Certbot certonly renewed certificate, but openssl shows Certificate has expired

Help
1

Hi all,
Hi all,

5 years ago I made a way to use Letsencrypt on Apache Tomcat and made a blog post tutorial: Configure Tomcat with HTTPS/SSL on Ubuntu 16.04 LTS (Xenial) using Letsencrypt – Blog posts about software engineering from Mladen Adamovic

It seems that now my config has some problems.

This is the example for domain online-utility.org

I run:
certbot certonly -n --force-renewal --webroot --webroot-path /tmp/letsencrypt/public_html -d online-utility.org -d www.online-utility.org -d ww2.online-utility.org -d new.online-utility.org --agree-tos --email mladen.adamovic@gmail.com

The output was:

 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/online-utility.org/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/online-utility.org/privkey.pem
   Your cert will expire on 2022-03-03. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"

Then I restarted my web server that is configured to use (this is Tomcat specific)

       SSLCertificateFile="/etc/letsencrypt/live/online-utility.org/cert.pem"
           SSLCertificateKeyFile="/etc/letsencrypt/live/online-utility.org/privkey.pem"
           SSLCertificateChainFile="/etc/letsencrypt/live/online-utility.org/chain.pem"
           SSLVerifyClient="optional" SSLProtocol="TLSv1+TLSv1.1+TLSv1.2"

The problem is that even after the web server restart, openssl show that the certificate is expired:

root@usve250267:~# openssl s_client -connect 207.38.82.240:443 -servername online-utility.org -showcerts
CONNECTED(00000003)
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
---
Certificate chain
 0 s:/CN=online-utility.org
   i:/C=US/O=Let's Encrypt/CN=R3
-----BEGIN CERTIFICATE-----
MIIFcjCCBFqgAwIBAgISA0Wrp9S4gjlho5agzxlpuOyyMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMTEyMDMxMzA4NTVaFw0yMjAzMDMxMzA4NTRaMB0xGzAZBgNVBAMT
Em9ubGluZS11dGlsaXR5Lm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBALbRWom6EMVGEx3dUd8JJdRffEKfbG0qzld0TDvVxU6ojlQrMT8RzUihaZWG
uDpumtaC6qOGVlfmEdIubovDiQgiIIM3fiop664rE8GL927OHdIcR8y9qfDTPD/j
Y9I7Hi/+p+6fb/JG4gyobm7gPZ8c+XA10/7sU8IUp2VEPtYqNX7juV0zGJwSl7d/
E6mJOY4s6e03sJzN4asy3EPhGZvLAdLW/ixYA9KObT6pcjznQhvg6XRAisN89+PT
JFZP9+3NT4g1SBc3C8oS7tCxCe/yrh8bcTWjQMnw38+BD8fLroXiDdInw/yJOLOt
Vp/IVMXR1/rIbAR9b98Bhu/p5C8CAwEAAaOCApUwggKRMA4GA1UdDwEB/wQEAwIF
oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAd
BgNVHQ4EFgQUcrcdvAGJO75Y4x0yf3/pf2HZwsowHwYDVR0jBBgwFoAUFC6zF7dY
VsuuUAlA5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRw
Oi8vcjMuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNy
Lm9yZy8wZQYDVR0RBF4wXIIWbmV3Lm9ubGluZS11dGlsaXR5Lm9yZ4ISb25saW5l
LXV0aWxpdHkub3JnghZ3dzIub25saW5lLXV0aWxpdHkub3JnghZ3d3cub25saW5l
LXV0aWxpdHkub3JnMEwGA1UdIARFMEMwCAYGZ4EMAQIBMDcGCysGAQQBgt8TAQEB
MCgwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIIBBAYK
KwYBBAHWeQIEAgSB9QSB8gDwAHUAQcjKsd8iRkoQxqE6CUKHXk4xixsD6+tLx2jw
kGKWBvYAAAF9gKBnpQAABAMARjBEAiANNp65InV7CQ3qDVMnaj66ar1pygWxLTT1
ppNnYpJNvAIgcBM39leJeo8KPP+fbur+nw97i5MZiAgy/Wrlozyh0BgAdwBGpVXr
dfqRIDC1oolp9PN9ESxBdL79SbiFq/L8cP5tRwAAAX2AoGfgAAAEAwBIMEYCIQCP
urSJckpk08VQfj/PgFYbveXMSrPCBViS7kQDoJFHXwIhAIjf4XWQCAZaXkunatEj
pMYrbRh+dJmAJLZGL0S6U1apMA0GCSqGSIb3DQEBCwUAA4IBAQAQWv/epzyTyX9j
mZ1Nckswc+I2cX/CbbKUg5igd98RccnyFDCzBglAmkyARM1MqOdRBGpwCaGBWeaH
Kt0Mq7tc4kRYNKeOpn7zXbZWc0cu1r30NrzSqFhoe0YhpJUWjD/Nqv1VWg7dDIKX
gUY/zD4ECKj5sQX9Z5q5nB87uz5galex5g1fXLCJs2qTM15Hlo9maJmp7o1zZ1n1
ICgLiMyVdDxfinV9D/ZyOccHn/I2NDprV1UoRzs4V+qzEaazj3Zcrx3wO8nOXaCX
NgrxxMirHPgYW3/LqS9r0Fe1ZBi8LMBXoxL8LXfdL6zylvrr08jGjg+mlBlSpoJO
ggC3cieu
-----END CERTIFICATE-----
 1 s:/C=US/O=Let's Encrypt/CN=R3
   i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
 2 s:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=online-utility.org
issuer=/C=US/O=Let's Encrypt/CN=R3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4785 bytes and written 458 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 64CE1B78579C2BC3519428A9074C2868487442D657FDF339BA4EFB9B7AB26974
    Session-ID-ctx: 
    Master-Key: 526845E76892F1A21F46DE366C5D38F7087B007A347641EFA113B48237C6859BEB4802966C75972CAADC36A44F3EE398
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 14400 (seconds)
    TLS session ticket:
    0000 - 61 b3 18 d8 62 0a 0d c6-7c 9d d0 b0 d4 3c a7 83   a...b...|....<..
    0010 - f3 bd d7 06 b4 6f 30 20-1e 19 de 66 f3 69 3d d3   .....o0 ...f.i=.
    0020 - d5 f0 d7 2e ab 19 87 2c-50 89 ac 83 4f af be 04   .......,P...O...
    0030 - 6e 93 49 5a 8a db f5 0f-78 9c cf 52 f5 77 75 92   n.IZ....x..R.wu.
    0040 - bb 9a 2d a7 6a eb d8 7d-ab b4 d5 2d f2 c7 78 39   ..-.j..}...-..x9
    0050 - 0e b3 a3 95 de 66 d4 de-f6 33 11 ed ce d7 5b 6b   .....f...3....[k
    0060 - fe 21 47 06 a8 ca 07 78-e7 e0 3c 5e 19 18 88 b7   .!G....x..<^....
    0070 - d1 2f 41 b8 21 08 4b 1b-db d0 2d 99 4f d2 7b 4f   ./A.!.K...-.O.{O
    0080 - 6b 49 13 18 94 ac 26 b1-37 ac 13 e2 83 7a c0 33   kI....&.7....z.3
    0090 - fb 64 49 fc bc 75 9e 60-06 1c 5d 46 51 b1 a0 22   .dI..u.`..]FQ.."
    00a0 - f8 a6 50 53 68 76 cf 03-2b c0 8c a0 58 4d af 27   ..PShv..+...XM.'
    00b0 - 34 fe b9 cc cf e7 25 0b-3a c6 db 07 02 3e b6 d2   4.....%.:....>..

