# Certbot no longer works
**URL:** https://community.letsencrypt.org/t/certbot-no-longer-works/222025
**Category:** Help
**Created:** [July 16, 2024, 3:24am UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025 "2024-07-16T03:24:25Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [July 17, 2024, 1:25pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/21 "2024-07-17T13:25:25Z")
> [@MikeMcQ](#):
>
> `sudo certbot certonly --apache --dry-run --cert-name www.newstarmotel.dyn-o-saur.com -d www.newstarmotel.dyn-o-saur.com -d newstarmotel.dyn-o-saur.com`
Okay, good, let's try getting a fresh production cert now:
```nohighlight
sudo certbot --apache --cert-name www.newstarmotel.dyn-o-saur.com -d www.newstarmotel.dyn-o-saur.com -d newstarmotel.dyn-o-saur.com
```
As before, should get prompted about adding a domain name and confirm you want that
Please show output of that command
And, show a fresh `sudo apache2ctl -t -D DUMP_VHOSTS` after that too
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 2:07pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/22 "2024-07-17T14:07:09Z")
I think it worked, if you can check on your end.
You are updating certificate [www.newstarmotel.dyn-o-saur.com](http://www.newstarmotel.dyn-o-saur.com) to include new
domain(s):
- [newstarmotel.dyn-o-saur.com](http://newstarmotel.dyn-o-saur.com)
You are also removing previously included domain(s):
(None)
Did you intend to make this change?
* * *
(U)pdate certificate/(C)ancel: u
Renewing an existing certificate for [www.newstarmotel.dyn-o-saur.com](http://www.newstarmotel.dyn-o-saur.com) and [newstarmotel.dyn-o-saur.com](http://newstarmotel.dyn-o-saur.com)
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/www.newstarmotel.dyn-o-saur.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/www.newstarmotel.dyn-o-saur.com/privkey.pem
This certificate expires on 2024-10-15.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate
Successfully deployed certificate for [www.newstarmotel.dyn-o-saur.com](http://www.newstarmotel.dyn-o-saur.com) to /etc/apache2/sites-enabled/newstarmotel-le-ssl.conf
Successfully deployed certificate for [newstarmotel.dyn-o-saur.com](http://newstarmotel.dyn-o-saur.com) to /etc/apache2/sites-enabled/newstarmotel-le-ssl.conf
Your existing certificate has been successfully renewed, and the new certificate has been installed.
* * *
If you like Certbot, please consider supporting our work by:
- Donating to ISRG / Let's Encrypt: [https://letsencrypt.org/donate](https://letsencrypt.org/donate)
- Donating to EFF: [Support EFF's Work on Let's Encrypt | Electronic Frontier Foundation](https://eff.org/donate-le)
* * *
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 2:12pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/23 "2024-07-17T14:12:00Z")
One more thing: on [gillab.dyndns-wiki.com](http://gillab.dyndns-wiki.com) and [newstarmotel.homelinux.com](http://newstarmotel.homelinux.com), the www extensions does not work. Here's me le-ssl.conf:
```nohighlight
ServerAdmin webmaster@localhost
ServerName gilllab.dyndns-wiki.com
ServerAlias www.gilllab.dyndns-wiki.com
DocumentRoot /var/www/GillLabwebsite
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.
# RewriteCond %{SERVER_NAME} =www.gilllab.dyndns-wiki.com [OR]
# RewriteCond %{SERVER_NAME} =gilllab.dyndns-wiki.com
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
SSLCertificateFile /etc/letsencrypt/live/gilllab.dyndns-wiki.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/gilllab.dyndns-wiki.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
```
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [July 17, 2024, 2:32pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/24 "2024-07-17T14:32:15Z")
> [@Tears](#):
>
> One more thing: on [gillab.dyndns-wiki.com](http://gillab.dyndns-wiki.com)
Yes, your other domains have the same kind of problem
But, let's finish making sure the prior steps worked.
> [@MikeMcQ](#):
>
> And, show a fresh `sudo apache2ctl -t -D DUMP_VHOSTS` after that too
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 2:34pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/25 "2024-07-17T14:34:57Z")
Lastly, is there anyway to clean up the obsolete certificates on crt.sh?
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [July 17, 2024, 2:37pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/26 "2024-07-17T14:37:32Z")
> [@Tears](#):
>
> is there anyway to clean up the obsolete certificates on crt.sh?
