send over the wire. Breakpoints should also work ofc.