    Start Time: 1638540700
    Timeout   : 300 (sec)
    Verify return code: 10 (certificate has expired)
---

This is the log file:

2021-12-03 14:08:54,216:DEBUG:certbot.main:certbot version: 0.31.0
2021-12-03 14:08:54,218:DEBUG:certbot.main:Arguments: ['-n', '--force-renewal', '--webroot', '--webroot-path', '/tmp/letsencrypt/public_html', '-d', 'online-utility.org', '-d', 'www.online-utility.org', '-d', 'ww2.online-utility.org', '-d', 'new.online-utility.org', '--agree-tos', '--email', 'mladen.adamovic@gmail.com']
2021-12-03 14:08:54,219:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2021-12-03 14:08:54,234:DEBUG:certbot.log:Root logging level set at 20
2021-12-03 14:08:54,235:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2021-12-03 14:08:54,236:DEBUG:certbot.plugins.selection:Requested authenticator webroot and installer None
2021-12-03 14:08:54,237:DEBUG:certbot.plugins.selection:Single candidate plugin: * webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot.plugins.webroot:Authenticator
Initialized: <certbot.plugins.webroot.Authenticator object at 0x7f3cc4573588>
Prep: True
2021-12-03 14:08:54,238:DEBUG:certbot.plugins.selection:Selected authenticator <certbot.plugins.webroot.Authenticator object at 0x7f3cc4573588> and installer None
2021-12-03 14:08:54,238:INFO:certbot.plugins.selection:Plugins selected: Authenticator webroot, Installer None
2021-12-03 14:08:54,243:DEBUG:certbot.main:Picked account: <Account(RegistrationResource(new_authzr_uri='https://acme-v01.api.letsencrypt.org/acme/new-authz', body=Registration(terms_of_service_agreed=None, only_return_existing=None, external_account_binding=None, agreement='https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf', key=JWKRSA(key=<ComparableRSAKey(<cryptography.hazmat.backends.openssl.rsa._RSAPublicKey object at 0x7f3cc0440be0>)>), status=None, contact=('mailto:contact@numbeo.com',)), terms_of_service='https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf', uri='https://acme-v01.api.letsencrypt.org/acme/reg/4041758'), 473ff5c11c99787a7733e59f8e7f144d, Meta(creation_dt=datetime.datetime(2016, 9, 7, 11, 24, 55, tzinfo=<UTC>), creation_host='usve250267.serverprofi24.net'))>
2021-12-03 14:08:54,246:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2021-12-03 14:08:54,249:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
2021-12-03 14:08:54,403:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 658
2021-12-03 14:08:54,405:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Fri, 03 Dec 2021 14:08:54 GMT
Content-Type: application/json
Content-Length: 658
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
  "meta": {
    "caaIdentities": [
      "letsencrypt.org"
    ],
    "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",
    "website": "https://letsencrypt.org"
  },
  "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
  "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
  "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
  "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert",
  "zGn5Vs-XwvM": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417"
}
2021-12-03 14:08:54,412:DEBUG:certbot.renewal:Auto-renewal forced with --force-renewal...
2021-12-03 14:08:54,412:INFO:certbot.main:Renewing an existing certificate
2021-12-03 14:08:54,574:DEBUG:certbot.crypto_util:Generating key (2048 bits): /etc/letsencrypt/keys/0031_key-certbot.pem
2021-12-03 14:08:54,580:DEBUG:certbot.crypto_util:Creating CSR: /etc/letsencrypt/csr/0031_csr-certbot.pem
2021-12-03 14:08:54,580:DEBUG:acme.client:Requesting fresh nonce
2021-12-03 14:08:54,580:DEBUG:acme.client:Sending HEAD request to https://acme-v02.api.letsencrypt.org/acme/new-nonce.
2021-12-03 14:08:54,622:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "HEAD /acme/new-nonce HTTP/1.1" 200 0
2021-12-03 14:08:54,623:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Fri, 03 Dec 2021 14:08:54 GMT
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0001-ur10LUiM7KBtPE98S3DDgZZpa6JJCAuz3Sj51M0y1Y
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800


