Certbot fails on Raspberry Pi Ubuntu 20.04 (Arm64)

My domain is: MyBeautyHaven.uk

I ran this command: Multiple commands, certbot --certonly, certbot --debug, certbot --apache

It produced this output:
Debug output:
Exiting abnormally:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 485, in wrap_socket
cnx.do_handshake()
File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1915, in do_handshake
self._raise_ssl_error(self._ssl, result)
File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1647, in _raise_ssl_error
_raise_current_error()
File "/usr/lib/python3/dist-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 665, in urlopen
httplib_response = self._make_request(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 376, in _make_request
self._validate_conn(conn)
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 996, in validate_conn
conn.connect()
File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 366, in connect
self.sock = ssl_wrap_socket(
File "/usr/lib/python3/dist-packages/urllib3/util/ssl
.py", line 370, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 491, in wrap_socket
raise ssl.SSLError("bad handshake: %r" % e)
ssl.SSLError: ("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
resp = conn.urlopen(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 719, in urlopen
retries = retries.increment(
File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 436, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/bin/certbot", line 11, in
load_entry_point('certbot==0.40.0', 'console_scripts', 'certbot')()
File "/usr/lib/python3/dist-packages/certbot/main.py", line 1382, in main
File "/usr/lib/python3/dist-packages/certbot/main.py", line 1382, in main
return config.func(config, plugins)
File "/usr/lib/python3/dist-packages/certbot/main.py", line 1125, in run
le_client = _init_le_client(config, authenticator, installer)
File "/usr/lib/python3/dist-packages/certbot/main.py", line 607, in _init_le_client
acc, acme = _determine_account(config)
File "/usr/lib/python3/dist-packages/certbot/main.py", line 522, in _determine_account
acc, acme = client.register(
File "/usr/lib/python3/dist-packages/certbot/client.py", line 176, in register
acme = acme_from_config_key(config, key)
File "/usr/lib/python3/dist-packages/certbot/client.py", line 46, in acme_from_config_key
return acme_client.BackwardsCompatibleClientV2(net, key, config.server)
File "/usr/lib/python3/dist-packages/acme/client.py", line 808, in init
directory = messages.Directory.from_json(net.get(server).json())
File "/usr/lib/python3/dist-packages/acme/client.py", line 1138, in get
self._send_request('GET', url, **kwargs), content_type=content_type)
File "/usr/lib/python3/dist-packages/acme/client.py", line 1088, in _send_request
response = self.session.request(method, url, *args, **kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 533, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 646, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

My web server is (include version): Apache 2.4.41

The operating system my web server runs on is (include version): Ubuntu 20.04.01 LTS Arm64

My hosting provider, if applicable, is: Google Domains.

I can login to a root shell on my machine: yes

I'm using a control panel to manage my site: no, command line only.

The version of my client is: Certbot 0.40.0

Notes: I've tried to purge all certbot packages to no avail. Please help :frowning:

1 Like

Hi and welcome to the community!

Yeah, you need remove that version (and replace with snapd installation of certbot).
Have you tried?:
sudo apt remove certbot

[&2* readers: Get involved; Be heard. It starts with: if you read something you like, then like it :heart:]

2 Likes

Although snaps will get you the latest version of Certbot, this error might be resolvable with:

sudo apt install --reinstall ca-certificates
2 Likes

@_az I did as @rg305 said and installed via snapd, which seemed to fix the issue. However I still had a x509 certificate issue with snap but I was able to fix that by blindly running all the snap repair services. I did, however, try your method when I saw it, hopefully if for whatever reason I need to use the package version again I won't bump into the issue. However I did run into errors with the snap version of certbot about not having the relevant A records for the domains I wanted certificates for: www.MyBeautyHaven.uk and MyBeautyHaven.uk this is despite adding them to my local and 'real' DNS servers for this domain. But I believe that is out the scope of this thread.

Thanks for your help :slight_smile:

2 Likes

I'm glad this part worked out.
If you are still having DNS issues, go ahead and open another topic for discussion.

Cheers from Miami :beers:

[&2* readers: Get involved; Be heard. It starts with: if you read something you like, then like it :heart:]

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.