Certbot --apache -d ... gives error

While revoking an old certificate, I accidentally said Yes to delete previous and current certs. Now, certbot certificates command says "No certificates..".

If I run certbot --apache, it says Action configtest failed.

How do I restore or create new LetsEncryp cert? THANK YOU!!

My domain is: nuvyug.org

I ran this command: sudo certbot certificates

It produced this output: "No certificates found."

My web server is (include version): Apache/2.4.52 (Ubuntu)

The operating system my web server runs on is (include version): Ubuntu 22.04.5 LTS

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): certbot 1.21.0

cert_details.sh
Enter the domain name: nuvyug.org
Retrieving certificate details for nuvyug.org...

Certificate:
Data:
Version: 3 (0x2)
Serial Number:
06:9f:8c:ff:a5:f1:13:bf:02:b1:1b:10:88:d8:4b:5a:02:05
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = Let's Encrypt, CN = R11
Validity
Not Before: Jun 5 16:50:43 2025 GMT
Not After : Sep 3 16:50:42 2025 GMT
Subject: CN = nuvyug.org

Looks like you were able to get a new cert today?

2 Likes

Yes, your Apache config is now referencing a file (for the certificate and its private key) that you deleted. Apache will no longer start

You will need to make a self-signed cert for your port 443 VirtualHosts to get it running again. Or, just remove the port 443 VHosts temporarily. Once you can start Apache to accept HTTP (port 80) requests you should be able to run certbot --apache again to get a new cert. Then re-apply any configuration from your existing port 443 VHost to the one just created by Certbot.

Revoking a cert is rarely needed and only if your system was compromised. If you explain what you were trying to accomplish we can instruct you on a better remedy. Often people think revoking a cert will fix some other problem but just makes things worse.

4 Likes

Yes, I did get a new cert today BEFORE I tried to revoke my previous cert because it had additional domains which I wanted to delete. During revoke, I stupidly said Yes to remove certs.

I have not yet restarted apache, so it seems to be using the already loaded cert. So I need to get past the error I posted about.

Now I understand that revoke was totally unnecessary.

2 Likes

This is now making sense to me. Apache has to accepted HTTP requests on Port 80 for the certbot --apache command to do its magic. Let me look up how to remove 443 and enable port 80. THANK YOU!!

1 Like

Maybe just by using the a2dissite command? That is a commonly used method on Ubuntu

The a2ensite (enable site) is the opposite but if Certbot makes a port 443 VHost you shouldn't just enable the old one. You will have duplicate VHosts for the same domain and port. Apache oddly allows starting up with that but it won't process requests properly.

You would manually update the new VHost with any needed parts from your old one.

4 Likes

I vote for that, I think certbot will create the "vhost-le-ssl.conf" ?

  1. disable the conf
  2. restart apache
  3. re-run certbot with correct CLI arguments to obtain new certs
  4. don't revoke them!

I might be missing a step or two!

6 Likes

@Rip and @MikeMcQ - Thank you both!! It worked! Certbot is working now, I have new certs, and Apache conf files seem to be okay too.

5 Likes

It was @MikeMcQ idea ... he deserves the credit. Glad it worked for you!

5 Likes