2021-12-03 14:08:54,624:DEBUG:acme.client:Storing nonce: 0001-ur10LUiM7KBtPE98S3DDgZZpa6JJCAuz3Sj51M0y1Y
2021-12-03 14:08:54,625:DEBUG:acme.client:JWS payload:
b'{\n  "identifiers": [\n    {\n      "type": "dns",\n      "value": "online-utility.org"\n    },\n    {\n      "type": "dns",\n      "value": "www.online-utility.org"\n    },\n    {\n      "type": "dns",\n      "value": "ww2.online-utility.org"\n    },\n    {\n      "type": "dns",\n      "value": "new.online-utility.org"\n    }\n  ]\n}'
2021-12-03 14:08:54,632:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/new-order:
{
  "signature": "IgWb3Ezmw4PIMARjNqsAVvRy500pG8JgzhAtyy42gkARXqzL8xtfJJ2kJzQv0uL5TnzkX_bkhpwKddcsHic4yYS1hP_eWFw5GC3wYuzpJ1FOfqZPnkGQS7CYEu7kVjwGja_Lj5Fuz3-GERhpW1T3zlaPTQbYzd6MqpTPszt2AhieNlQl3upMnuIksVmRVlPB4UrsiXtY3tbY5julgSLqjLRmtYMcjhOwurPdr0QiEgSYhtsjCUcFB71UsuLoE9NXXT9SHZ907ckjblEyN7G69590AuUV6eM9691cvp555cC60XhCcExpUWMVcM2VAjlAVykJ2rcgyKt5-dekRcnDMA",
  "protected": "eyJ1cmwiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvbmV3LW9yZGVyIiwgIm5vbmNlIjogIjAwMDEtdXIxMExVaU03S0J0UEU5OFMzRERnWlpwYTZKSkNBdXozU2o1MU0weTFZIiwgImtpZCI6ICJodHRwczovL2FjbWUtdjAxLmFwaS5sZXRzZW5jcnlwdC5vcmcvYWNtZS9yZWcvNDA0MTc1OCIsICJhbGciOiAiUlMyNTYifQ",
  "payload": "ewogICJpZGVudGlmaWVycyI6IFsKICAgIHsKICAgICAgInR5cGUiOiAiZG5zIiwKICAgICAgInZhbHVlIjogIm9ubGluZS11dGlsaXR5Lm9yZyIKICAgIH0sCiAgICB7CiAgICAgICJ0eXBlIjogImRucyIsCiAgICAgICJ2YWx1ZSI6ICJ3d3cub25saW5lLXV0aWxpdHkub3JnIgogICAgfSwKICAgIHsKICAgICAgInR5cGUiOiAiZG5zIiwKICAgICAgInZhbHVlIjogInd3Mi5vbmxpbmUtdXRpbGl0eS5vcmciCiAgICB9LAogICAgewogICAgICAidHlwZSI6ICJkbnMiLAogICAgICAidmFsdWUiOiAibmV3Lm9ubGluZS11dGlsaXR5Lm9yZyIKICAgIH0KICBdCn0"
}
2021-12-03 14:08:55,140:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/new-order HTTP/1.1" 201 769
2021-12-03 14:08:55,141:DEBUG:acme.client:Received response:
HTTP 201
Server: nginx
Date: Fri, 03 Dec 2021 14:08:55 GMT
Content-Type: application/json
Content-Length: 769
Connection: keep-alive
Boulder-Requester: 4041758
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Location: https://acme-v02.api.letsencrypt.org/acme/order/4041758/44433938760
Replay-Nonce: 0002Rfn3BjBMm93OXGt9zvTZEgHzyNoROYNsEVEQ37pVlOo
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "status": "ready",
  "expires": "2021-12-10T14:08:55Z",
  "identifiers": [
    {
      "type": "dns",
      "value": "new.online-utility.org"
    },
    {
      "type": "dns",
      "value": "online-utility.org"
    },
    {
      "type": "dns",
      "value": "ww2.online-utility.org"
    },
    {
      "type": "dns",
      "value": "www.online-utility.org"
    }
  ],
  "authorizations": [
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844430",
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844440",
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844450",
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844460"
  ],
  "finalize": "https://acme-v02.api.letsencrypt.org/acme/finalize/4041758/44433938760"
}
2021-12-03 14:08:55,142:DEBUG:acme.client:Storing nonce: 0002Rfn3BjBMm93OXGt9zvTZEgHzyNoROYNsEVEQ37pVlOo
2021-12-03 14:08:55,142:DEBUG:acme.client:JWS payload:
b''
2021-12-03 14:08:55,148:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844430:
{
  "signature": "fCSpzXx5gFb25ho53eipn6Oi84bewNkgCKlOC6biVtCgVxoQNsyY7wwTIf4sM7aIr1xkt0wTUMxxzoBhAZ9pUs6a8jc9y0ZH3jgI1fsXVvGmLnOeND1S4rSFTQ9TZop9t0FKmcy6SWqduXIWKp1IDf4OANAyAE8byC1GScSk0MXr8R74Upe1leSF206JcTN-5GZjZMvVGR5wsJhWr9PHzlDP86gXTh098zT0su27GqCKtl6dtwWyv13UvAsox6aVO-vmNf-ELRDE0-ipEN_9YzCPZ9aU74pXpEyMQA1y1ipDZ5f0MGWy2iFJnKTk-3rY0wbZfCv6Kv48sWsxupntQw",
  "protected": "eyJ1cmwiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYXV0aHotdjMvNTQ0MDE4NDQ0MzAiLCAibm9uY2UiOiAiMDAwMlJmbjNCakJNbTkzT1hHdDl6dlRaRWdIenlOb1JPWU5zRVZFUTM3cFZsT28iLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDEuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL3JlZy80MDQxNzU4IiwgImFsZyI6ICJSUzI1NiJ9",
  "payload": ""
}
2021-12-03 14:08:55,196:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/54401844430 HTTP/1.1" 200 780
2021-12-03 14:08:55,197:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Fri, 03 Dec 2021 14:08:55 GMT
Content-Type: application/json
Content-Length: 780
Connection: keep-alive
Boulder-Requester: 4041758
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0001f8wyJAqv05xukW3W_HEhJtUiY23r7IFJ0o2iP9Skizk
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "identifier": {
    "type": "dns",
    "value": "new.online-utility.org"
  },
  "status": "valid",
  "expires": "2021-12-31T10:03:10Z",
  "challenges": [
    {
      "type": "http-01",
      "status": "valid",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/54401844430/mOjT1A",
      "token": "GkpP7AF6QU3NiHFOk4I27VALOyXIV4B8hD9PnX8uyYM",
      "validationRecord": [
        {
          "url": "http://new.online-utility.org/.well-known/acme-challenge/GkpP7AF6QU3NiHFOk4I27VALOyXIV4B8hD9PnX8uyYM",
          "hostname": "new.online-utility.org",
          "port": "80",
          "addressesResolved": [
            "207.38.82.240"
          ],
          "addressUsed": "207.38.82.240"
        }
      ],
      "validated": "2021-12-01T10:03:06Z"
    }
  ]
}
2021-12-03 14:08:55,198:DEBUG:acme.client:Storing nonce: 0001f8wyJAqv05xukW3W_HEhJtUiY23r7IFJ0o2iP9Skizk
2021-12-03 14:08:55,198:DEBUG:acme.client:JWS payload:
b''
2021-12-03 14:08:55,202:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844440:
{
  "signature": "pFNK8vXYO5z9B-TCYzyeD_lo4bboTaoqErkHTABF1Jb9zEq4dA4ciylYkYvdTt53wVDZpppI01udVsBkXASTbWiTNnI5l3LLRBOBJKvFyfu13zAyC7UiafYKW3IbYNi2jgRO5FYOglZ_KvQs9Zbi2Vy8w7hGZB3teReQSHhhOyi-h5sD1k43W0HVJVgn3V2J1jp88IDtq573TBb9quwI9al9-qD6ZWeI9M6MF-rFLuapQrY39ZesSE2U86A7plVH362XXLJOuujo-Gg93dbdjE_NWcX5jg8Bn1lRszs7og0G6z1VOdVpZhtN1SzZVrlxgFRm0VaWAgR4QlPUxrn_Kg",
  "protected": "eyJ1cmwiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYXV0aHotdjMvNTQ0MDE4NDQ0NDAiLCAibm9uY2UiOiAiMDAwMWY4d3lKQXF2MDV4dWtXM1dfSEVoSnRVaVkyM3I3SUZKMG8yaVA5U2tpemsiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDEuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL3JlZy80MDQxNzU4IiwgImFsZyI6ICJSUzI1NiJ9",
  "payload": ""
}
2021-12-03 14:08:55,252:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/54401844440 HTTP/1.1" 200 768
2021-12-03 14:08:55,253:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Fri, 03 Dec 2021 14:08:55 GMT
Content-Type: application/json
Content-Length: 768
Connection: keep-alive
Boulder-Requester: 4041758
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0002BSLJ7jiO-k_hjB3K9VNaAlkn_qaG1-DFKrbqNO6wbx8
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "identifier": {
    "type": "dns",
    "value": "online-utility.org"
  },
  "status": "valid",
  "expires": "2021-12-31T10:03:07Z",
  "challenges": [
    {
      "type": "http-01",
      "status": "valid",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/54401844440/ZRrY0A",
      "token": "8ktPD-AXcpF9W6hWvN3k1t1odUtY10LFmioIuUM7ayw",
      "validationRecord": [
        {
          "url": "http://online-utility.org/.well-known/acme-challenge/8ktPD-AXcpF9W6hWvN3k1t1odUtY10LFmioIuUM7ayw",
          "hostname": "online-utility.org",
          "port": "80",