No, certs are logged in the public Certificate Transparency logs. crt.sh is just one tool that displays the CT log info. This log is an essential part of auditing to monitor for mis-issuance and such. These are "public" certs after all 🙂
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 3:25pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/27 "2024-07-17T15:25:26Z")
```nohighlight
*:443 is a NameVirtualHost
default server gilllab.dyndns-wiki.com (/etc/apache2/sites-enabled/gilllab-le-ssl.conf:2)
port 443 namevhost gilllab.dyndns-wiki.com (/etc/apache2/sites-enabled/gilllab-le-ssl.conf:2)
alias www.gilllab.dyndns-wiki.com
port 443 namevhost newstarmotel.homelinux.com (/etc/apache2/sites-enabled/homelinux-le-ssl.conf:2)
alias www.newstarmotel.homelinux.com
port 443 namevhost newstarmotel.dyn-o-saur.com (/etc/apache2/sites-enabled/newstarmotel-le-ssl.conf:2)
alias www.newstarmotel.dyn-o-saur.com
port 443 namevhost nsmrentalproperties.from-ca.com (/etc/apache2/sites-enabled/nsmrentalproperties-le-ssl.conf:2)
alias www.nsmrentalproperties.from-ca.com
*:80 is a NameVirtualHost
default server gilllab.dyndns-wiki.com (/etc/apache2/sites-enabled/gilllab.conf:1)
port 80 namevhost gilllab.dyndns-wiki.com (/etc/apache2/sites-enabled/gilllab.conf:1)
alias www.gilllab.dyndns-wiki.com
port 80 namevhost newstarmotel.homelinux.com (/etc/apache2/sites-enabled/homelinux.conf:1)
alias www.newstarmotel.homelinux.com
port 80 namevhost newstarmotel.dyn-o-saur.com (/etc/apache2/sites-enabled/newstarmotel.conf:1)
alias www.newstarmotel.dyn-o-saur.com
port 80 namevhost nsmrentalproperties.from-ca.com (/etc/apache2/sites-enabled/nsmrentalproperties.conf:1)
alias www.nsmrentalproperties.from-ca.com
```
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [July 17, 2024, 3:44pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/28 "2024-07-17T15:44:37Z")
Okay. Good. The dyn-o-saur looks good. There were no "extra" VirtualHosts for port 80 added anywhere. I was pretty sure there would not be but wanted to be sure.
> [@Tears](#):
>
> One more thing: on [gillab.dyndns-wiki.com](http://gillab.dyndns-wiki.com) and [newstarmotel.homelinux.com](http://newstarmotel.homelinux.com), the www extensions does not work.
The first problem with `gilllab.dyndns-wiki.com` (which you omitted one `l` by the way) is there is no DNS entry for the `www` subdomain. You could need to get that setup first.
```nohighlight
nslookup www.gilllab.dyndns-wiki.com
** server can't find www.gilllab.dyndns-wiki.com: NXDOMAIN
nslookup gilllab.dyndns-wiki.com
Address: 172.118.22.205
```
I will address newstarmotel homelinux in my next post. It is slightly different than this gilllab issue and your dyn-o-saur issue.
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 4:20pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/29 "2024-07-17T16:20:55Z")
I forgot to include the wildcard on the [dyndns.org](http://dyndns.org) server for www. I think it should work now.
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [July 17, 2024, 4:59pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/30 "2024-07-17T16:59:59Z")
So, for gilllab it is similar to what you did for `dyn-o-saur`.
You could test first with this
```nohighlight
sudo certbot certonly --apache --dry-run --cert-name gilllab.dyndns-wiki.com -d gilllab.dyndns-wiki.com -d www.gilllab.dyndns-wiki.com
```
if that works do this
```nohighlight
sudo certbot --apache --cert-name gilllab.dyndns-wiki.com -d gilllab.dyndns-wiki.com -d www.gilllab.dyndns-wiki.com
```
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [July 17, 2024, 6:03pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/31 "2024-07-17T18:03:18Z")
> [@MikeMcQ](#):
>
> So, for gilllab it is similar to what you did for `dyn-o-saur`.
I haven't forgotten about your homelinux domain. Just waiting to see result from gilllab.
I don't want to get too far out in front in case something unusual happens
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 6:58pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/32 "2024-07-17T18:58:01Z")
[gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) and [www.gilllab.dyndns-wiki.com](http://www.gilllab.dyndns-wiki.com) are now fine as is, without creating another certificate. Or, should I combine them still like before?
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [July 17, 2024, 7:43pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/33 "2024-07-17T19:43:46Z")
You should make a single cert that includes both names. Both domain names are handled in the same VirtualHost so you need a cert that includes both.
