# Certbot renew - symlink fail error **URL:** \ **Category:** Help\ **Created:** [March 30, 2021, 9:25am UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611 "2021-03-30T09:25:08Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 9:25am UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/1 "2021-03-30T09:25:08Z")
Please advise , my ssl is going to expire by tommorrow. I tried to renew my ssl cert, using certbot renew command , it returns error ""expected {0} to be a symlink".format(link)) certbot.errors.CertStorageError: expected /etc/letsencrypt/live/sprigsys.com/cert.pem to be a symlink Renewal configuration file /etc/letsencrypt/renewal/sprigsys.com.conf is broken. Skipping. Error message Traceback (most recent call last): File "/usr/lib/python3/dist-packages/certbot/renewal.py", line 68, in \_reconstitute renewal\_candidate = storage.RenewableCert(full\_path, config) File "/usr/lib/python3/dist-packages/certbot/storage.py", line 463, in **init** self.\_check\_symlinks() File "/usr/lib/python3/dist-packages/certbot/storage.py", line 522, in \_check\_symlinks "expected {0} to be a symlink".format(link)) certbot.errors.CertStorageError: expected /etc/letsencrypt/live/sprigsys.com/cert.pem to be a symlink Renewal configuration file /etc/letsencrypt/renewal/sprigsys.com.conf is broken. Skipping. My domain is: [sprigsys.com](http://sprigsys.com) I ran this command: certbot renew also tried certbot update\_symlinks It produced this output: error "expected {0} to be a symlink".format(link)) certbot.errors.CertStorageError: expected /etc/letsencrypt/live/sprigsys.com/cert.pem to be a symlink Renewal configuration file /etc/letsencrypt/renewal/sprigsys.com.conf is broken. Skipping. My web server is (include version): NGNIX (docker container) The operating system my web server runs on is (include version):linux The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 0.31.0 Tree output: tree /etc/letsencrypt /etc/letsencrypt ├── accounts │ └── [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org) │ └── directory │ └── f9bc1df3fa5ee6536ee78c1ef68babe4 │ ├── meta.json │ ├── private\_key.json │ └── regr.json ├── archive │ └── [sprigsys.com](http://sprigsys.com) │ ├── cert1.pem │ ├── chain1.pem │ ├── fullchain1.pem │ └── privkey1.pem ├── cli.ini ├── csr │ ├── 0000\_csr-certbot.pem │ ├── 0001\_csr-certbot.pem │ ├── 0002\_csr-certbot.pem │ ├── 0003\_csr-certbot.pem │ ├── 0004\_csr-certbot.pem │ ├── 0005\_csr-certbot.pem │ ├── 0006\_csr-certbot.pem │ ├── 0007\_csr-certbot.pem │ ├── 0008\_csr-certbot.pem │ ├── 0009\_csr-certbot.pem │ ├── 0010\_csr-certbot.pem │ ├── 0011\_csr-certbot.pem │ ├── 0012\_csr-certbot.pem │ ├── 0013\_csr-certbot.pem │ ├── 0014\_csr-certbot.pem │ ├── 0015\_csr-certbot.pem │ ├── 0016\_csr-certbot.pem │ └── 0017\_csr-certbot.pem ├── keys │ ├── 0000\_key-certbot.pem │ ├── 0001\_key-certbot.pem │ ├── 0002\_key-certbot.pem │ ├── 0003\_key-certbot.pem │ ├── 0004\_key-certbot.pem │ ├── 0005\_key-certbot.pem │ ├── 0006\_key-certbot.pem │ ├── 0007\_key-certbot.pem │ ├── 0008\_key-certbot.pem │ ├── 0009\_key-certbot.pem │ ├── 0010\_key-certbot.pem │ ├── 0011\_key-certbot.pem │ ├── 0012\_key-certbot.pem │ ├── 0013\_key-certbot.pem │ ├── 0014\_key-certbot.pem │ ├── 0015\_key-certbot.pem │ ├── 0016\_key-certbot.pem │ └── 0017\_key-certbot.pem ├── live │ └── [sprigsys.com](http://sprigsys.com) │ ├── README │ ├── cert.pem │ ├── chain.pem │ ├── fullchain.pem │ └── privkey.pem ├── renewal │ └── sprigsys.com.conf └── renewal-hooks ├── deploy ├── post └── pre FULL ERROR Message $ sudo certbot renew Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * Processing /etc/letsencrypt/renewal/sprigsys.com.conf * * * Traceback (most recent call last): File "/usr/lib/python3/dist-packages/certbot/renewal.py", line 68, in \_reconstitute renewal\_candidate = storage.RenewableCert(full\_path, config) File "/usr/lib/python3/dist-packages/certbot/storage.py", line 463, in **init** self.\_check\_symlinks() File "/usr/lib/python3/dist-packages/certbot/storage.py", line 522, in \_check\_symlinks "expected {0} to be a symlink".format(link)) certbot.errors.CertStorageError: expected /etc/letsencrypt/live/sprigsys.com/cert.pem to be a symlink Renewal configuration file /etc/letsencrypt/renewal/sprigsys.com.conf is broken. Skipping. * * * No renewals were attempted. Additionally, the following renewal configurations were invalid: /etc/letsencrypt/renewal/sprigsys.com.conf (parsefail) * * * 0 renew failure(s), 1 parse failure(s) $ ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [March 30, 2021, 12:56pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/2 "2021-03-30T12:56:45Z")