          "addressesResolved": [
            "207.38.82.240"
          ],
          "addressUsed": "207.38.82.240"
        }
      ],
      "validated": "2021-12-01T10:03:06Z"
    }
  ]
}
2021-12-03 14:08:55,254:DEBUG:acme.client:Storing nonce: 0002BSLJ7jiO-k_hjB3K9VNaAlkn_qaG1-DFKrbqNO6wbx8
2021-12-03 14:08:55,254:DEBUG:acme.client:JWS payload:
b''
2021-12-03 14:08:55,259:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844450:
{
  "signature": "iG4qdPAA3pEE_mi93OkxjJmrM-bbM6SgHu9_gCs-kAwxn5icMF1UADFQJoRNh230aF2Lpd6MsEGC0qObqdxu3ujW3rfjhQLGFnyUrVUAEsAy1qwdFbPOtsTYTVtgrKZKQpkFWDNDVr60kNfzhGSy3kqctr27n4aw77Iz-YqEDQ9XCnMlQjBzooc2PFq6NOnUG_y4mQlzK57iQ72oBHMAQGE3XjXsn3oeYhcJkofT5C5gIC0Ixu2CkTvjqZKHwFwcvmxXvOEj5EAvyWsHEob3AHwsuRRv9mA8T7uyHVb_I1TrPbuWTgyEaFY_51sN3Wnvzq_73fFRU2LupozKQw1vgQ",
  "protected": "eyJ1cmwiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYXV0aHotdjMvNTQ0MDE4NDQ0NTAiLCAibm9uY2UiOiAiMDAwMkJTTEo3amlPLWtfaGpCM0s5Vk5hQWxrbl9xYUcxLURGS3JicU5PNndieDgiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDEuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL3JlZy80MDQxNzU4IiwgImFsZyI6ICJSUzI1NiJ9",
  "payload": ""
}
2021-12-03 14:08:55,313:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/54401844450 HTTP/1.1" 200 780
2021-12-03 14:08:55,314:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Fri, 03 Dec 2021 14:08:55 GMT
Content-Type: application/json
Content-Length: 780
Connection: keep-alive
Boulder-Requester: 4041758
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 00012SZhvQx47SUEUGMTPop7nieLljicVA9mtfnVkQjL-6Y
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "identifier": {
    "type": "dns",
    "value": "ww2.online-utility.org"
  },
  "status": "valid",
  "expires": "2021-12-31T10:03:07Z",
  "challenges": [
    {
      "type": "http-01",
      "status": "valid",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/54401844450/7-SSvg",
      "token": "SzeaiCpkLOdFM7_91smYvF7SXLiD7yGEoNA29ZP5gJE",
      "validationRecord": [
        {
          "url": "http://ww2.online-utility.org/.well-known/acme-challenge/SzeaiCpkLOdFM7_91smYvF7SXLiD7yGEoNA29ZP5gJE",
          "hostname": "ww2.online-utility.org",
          "port": "80",
          "addressesResolved": [
            "207.38.82.240"
          ],
          "addressUsed": "207.38.82.240"
        }
      ],
      "validated": "2021-12-01T10:03:06Z"
    }
  ]
}
2021-12-03 14:08:55,314:DEBUG:acme.client:Storing nonce: 00012SZhvQx47SUEUGMTPop7nieLljicVA9mtfnVkQjL-6Y
2021-12-03 14:08:55,315:DEBUG:acme.client:JWS payload:
b''
2021-12-03 14:08:55,318:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844460:
{
  "signature": "lZQr1Ul4lxS0VHAleIH1Ryb6UiHBL2gj7HA0qWVuq_g8v2r6s231QWjZloNvZfMHoAmWCEX24yFcsjI9pOxlhySxJ1yb8DBO2uq2IstWb10qZVhy_HaE29Pa9_MaYvo8wIbbTFQjD8L99wP3KWlINwSKzKmPhFSnqawpQFM9klhGzTwXXIRO5CeOYN_tUKafFc8Sk7fFAzZMUED_dlpnwnlopKvH5p9gda_mCC_ellRP0f01v5czK1X8mCD3QZw2jx2uykA-y-DMxZnPJ0Fp6ddUfAgt_U_lg940UfNcJVn_Zg1SGWlOuytokN3thOrDzi9j-KVrBWQ7YETKLqUC3A",
  "protected": "eyJ1cmwiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvYXV0aHotdjMvNTQ0MDE4NDQ0NjAiLCAibm9uY2UiOiAiMDAwMTJTWmh2UXg0N1NVRVVHTVRQb3A3bmllTGxqaWNWQTltdGZuVmtRakwtNlkiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDEuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL3JlZy80MDQxNzU4IiwgImFsZyI6ICJSUzI1NiJ9",
  "payload": ""
}
2021-12-03 14:08:55,375:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/54401844460 HTTP/1.1" 200 780
2021-12-03 14:08:55,376:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Fri, 03 Dec 2021 14:08:55 GMT
Content-Type: application/json
Content-Length: 780
Connection: keep-alive
Boulder-Requester: 4041758
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 00011I4q9JhsZ8-JUYTJvA-F5BrDLHzKhoNOaooe0bHNJa4
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "identifier": {
    "type": "dns",
    "value": "www.online-utility.org"
  },
  "status": "valid",
  "expires": "2021-12-31T10:03:07Z",
  "challenges": [
    {
      "type": "http-01",
      "status": "valid",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/54401844460/bYUoAQ",
      "token": "y9TfxCWn1AFO66lU6qRl1B5XITcDROilEZP6q80bg7c",
      "validationRecord": [
        {
          "url": "http://www.online-utility.org/.well-known/acme-challenge/y9TfxCWn1AFO66lU6qRl1B5XITcDROilEZP6q80bg7c",
          "hostname": "www.online-utility.org",
          "port": "80",
          "addressesResolved": [
            "207.38.82.240"
          ],
          "addressUsed": "207.38.82.240"
        }
      ],
      "validated": "2021-12-01T10:03:06Z"
    }
  ]
}
2021-12-03 14:08:55,376:DEBUG:acme.client:Storing nonce: 00011I4q9JhsZ8-JUYTJvA-F5BrDLHzKhoNOaooe0bHNJa4
2021-12-03 14:08:55,378:DEBUG:certbot.client:CSR: CSR(file='/etc/letsencrypt/csr/0031_csr-certbot.pem', data=b'-----BEGIN CERTIFICATE REQUEST-----\nMIICvTCCAaUCAQIwADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALbR\nWom6EMVGEx3dUd8JJdRffEKfbG0qzld0TDvVxU6ojlQrMT8RzUihaZWGuDpumtaC\n6qOGVlfmEdIubovDiQgiIIM3fiop664rE8GL927OHdIcR8y9qfDTPD/jY9I7Hi/+\np+6fb/JG4gyobm7gPZ8c+XA10/7sU8IUp2VEPtYqNX7juV0zGJwSl7d/E6mJOY4s\n6e03sJzN4asy3EPhGZvLAdLW/ixYA9KObT6pcjznQhvg6XRAisN89+PTJFZP9+3N\nT4g1SBc3C8oS7tCxCe/yrh8bcTWjQMnw38+BD8fLroXiDdInw/yJOLOtVp/IVMXR\n1/rIbAR9b98Bhu/p5C8CAwEAAaB4MHYGCSqGSIb3DQEJDjFpMGcwZQYDVR0RBF4w\nXIISb25saW5lLXV0aWxpdHkub3JnghZ3d3cub25saW5lLXV0aWxpdHkub3JnghZ3\ndzIub25saW5lLXV0aWxpdHkub3JnghZuZXcub25saW5lLXV0aWxpdHkub3JnMA0G\nCSqGSIb3DQEBCwUAA4IBAQBnMtvOzKisBBMeSiYsfee1vpbga0jUbjkMUk+yuV2F\n/N17Dcj1HR25Dy7hLv5w5GbUan54vksbt2GEtEVthJk+zidbIqgdniSSw0AWcsTk\nidW0DZUhOQJ1SUQwxCVL7f0WZx4XpL4nIMtBKMkV4Gu3VXE1WZ2Qk/xMjU1wH4HZ\nZrIGPnigTyy4dfogztYowIjhVrMqmfJzJ6T9jxfWzzagyMcS0ngVXMqhSR1Etncg\nZqLABk4zmxZwE4kGB0kmLaqApkaIIV6xa0X9I3dgFGECQarze9aIZ40TSfjJQkj2\nTY96Bwb9XU03jj7CKQrlkFE288IQv0U1RJdjHfaTVUzM\n-----END CERTIFICATE REQUEST-----\n', form='pem')
2021-12-03 14:08:55,380:DEBUG:acme.client:JWS payload:
b'{\n  "resource": "new-cert",\n  "csr": "MIICvTCCAaUCAQIwADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALbRWom6EMVGEx3dUd8JJdRffEKfbG0qzld0TDvVxU6ojlQrMT8RzUihaZWGuDpumtaC6qOGVlfmEdIubovDiQgiIIM3fiop664rE8GL927OHdIcR8y9qfDTPD_jY9I7Hi_-p-6fb_JG4gyobm7gPZ8c-XA10_7sU8IUp2VEPtYqNX7juV0zGJwSl7d_E6mJOY4s6e03sJzN4asy3EPhGZvLAdLW_ixYA9KObT6pcjznQhvg6XRAisN89-PTJFZP9-3NT4g1SBc3C8oS7tCxCe_yrh8bcTWjQMnw38-BD8fLroXiDdInw_yJOLOtVp_IVMXR1_rIbAR9b98Bhu_p5C8CAwEAAaB4MHYGCSqGSIb3DQEJDjFpMGcwZQYDVR0RBF4wXIISb25saW5lLXV0aWxpdHkub3JnghZ3d3cub25saW5lLXV0aWxpdHkub3JnghZ3dzIub25saW5lLXV0aWxpdHkub3JnghZuZXcub25saW5lLXV0aWxpdHkub3JnMA0GCSqGSIb3DQEBCwUAA4IBAQBnMtvOzKisBBMeSiYsfee1vpbga0jUbjkMUk-yuV2F_N17Dcj1HR25Dy7hLv5w5GbUan54vksbt2GEtEVthJk-zidbIqgdniSSw0AWcsTkidW0DZUhOQJ1SUQwxCVL7f0WZx4XpL4nIMtBKMkV4Gu3VXE1WZ2Qk_xMjU1wH4HZZrIGPnigTyy4dfogztYowIjhVrMqmfJzJ6T9jxfWzzagyMcS0ngVXMqhSR1EtncgZqLABk4zmxZwE4kGB0kmLaqApkaIIV6xa0X9I3dgFGECQarze9aIZ40TSfjJQkj2TY96Bwb9XU03jj7CKQrlkFE288IQv0U1RJdjHfaTVUzM"\n}'
2021-12-03 14:08:55,386:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/finalize/4041758/44433938760:
{