HTTPS requests to the `www` subdomain are failing now because the cert does not include that name. See
[https://www.ssllabs.com/ssltest/analyze.html?d=www.gilllab.dyndns-wiki.com&hideResults=on](https://www.ssllabs.com/ssltest/analyze.html?d=www.gilllab.dyndns-wiki.com&hideResults=on)
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 9:33pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/34 "2024-07-17T21:33:26Z")
\*:443 is a NameVirtualHost
default server [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab-le-ssl.conf:2)
port 443 namevhost [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab-le-ssl.conf:2)
alias [www.gilllab.dyndns-wiki.com](http://www.gilllab.dyndns-wiki.com)
port 443 namevhost [newstarmotel.homelinux.com](http://newstarmotel.homelinux.com) (/etc/apache2/sites-enabled/homelinux-le-ssl.conf:2)
alias [www.newstarmotel.homelinux.com](http://www.newstarmotel.homelinux.com)
port 443 namevhost [newstarmotel.dyn-o-saur.com](http://newstarmotel.dyn-o-saur.com) (/etc/apache2/sites-enabled/newstarmotel-le-ssl.conf:2)
alias [www.newstarmotel.dyn-o-saur.com](http://www.newstarmotel.dyn-o-saur.com)
port 443 namevhost [nsmrentalproperties.from-ca.com](http://nsmrentalproperties.from-ca.com) (/etc/apache2/sites-enabled/nsmrentalproperties-le-ssl.conf:2)
alias [www.nsmrentalproperties.from-ca.com](http://www.nsmrentalproperties.from-ca.com)
\*:80 is a NameVirtualHost
default server [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab.conf:1)
port 80 namevhost [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab.conf:1)
alias [www.gilllab.dyndns-wiki.com](http://www.gilllab.dyndns-wiki.com)
port 80 namevhost [newstarmotel.homelinux.com](http://newstarmotel.homelinux.com) (/etc/apache2/sites-enabled/homelinux.conf:1)
alias [www.newstarmotel.homelinux.com](http://www.newstarmotel.homelinux.com)
port 80 namevhost [newstarmotel.dyn-o-saur.com](http://newstarmotel.dyn-o-saur.com) (/etc/apache2/sites-enabled/newstarmotel.conf:1)
alias [www.newstarmotel.dyn-o-saur.com](http://www.newstarmotel.dyn-o-saur.com)
port 80 namevhost [nsmrentalproperties.from-ca.com](http://nsmrentalproperties.from-ca.com) (/etc/apache2/sites-enabled/nsmrentalproperties.conf:1)
alias [www.nsmrentalproperties.from-ca.com](http://www.nsmrentalproperties.from-ca.com)
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 9:45pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/35 "2024-07-17T21:45:17Z")
Ok. I combined www domains for [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) and [nsmrentalproperties.from-ca.com](http://nsmrentalproperties.from-ca.com).
VirtualHost configuration:
\*:443 is a NameVirtualHost
default server [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab-le-ssl.conf:2)
port 443 namevhost [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab-le-ssl.conf:2)
alias [www.gilllab.dyndns-wiki.com](http://www.gilllab.dyndns-wiki.com)
port 443 namevhost [newstarmotel.homelinux.com](http://newstarmotel.homelinux.com) (/etc/apache2/sites-enabled/homelinux-le-ssl.conf:2)
alias [www.newstarmotel.homelinux.com](http://www.newstarmotel.homelinux.com)
port 443 namevhost [newstarmotel.dyn-o-saur.com](http://newstarmotel.dyn-o-saur.com) (/etc/apache2/sites-enabled/newstarmotel-le-ssl.conf:2)
alias [www.newstarmotel.dyn-o-saur.com](http://www.newstarmotel.dyn-o-saur.com)
port 443 namevhost [nsmrentalproperties.from-ca.com](http://nsmrentalproperties.from-ca.com) (/etc/apache2/sites-enabled/nsmrentalproperties-le-ssl.conf:2)
alias [www.nsmrentalproperties.from-ca.com](http://www.nsmrentalproperties.from-ca.com)
\*:80 is a NameVirtualHost
default server [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab.conf:1)
port 80 namevhost [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab.conf:1)
alias [www.gilllab.dyndns-wiki.com](http://www.gilllab.dyndns-wiki.com)
port 80 namevhost [newstarmotel.homelinux.com](http://newstarmotel.homelinux.com) (/etc/apache2/sites-enabled/homelinux.conf:1)
alias [www.newstarmotel.homelinux.com](http://www.newstarmotel.homelinux.com)
port 80 namevhost [newstarmotel.dyn-o-saur.com](http://newstarmotel.dyn-o-saur.com) (/etc/apache2/sites-enabled/newstarmotel.conf:1)
alias [www.newstarmotel.dyn-o-saur.com](http://www.newstarmotel.dyn-o-saur.com)
port 80 namevhost [nsmrentalproperties.from-ca.com](http://nsmrentalproperties.from-ca.com) (/etc/apache2/sites-enabled/nsmrentalproperties.conf:1)
alias [www.nsmrentalproperties.from-ca.com](http://www.nsmrentalproperties.from-ca.com)
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [July 17, 2024, 9:54pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/36 "2024-07-17T21:54:41Z")
Excellent. Those two look good.
