Please fill out the fields below so we can help you better.
My domain is: zenit4you.win www.zenit4you.win m.zenit4you.win
I ran this command: ./certbot-auto certonly --nginx -d zenit4you.win -d www.zenit4you.win -d m.zenit4you.win
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Currently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command. The renew verb may provide other options for selecting certificates to renew in the future.
root@1ng:/opt/certbot-auto# ./certbot-auto certonly --nginx -d zenit4you.win -d www.zenit4you.win -d m.zenit4you.win
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for zenit4you.win
tls-sni-01 challenge for www.zenit4you.win
tls-sni-01 challenge for m.zenit4you.win
Waiting for verification…
Cleaning up challenges
IMPORTANT NOTES:
Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/zenit4you.win/fullchain.pem. Your cert will
expire on 2017-05-31. To obtain a new or tweaked version of this
certificate in the future, simply run certbot-auto again. To
non-interactively renew all of your certificates, run
"certbot-auto renew"
If you like Certbot, please consider supporting our work by:
Could you please post the output of the following commands?
ls /etc/letsencrypt/archive
ls -l /etc/letsencrypt/live/zenit4you.win
ls -lt /etc/letsencrypt/archive/zenit4you.win
certbot-auto certificates
I’m thinking that this sounds similar to a problem seen recently where the new certificate is issued correctly, but for some unknown reason the symbolic links in /etc/letsencrypt/live don’t get updated, or get updated incorrectly.
Possibly. I've never managed to replicate it myself, but it's come up a couple of times in the forum.
Did you make any manual changes to the contents of /etc/letsencrypt/ at any point (other than updating the symlinks just now)?
The surprising thing is that the symlinks in live/zenit4you.win are pointing to certificates in archive/zenit4you.win-0002 rather than archive/zenit4you.win (where the renewed one was saved); this is also similar to the previous case of this bug.
@bmw, I think we’ve had at least three reports like this where symlinks somehow point into a different lineage’s (with the same lineage name except -0001 or -0002) archive directory.
Can you think of anything that could cause this? It seems like a severe potential storage.py or renewal.py bug, yet my recollection of how RenewableCert works makes it hard to envision how this can happen.
Oh wow. I played with this for a bit trying to reproduce but was unable to (without manually modifying /etc/letsencrypt).
@shadowhide, I’m very interested in the commands you ran to get Certbot into this state. Would you be willing to provide the contents of /var/log/letsencrypt? This directory should contain a number of log files allowing me to get more information about what happened. Feel free to redact values like domains, email, and IP addresses as you feel appropriate. You’re also welcome to email them to me directly rather than posting them here. My email is bmw@eff.org.
Additionally, if anyone is able to give me a link to another thread where a user hit this issue without manually modifying /etc/letsencrypt, I’d appreciate it!