  "signature": "amsRoYhKoPQTyi7niMwNdL5e_yLczNDP7O_JngvWiwnH5BMsTG36iaTY9kFlQ445MQo0MjzPmFiGPIQwTFhVjtWBaXkKQw7XAN5nk3Qnb3EYli3YLcwS-G86qWCkrWAQ2-UG1U7BbpuJzDyueJ_ffy6u-Dn8rm9RL1RoGvxGalKmcbA3aGKtwrDAocZgl2Q2pyww6juH6QmmCXHoMifX86tQrkf7xZCGbz7w2MELewtHH05sYeZ_xltXuAvE2qz1IozCdAuQHCnWY1bIi9YlAgIaCIiEHzmPqGW1A9Mx-uTIjRURW9W8SH06VUa8ssO-UFfh70nGqq6e7IJbJcQkGA",
  "protected": "eyJ1cmwiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvZmluYWxpemUvNDA0MTc1OC80NDQzMzkzODc2MCIsICJub25jZSI6ICIwMDAxMUk0cTlKaHNaOC1KVVlUSnZBLUY1QnJETEh6S2hvTk9hb29lMGJITkphNCIsICJraWQiOiAiaHR0cHM6Ly9hY21lLXYwMS5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvcmVnLzQwNDE3NTgiLCAiYWxnIjogIlJTMjU2In0",
  "payload": "ewogICJyZXNvdXJjZSI6ICJuZXctY2VydCIsCiAgImNzciI6ICJNSUlDdlRDQ0FhVUNBUUl3QURDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTGJSV29tNkVNVkdFeDNkVWQ4SkpkUmZmRUtmYkcwcXpsZDBURHZWeFU2b2psUXJNVDhSelVpaGFaV0d1RHB1bXRhQzZxT0dWbGZtRWRJdWJvdkRpUWdpSUlNM2Zpb3A2NjRyRThHTDkyN09IZEljUjh5OXFmRFRQRF9qWTlJN0hpXy1wLTZmYl9KRzRneW9ibTdnUFo4Yy1YQTEwXzdzVThJVXAyVkVQdFlxTlg3anVWMHpHSndTbDdkX0U2bUpPWTRzNmUwM3NKek40YXN5M0VQaEdadkxBZExXX2l4WUE5S09iVDZwY2p6blFodmc2WFJBaXNOODktUFRKRlpQOS0zTlQ0ZzFTQmMzQzhvUzd0Q3hDZV95cmg4YmNUV2pRTW53MzgtQkQ4Zkxyb1hpRGRJbndfeUpPTE90VnBfSVZNWFIxX3JJYkFSOWI5OEJodV9wNUM4Q0F3RUFBYUI0TUhZR0NTcUdTSWIzRFFFSkRqRnBNR2N3WlFZRFZSMFJCRjR3WElJU2IyNXNhVzVsTFhWMGFXeHBkSGt1YjNKbmdoWjNkM2N1YjI1c2FXNWxMWFYwYVd4cGRIa3ViM0puZ2haM2R6SXViMjVzYVc1bExYVjBhV3hwZEhrdWIzSm5naFp1WlhjdWIyNXNhVzVsTFhWMGFXeHBkSGt1YjNKbk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQm5NdHZPektpc0JCTWVTaVlzZmVlMXZwYmdhMGpVYmprTVVrLXl1VjJGX04xN0RjajFIUjI1RHk3aEx2NXc1R2JVYW41NHZrc2J0MkdFdEVWdGhKay16aWRiSXFnZG5pU1N3MEFXY3NUa2lkVzBEWlVoT1FKMVNVUXd4Q1ZMN2YwV1p4NFhwTDRuSU10QktNa1Y0R3UzVlhFMVdaMlFrX3hNalUxd0g0SFpacklHUG5pZ1R5eTRkZm9nenRZb3dJamhWck1xbWZKeko2VDlqeGZXenphZ3lNY1MwbmdWWE1xaFNSMUV0bmNnWnFMQUJrNHpteFp3RTRrR0Iwa21MYXFBcGthSUlWNnhhMFg5STNkZ0ZHRUNRYXJ6ZTlhSVo0MFRTZmpKUWtqMlRZOTZCd2I5WFUwM2pqN0NLUXJsa0ZFMjg4SVF2MFUxUkpkakhmYVRWVXpNIgp9"
}
2021-12-03 14:08:55,916:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/finalize/4041758/44433938760 HTTP/1.1" 200 873
2021-12-03 14:08:55,917:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Fri, 03 Dec 2021 14:08:55 GMT
Content-Type: application/json
Content-Length: 873
Connection: keep-alive
Boulder-Requester: 4041758
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Location: https://acme-v02.api.letsencrypt.org/acme/order/4041758/44433938760
Replay-Nonce: 0001jXkRN1igtSRuUAKVZpO5605Ck4WrDUxgYQJWoC2xNu8
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "status": "valid",
  "expires": "2021-12-10T14:08:55Z",
  "identifiers": [
    {
      "type": "dns",
      "value": "new.online-utility.org"
    },
    {
      "type": "dns",
      "value": "online-utility.org"
    },
    {
      "type": "dns",
      "value": "ww2.online-utility.org"
    },
    {
      "type": "dns",
      "value": "www.online-utility.org"
    }
  ],
  "authorizations": [
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844430",
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844440",
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844450",
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844460"
  ],
  "finalize": "https://acme-v02.api.letsencrypt.org/acme/finalize/4041758/44433938760",
  "certificate": "https://acme-v02.api.letsencrypt.org/acme/cert/0345aba7d4b8823961a396a0cf1969b8ecb2"
}
2021-12-03 14:08:55,917:DEBUG:acme.client:Storing nonce: 0001jXkRN1igtSRuUAKVZpO5605Ck4WrDUxgYQJWoC2xNu8
2021-12-03 14:08:56,917:DEBUG:acme.client:JWS payload:
b''
2021-12-03 14:08:56,921:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/order/4041758/44433938760:
{
  "signature": "SFONUfIN0UJ6AthcV3kMUopjhPmP8gGuqJzOewQLaqM95-GVSZGsk3GiNwYPWafxxRlxd28WwQ9FPhERGtKR5SSQFVCEk8xMcmBA7EddHqr96BqMrvmM79JpfPUQN3BVh-eR5tSEiyzb62_yku2m8evBA_W8zYX8kRLKy75WrVagiJ9pgJRtFMSYdBVh16BpYWUzBQFe4pSkD5EiG368eNALNPJbm0mVpLb2mW5QNMJy4j1WtI7Vhye8vPcfNGjWQ3TmlbY6omabcsvvE9gl3cPMnuc63-uJsO1M439iRsn7jJHP8pW0fstBrHMdBwVwDQEJduY18_ruw7Fx_Ulb3g",
  "protected": "eyJ1cmwiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvb3JkZXIvNDA0MTc1OC80NDQzMzkzODc2MCIsICJub25jZSI6ICIwMDAxalhrUk4xaWd0U1J1VUFLVlpwTzU2MDVDazRXckRVeGdZUUpXb0MyeE51OCIsICJraWQiOiAiaHR0cHM6Ly9hY21lLXYwMS5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvcmVnLzQwNDE3NTgiLCAiYWxnIjogIlJTMjU2In0",
  "payload": ""
}
2021-12-03 14:08:56,985:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/order/4041758/44433938760 HTTP/1.1" 200 873
2021-12-03 14:08:56,986:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Fri, 03 Dec 2021 14:08:56 GMT
Content-Type: application/json
Content-Length: 873
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0001TUjOJk6jtC44dFo-Xe-orrScrZumoiv_11V2WGJoM7g
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "status": "valid",
  "expires": "2021-12-10T14:08:55Z",
  "identifiers": [
    {
      "type": "dns",
      "value": "new.online-utility.org"
    },
    {
      "type": "dns",
      "value": "online-utility.org"
    },
    {
      "type": "dns",
      "value": "ww2.online-utility.org"
    },
    {
      "type": "dns",
      "value": "www.online-utility.org"
    }
  ],
  "authorizations": [
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844430",
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844440",
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844450",
    "https://acme-v02.api.letsencrypt.org/acme/authz-v3/54401844460"
  ],
  "finalize": "https://acme-v02.api.letsencrypt.org/acme/finalize/4041758/44433938760",
  "certificate": "https://acme-v02.api.letsencrypt.org/acme/cert/0345aba7d4b8823961a396a0cf1969b8ecb2"
}
2021-12-03 14:08:56,986:DEBUG:acme.client:Storing nonce: 0001TUjOJk6jtC44dFo-Xe-orrScrZumoiv_11V2WGJoM7g
2021-12-03 14:08:56,986:DEBUG:acme.client:JWS payload:
b''
2021-12-03 14:08:56,990:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/cert/0345aba7d4b8823961a396a0cf1969b8ecb2:
{
  "signature": "gEoiqPAJaSWn_wKNy0pKA6pN7ndXdOkCckViscMh9J3YpRiBwDWqYWoAUZLjHVyQdFAsGzL8TidP-IX7ZhyffoWLhoXJ6sSAO8zfbtO1bEdVZY7A4Iriy5zRGLYSevgQVpO-AsBJsQs6ZFw1Mow0GSp0B-Aip7Ia_DU2C3Ei-Z5KOwA0xQleOwXATUC4uM6-dZKIsf6YerzrBYaGN4zjnIbED9-SVWybDLBRyWiKixzmKN6Q6FEyZMAEr7ZqQ5AgAgGwD8BAoSFy7LrAwpnFeHrUiOK9BvyRg-H2ZYSCdDnEaUVA5wmNqO6AEGZIUZoYLlLQX0kkIUqARwDmR6QLww",
  "protected": "eyJ1cmwiOiAiaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvY2VydC8wMzQ1YWJhN2Q0Yjg4MjM5NjFhMzk2YTBjZjE5NjliOGVjYjIiLCAibm9uY2UiOiAiMDAwMVRVak9KazZqdEM0NGRGby1YZS1vcnJTY3JadW1vaXZfMTFWMldHSm9NN2ciLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDEuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL3JlZy80MDQxNzU4IiwgImFsZyI6ICJSUzI1NiJ9",
  "payload": ""
}
2021-12-03 14:08:57,044:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/cert/0345aba7d4b8823961a396a0cf1969b8ecb2 HTTP/1.1" 200 5699
2021-12-03 14:08:57,044:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Fri, 03 Dec 2021 14:08:57 GMT
Content-Type: application/pem-certificate-chain
Content-Length: 5699
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index", <https://acme-v02.api.letsencrypt.org/acme/cert/0345aba7d4b8823961a396a0cf1969b8ecb2/1>;rel="alternate"
Replay-Nonce: 0002rpBQ9aAqdVlsw7tTsnhXju0kYBhNDzPDQ88Glcl44Co
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