The homelinux cert can be modified to include both names in the same way.
The difference with this domain is that you have a cert for its `www` subdomain. But, it is not used by Apache for HTTPS requests to that `www` name.
So, once you combine the names into one cert like you did for the others you can probably delete the "extra" one. Could you have used this `www` cert somewhere else? Like copying it to some other server? Or somewhere for a mail server or similar?
I'm guessing it was just a mistake in which case this deletes the local cert files and the Certbot renewal profile for it
```nohighlight
sudo certbot delete --cert-name www.newstarmotel.homelinux.com
```
If you are not sure about this let us know after you get the new cert with both names.
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 10:33pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/37 "2024-07-17T22:33:38Z")
Ok. Done:
\*:443 is a NameVirtualHost
default server [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab-le-ssl.conf:2)
port 443 namevhost [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab-le-ssl.conf:2)
alias [www.gilllab.dyndns-wiki.com](http://www.gilllab.dyndns-wiki.com)
port 443 namevhost [newstarmotel.homelinux.com](http://newstarmotel.homelinux.com) (/etc/apache2/sites-enabled/homelinux-le-ssl.conf:2)
alias [www.newstarmotel.homelinux.com](http://www.newstarmotel.homelinux.com)
port 443 namevhost [newstarmotel.dyn-o-saur.com](http://newstarmotel.dyn-o-saur.com) (/etc/apache2/sites-enabled/newstarmotel-le-ssl.conf:2)
alias [www.newstarmotel.dyn-o-saur.com](http://www.newstarmotel.dyn-o-saur.com)
port 443 namevhost [nsmrentalproperties.from-ca.com](http://nsmrentalproperties.from-ca.com) (/etc/apache2/sites-enabled/nsmrentalproperties-le-ssl.conf:2)
alias [www.nsmrentalproperties.from-ca.com](http://www.nsmrentalproperties.from-ca.com)
\*:80 is a NameVirtualHost
default server [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab.conf:1)
port 80 namevhost [gilllab.dyndns-wiki.com](http://gilllab.dyndns-wiki.com) (/etc/apache2/sites-enabled/gilllab.conf:1)
alias [www.gilllab.dyndns-wiki.com](http://www.gilllab.dyndns-wiki.com)
port 80 namevhost [newstarmotel.homelinux.com](http://newstarmotel.homelinux.com) (/etc/apache2/sites-enabled/homelinux.conf:1)
alias [www.newstarmotel.homelinux.com](http://www.newstarmotel.homelinux.com)
port 80 namevhost [newstarmotel.dyn-o-saur.com](http://newstarmotel.dyn-o-saur.com) (/etc/apache2/sites-enabled/newstarmotel.conf:1)
alias [www.newstarmotel.dyn-o-saur.com](http://www.newstarmotel.dyn-o-saur.com)
port 80 namevhost [nsmrentalproperties.from-ca.com](http://nsmrentalproperties.from-ca.com) (/etc/apache2/sites-enabled/nsmrentalproperties.conf:1)
alias [www.nsmrentalproperties.from-ca.com](http://www.nsmrentalproperties.from-ca.com)
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 10:39pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/38 "2024-07-17T22:39:53Z")
One last question:
This is the command I use to get my certificate for a domain:
> sudo certbot --apache
It gives a list to choose from of virtual hosts (with and without the www). Is there a more direct command for a particular domain?
After that, I will from now on link the corresponding www domain to the certificate obtained from the command above.
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [July 17, 2024, 10:44pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/39 "2024-07-17T22:44:51Z")
If you setup a _new_ VirtualHost with a ServerName and ServerAlias you just do
```nohighlight
sudo certbot --apache -d (domain1) -d (domain2)
```
With a `-d` for each of the names in that VirtualHost (often the base name and www subdomain)
You don't use that format to "renew" an existing cert. You use the "renew" command for that
To test renewal of all your existing cert (profiles) do:
```nohighlight
sudo certbot renew --dry-run
```
or testing renewal of one cert / profile:
```nohighlight
sudo certbot renew --dry-run --cert-name (name)
```
Where (name) comes from the `certbot certificates` list
---
### Author:  [@Tears](https://community.letsencrypt.org/u/Tears)
#### Post date: [July 17, 2024, 11:58pm UTC](https://community.letsencrypt.org/t/certbot-no-longer-works/222025/40 "2024-07-17T23:58:46Z")
I appreciate your time and help, Mike!
[Previous page](https://community.letsencrypt.org/t/certbot-no-longer-works/222025.md?page=1)
[Next page](https://community.letsencrypt.org/t/certbot-no-longer-works/222025.md?page=3)