Certbot renew fails with IndexError: list index out of range

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: buehl.net

I ran this command: certbot renew

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/nextcloud.buehl.net.conf

Renewing an existing certificate for nextcloud.buehl.net and 4 more domains
Failed to renew certificate nextcloud.buehl.net with error: list index out of range

Processing /etc/letsencrypt/renewal/www2.buehl.net.conf

Renewing an existing certificate for nextcloud.buehl.net and 3 more domains
Failed to renew certificate www2.buehl.net with error: list index out of range

All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/nextcloud.buehl.net/fullchain.pem (failure)
/etc/letsencrypt/live/www2.buehl.net/fullchain.pem (failure)

2 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): nginx 1.26.3-3+deb13u7

The operating system my web server runs on is (include version): Debian 13 Trixie

My hosting provider, if applicable, is: Hetzner

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 4.0.0

The problem started after upgrading Debian from 12 (bookworm) to 13 trixie.

2

If memory serves, certbot 4.0 had a bug where it would show that error instead of the real error from the server. You probably need to upgrade certbot (beyond the version that's in your OS's package manager) and/or look deeper in the log files to see the underlying problem.

3

With some debug output I managed to trace the parser error down to a missing ; in a server_name directive that was accepted by nginx but had the certbot parser trip over.
After correcting this, I got a different error that I seemed to come from a server block for port 80 that an older version of certbot had created. After rewriting this block to a more common notation, certbot renew started to work again.