-----BEGIN CERTIFICATE-----
MIIFcjCCBFqgAwIBAgISA0Wrp9S4gjlho5agzxlpuOyyMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMTEyMDMxMzA4NTVaFw0yMjAzMDMxMzA4NTRaMB0xGzAZBgNVBAMT
Em9ubGluZS11dGlsaXR5Lm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBALbRWom6EMVGEx3dUd8JJdRffEKfbG0qzld0TDvVxU6ojlQrMT8RzUihaZWG
uDpumtaC6qOGVlfmEdIubovDiQgiIIM3fiop664rE8GL927OHdIcR8y9qfDTPD/j
Y9I7Hi/+p+6fb/JG4gyobm7gPZ8c+XA10/7sU8IUp2VEPtYqNX7juV0zGJwSl7d/
E6mJOY4s6e03sJzN4asy3EPhGZvLAdLW/ixYA9KObT6pcjznQhvg6XRAisN89+PT
JFZP9+3NT4g1SBc3C8oS7tCxCe/yrh8bcTWjQMnw38+BD8fLroXiDdInw/yJOLOt
Vp/IVMXR1/rIbAR9b98Bhu/p5C8CAwEAAaOCApUwggKRMA4GA1UdDwEB/wQEAwIF
oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAd
BgNVHQ4EFgQUcrcdvAGJO75Y4x0yf3/pf2HZwsowHwYDVR0jBBgwFoAUFC6zF7dY
VsuuUAlA5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRw
Oi8vcjMuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNy
Lm9yZy8wZQYDVR0RBF4wXIIWbmV3Lm9ubGluZS11dGlsaXR5Lm9yZ4ISb25saW5l
LXV0aWxpdHkub3JnghZ3dzIub25saW5lLXV0aWxpdHkub3JnghZ3d3cub25saW5l
LXV0aWxpdHkub3JnMEwGA1UdIARFMEMwCAYGZ4EMAQIBMDcGCysGAQQBgt8TAQEB
MCgwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIIBBAYK
KwYBBAHWeQIEAgSB9QSB8gDwAHUAQcjKsd8iRkoQxqE6CUKHXk4xixsD6+tLx2jw
kGKWBvYAAAF9gKBnpQAABAMARjBEAiANNp65InV7CQ3qDVMnaj66ar1pygWxLTT1
ppNnYpJNvAIgcBM39leJeo8KPP+fbur+nw97i5MZiAgy/Wrlozyh0BgAdwBGpVXr
dfqRIDC1oolp9PN9ESxBdL79SbiFq/L8cP5tRwAAAX2AoGfgAAAEAwBIMEYCIQCP
urSJckpk08VQfj/PgFYbveXMSrPCBViS7kQDoJFHXwIhAIjf4XWQCAZaXkunatEj
pMYrbRh+dJmAJLZGL0S6U1apMA0GCSqGSIb3DQEBCwUAA4IBAQAQWv/epzyTyX9j
mZ1Nckswc+I2cX/CbbKUg5igd98RccnyFDCzBglAmkyARM1MqOdRBGpwCaGBWeaH
Kt0Mq7tc4kRYNKeOpn7zXbZWc0cu1r30NrzSqFhoe0YhpJUWjD/Nqv1VWg7dDIKX
gUY/zD4ECKj5sQX9Z5q5nB87uz5galex5g1fXLCJs2qTM15Hlo9maJmp7o1zZ1n1
ICgLiMyVdDxfinV9D/ZyOccHn/I2NDprV1UoRzs4V+qzEaazj3Zcrx3wO8nOXaCX
NgrxxMirHPgYW3/LqS9r0Fe1ZBi8LMBXoxL8LXfdL6zylvrr08jGjg+mlBlSpoJO
ggC3cieu
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----

