# Certbot Plopping Renewals into / **URL:** \ **Category:** Help\ **Created:** [August 22, 2018, 4:23pm UTC](https://community.letsencrypt.org/t/certbot-plopping-renewals-into/70205 "2018-08-22T16:23:24Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Quantum](https://avatars.discourse-cdn.com/v4/letter/q/b9e5f3/32.png) [@Quantum](https://community.letsencrypt.org/u/Quantum)\ **Post date:** [August 22, 2018, 4:23pm UTC](https://community.letsencrypt.org/t/certbot-plopping-renewals-into/70205/1 "2018-08-22T16:23:24Z")
My domain is: > [delphi-real-estate.com](http://delphi-real-estate.com) I ran this command: > certbot certonly --standalone --agree-tos --email colony.three@protonmail.ch --renew-by-default --domains [delphi-real-estate.com](http://delphi-real-estate.com) --csr /etc/letsencrypt/csr-delphi-real-estate.com.csr --keep It produced this output: > Aug 22 09:03:46 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: + certbot certonly --standalone --agree-tos --email colony.three@protonmail.ch --renew-by-default --domains [delphi-real-estate.com](http://delphi-real-estate.com) --csr /etc/letsencrypt/csr-delphi-real-estate.com.csr --keep > Aug 22 09:03:46 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Saving debug log to /var/log/letsencrypt/letsencrypt.log > Aug 22 09:03:47 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Plugins selected: Authenticator standalone, Installer None > Aug 22 09:03:47 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Starting new HTTPS connection (1): [acme-v01.api.letsencrypt.org](http://acme-v01.api.letsencrypt.org) > Aug 22 09:03:49 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Performing the following challenges: > Aug 22 09:03:49 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: tls-sni-01 challenge for [delphi-real-estate.com](http://delphi-real-estate.com) > Aug 22 09:03:49 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: tls-sni-01 challenge for [www.delphi-real-estate.com](http://www.delphi-real-estate.com) > Aug 22 09:03:49 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Waiting for verification... > Aug 22 09:03:53 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Cleaning up challenges > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Server issued certificate; certificate written to /0002\_cert.pem > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Cert chain written to > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Cert chain written to > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: IMPORTANT NOTES: > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: - Congratulations! Your certificate and chain have been saved at: > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: /0005\_chain.pem > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Your cert will expire on 2018-11-20. To obtain a new or tweaked > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: version of this certificate in the future, simply run certbot > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: again. To non-interactively renew _all_ of your certificates, run > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: "certbot renew" > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: - If you like Certbot, please consider supporting our work by: > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Donating to ISRG / Let's Encrypt: [Donate - Let's Encrypt](https://letsencrypt.org/donate) > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: Donating to EFF: [Support EFF's Work on Let's Encrypt | Electronic Frontier Foundation](https://eff.org/donate-le) > Aug 22 09:03:55 [quantum.darkmatter.org](http://quantum.darkmatter.org) letsencrypt-renew[2075]: + '[' '!' -f -o '!' -f -o '!' -f ']' My web server is (include version): > httpd > Version : 2.4.6 > Release : 80.el7.centos.1 > Architecture: x86\_64 The operating system my web server runs on is (include version): > CentOS v7.5 I can login to a root shell on my machine (yes or no, or I don't know): > Yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): > No What would possess certbot to plop my renewed certs in /, with all the wrong names and no symlinks? Just barely got my renewal script running, and then finally got my systemd timer working but now this weird behavior. I am so close... ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [August 22, 2018, 4:31pm UTC](https://community.letsencrypt.org/t/certbot-plopping-renewals-into/70205/2 "2018-08-22T16:31:00Z")
> [@Quantum](#): > > --csr /etc/letsencrypt/csr-delphi-real-estate.com.csr > [@Quantum](#): > > What would possess certbot to plop my renewed certs in /, with all the wrong names and no symlinks? When you use the `--csr` option, it puts the files in the current directory and doesn't set up symlinks or automatic renewal. In the timer, the current directory must be `/`. Would it be practical to stop using `--csr`? Recent versions of Certbot have a `--reuse-key` option. ---
**Author:** ![jared.m](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jared.m/32/17871_2.png) [@jared.m](https://community.letsencrypt.org/u/jared.m)\ **Post date:** [August 22, 2018, 4:33pm UTC](https://community.letsencrypt.org/t/certbot-plopping-renewals-into/70205/3 "2018-08-22T16:33:00Z")
The `--csr` option causes _a lot_ of Certbot functions to behave differently. Usually, if you can avoid this, it’s a good idea to do so. ---
**Author:** ![Quantum](https://avatars.discourse-cdn.com/v4/letter/q/b9e5f3/32.png) [@Quantum](https://community.letsencrypt.org/u/Quantum)\ **Post date:** [August 22, 2018, 4:51pm UTC](https://community.letsencrypt.org/t/certbot-plopping-renewals-into/70205/4 "2018-08-22T16:51:21Z")
Yikes, there's a --reuse-key now? No more need for a .csr? Do I need to stop Apache? Do I dare run this with the corrected command even though I've just gotten a set of certs? > certbot certonly --standalone --agree-tos --email colony.three@protonmail.ch --renew-by-default --domains [delphi-real-estate.com](http://delphi-real-estate.com) --reuse-key --keep Also something seems to be wrong with my failure email function: > if [! -f ${FULLCHAIN} -o ! -f ${CHAIN} -o ! -f ${CERT}]; then > cat ${OUT} | mail -s "TLS Cert Update Fail for [delphi-real-estate.com](http://delphi-real-estate.com)" [postmaster@delphi-real-estate.com](mailto:postmaster@delphi-real-estate.com) > fi "/usr/local/bin/letsencrypt-renew: line 28: [: too many arguments" ---
**Author:** ![Quantum](https://avatars.discourse-cdn.com/v4/letter/q/b9e5f3/32.png) [@Quantum](https://community.letsencrypt.org/u/Quantum)\ **Post date:** [August 22, 2018, 6:30pm UTC](https://community.letsencrypt.org/t/certbot-plopping-renewals-into/70205/5 "2018-08-22T18:30:06Z")
In desperation I went ahead and ran it. This time it seems to have worked but put the new certs in delphi-real-estate.com-0001 instead of [delphi-real-estate.com](http://delphi-real-estate.com) . So nothing can find them now. How do I set httpd and postfix to account for this incrementing directory structure? ---
**Author:** ![jmorahan](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jmorahan/32/1873_2.png) [@jmorahan](https://community.letsencrypt.org/u/jmorahan)\ **Post date:** [August 22, 2018, 9:28pm UTC](https://community.letsencrypt.org/t/certbot-plopping-renewals-into/70205/6 "2018-08-22T21:28:45Z")
The -0001 usually means you used a different set of (sub)domains… try `certbot certificates` to see what domains were on the original certificate. If you use the same set of domains it should put the cert in the same place. If you really want to replace the existing certificate with a new one with different set of domains, you can use the `--cert-name` option to force it to use a particular subdirectory. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 21, 2018, 9:29pm UTC](https://community.letsencrypt.org/t/certbot-plopping-renewals-into/70205/7 "2018-09-21T21:29:00Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.