Certbot not renewing certificates, timing out on challenges

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: westconn.com.au

I ran this command: certbot renew

It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/westconn.com.au.conf

Cert is due for renewal, auto-renewing...
Non-interactive renewal: random delay of 366.726563028 seconds
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate for westconn.com.au and 2 more domains
Performing the following challenges:
http-01 challenge for ph.westconn.com.au
http-01 challenge for westconn.com.au
http-01 challenge for www.westconn.com.au
Using the webroot path /home/ph for all unmatched domains.
Waiting for verification...
Challenge failed for domain ph.westconn.com.au
Challenge failed for domain westconn.com.au
Challenge failed for domain www.westconn.com.au
http-01 challenge for ph.westconn.com.au
http-01 challenge for westconn.com.au
http-01 challenge for www.westconn.com.au
Cleaning up challenges
Failed to renew certificate westconn.com.au with error: Some challenges have failed.

All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/westconn.com.au/fullchain.pem (failure)

1 renew failure(s), 0 parse failure(s)
IMPORTANT NOTES:

My web server is (include version): Apache version 2.4.6

The operating system my web server runs on is (include version): CentOS Linux 7.9.2009 (EOL reached)

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): webmin

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.11.0

After many attempts I have now been able to renew my certificates by turning off redirect for the required virtual domains,

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/westconn.com.au.conf

Cert is due for renewal, auto-renewing...
Non-interactive renewal: random delay of 92.9884762855 seconds
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate for westconn.com.au and 2 more domains
Performing the following challenges:
http-01 challenge for ph.westconn.com.au
http-01 challenge for westconn.com.au
http-01 challenge for www.westconn.com.au
Using the webroot path /home/ph for all unmatched domains.
Waiting for verification...
Cleaning up challenges

new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/westconn.com.au/fullchain.pem

Congratulations, all renewals succeeded:
/etc/letsencrypt/live/westconn.com.au/fullchain.pem (success)

For future it would be better to get a solution that will auto update certificates, reading in the forums seem to indicate the problem is caused elsewhere

My redirects were set in the apache configuration

<VirtualHost *:80>
    DocumentRoot /var/www/html
    ServerName www.westconn.com.au
    <Directory "/var/www/html">
        allow from all
        Redirect / https://westconn.com.au/
        Options None
        Require all granted
    </Directory>
</VirtualHost>

Currently it appears that the website has not been working since the certificates expired and is still not loading pages, which is currently of little importance, but also some of the email clients are not working, as we are trying to migrate all to ssl, that is of more importance

2

That's because your server is accessible over HTTP port 80, but for some reason HTTPS port 443 is being blocked.

3 Likes
3

so easy when I am looking for the problem at the right port
thank you

2 Likes