2021-12-03 14:08:57,045:DEBUG:acme.client:Storing nonce: 0002rpBQ9aAqdVlsw7tTsnhXju0kYBhNDzPDQ88Glcl44Co
2021-12-03 14:08:57,051:DEBUG:certbot.storage:Writing new private key to /etc/letsencrypt/archive/online-utility.org/privkey73.pem.
2021-12-03 14:08:57,051:DEBUG:certbot.storage:Writing certificate to /etc/letsencrypt/archive/online-utility.org/cert73.pem.
2021-12-03 14:08:57,051:DEBUG:certbot.storage:Writing chain to /etc/letsencrypt/archive/online-utility.org/chain73.pem.
2021-12-03 14:08:57,052:DEBUG:certbot.storage:Writing full chain to /etc/letsencrypt/archive/online-utility.org/fullchain73.pem.
2021-12-03 14:08:57,065:DEBUG:certbot.plugins.selection:Requested authenticator webroot and installer <certbot.cli._Default object at 0x7f3cc0434278>
2021-12-03 14:08:57,066:DEBUG:certbot.cli:Var webroot_path=/tmp/letsencrypt/public_html (set by user).
2021-12-03 14:08:57,066:DEBUG:certbot.cli:Var webroot_map={'webroot_path'} (set by user).
2021-12-03 14:08:57,072:DEBUG:certbot.cli:Var authenticator=webroot (set by user).
2021-12-03 14:08:57,085:DEBUG:certbot.cli:Var webroot_path=/tmp/letsencrypt/public_html (set by user).
2021-12-03 14:08:57,090:DEBUG:certbot.storage:Writing new config /etc/letsencrypt/renewal/online-utility.org.conf.new.
2021-12-03 14:08:57,096:DEBUG:certbot.reporter:Reporting to user: Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/online-utility.org/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/online-utility.org/privkey.pem
Your cert will expire on 2022-03-03. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew"
2021-12-03 14:08:57,096:DEBUG:certbot.reporter:Reporting to user: If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
Donating to EFF:                    https://eff.org/donate-le

My web server is (include version): Apache Tomcat 8.5.5 (problem reproducable on 9.0.x branch)

The operating system my web server runs on is (include version): Linux 4.4.0-042stab145.3

Certbot version certbot 0.31.0

Where is the problem? What is causing the problem?

Thank you

3 Likes
2

Welcome back.

First, your certificates are fine and I see the updated one issued Dec 3. See this site as another way to confirm

The error is from openssl and is saying one of the certs in the chain, the DST Root CA X3 has expired. That cert has expired (see below) but is not a problem generally. This website uses a similar chain ending in that same DST Root CA X3.

Older versions of openssl do have a problem though and there are various work-arounds. The easiest is to update your CA Certificate store although I do not know how to do that with your Linux version. An update should remove the DST Root CA X3 from the system CA root store.

If you are using openssl 1.0.2 you have another option which is described in this blog from the openssl group

There are numerous posts about this expired DST Root CA X3. Here is just one providing more background

3 Likes
3

Please remove that from your script.
Especially if you are giving that as advice to others.

3 Likes
4

Some visual proof your serving things correctly:

echo | openssl s_client -connect 207.38.82.240:443 -servername online-utility.org | head
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = online-utility.org
verify return:1
CONNECTED(00000005)
---
Certificate chain
 0 s:CN = online-utility.org
DONE
   i:C = US, O = Let's Encrypt, CN = R3
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
 2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
---

The problem is within your client.

2 Likes
5

Thank you, everyone, the problem seems to be openssl client.

4 Likes
6

Don't forget:

3 Likes
7

Blog post doesn't have that --force-renewal statement, that's what I use internally as cron jobs are running once per month and they are restarting web server.

There is no other easy way to reload certificates in Tomcat.

1 Like
8

That could be improved upon.

2 Likes
9

Indeed, that really sounds like a not-so-good implementation.

3 Likes
10

It's a "this will surely work" approach.
Which it does.
But like I said "That could be improved upon".
Simply checking renewal status should not trigger anything [until a cert has been renewed].
So, then it can be checked twice a day without concern.

2 Likes
11

That would be by adding to certbot
--posthook 'sh /etc/init.d/tomcat restart' ?

That should work?
Restarting a service in posthook?

1 Like
12

You should use --deploy-hook instead of --post-hook so that you're restarting your tomcat when you actually acquire a new certificate instead of every time you try to acquire a new certificate.

5 Likes
13

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.