Welcome to the Let's Encrypt Community, Amit 🙂 Please run: `sudo certbot update_symlinks` then try to renew again. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [March 30, 2021, 12:59pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/3 "2021-03-30T12:59:45Z")
Hi @Amit > [@Amit](#): > > Please advise , my ssl is going to expire by tommorrow. > > I tried to renew my ssl cert, using certbot renew command , it returns error ""expected {0} to be a symlink".format(link)) your question has your complete answer. You have changed these files manual (that's wrong), so you have created that error. Undo that. If you don't know how: Your system has a documentation - use it. ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 1:42pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/4 "2021-03-30T13:42:52Z")
> [@griffin](#): > > sudo certbot update\_symlinks Tried it , no luck... $ sudo certbot update\_symlinks Saving debug log to /var/log/letsencrypt/letsencrypt.log Expected /etc/letsencrypt/live/sprigsys.com/privkey.pem to be a symlink ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 1:44pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/5 "2021-03-30T13:44:41Z")
@JuergenAuer - Please note i am too new to this, any help from your end will save my life... May be later we can look at the cause of it.... ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 1:55pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/6 "2021-03-30T13:55:36Z")
@JuergenAuer @griffin Have made some progress... Here is the latest error, little guidance from your end will save my life... $ sudo certbot renew Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * Processing /etc/letsencrypt/renewal/sprigsys.com.conf * * * Cert is due for renewal, auto-renewing... Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration. The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.') Attempting to renew cert ([sprigsys.com](http://sprigsys.com)) from /etc/letsencrypt/renewal/sprigsys.com.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration. The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.'). Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/sprigsys.com/fullchain.pem (failure) * * * All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/sprigsys.com/fullchain.pem (failure) * * * 1 renew failure(s), 0 parse failure(s) ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 30, 2021, 1:56pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/7 "2021-03-30T13:56:07Z")
> [@Amit](#): > > any help from your end will save my life The files in `/live/sprigsys.com/` should be symbolic links to the most recent and corresponding files in `../../archive/sprigsys.com/`. What's the output of `ls -l /etc/letsencrypt/live/sprigsys.com/` ? ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 1:57pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/8 "2021-03-30T13:57:47Z")
> [@Osiris](#): > > /etc/letsencrypt/live/sprigsys.com/ $ cd /etc/letsencrypt/live/sprigsys.com/ $ ls -l total 4 -rw-r--r-- 1 root root 740 Jan 2 15:56 README lrwxrwxrwx 1 root root 36 Mar 30 19:11 cert.pem -\> ../../archive/sprigsys.com/cert1.pem lrwxrwxrwx 1 naveen naveen 37 Mar 30 19:20 chain.pem -\> ../../archive/sprigsys.com/chain1.pem lrwxrwxrwx 1 naveen naveen 41 Mar 30 19:21 fullchain.pem -\> ../../archive/sprigsys.com/fullchain1.pem lrwxrwxrwx 1 naveen naveen 39 Mar 30 19:22 privkey.pem -\> ../../archive/sprigsys.com/privkey1.pem ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 30, 2021, 2:03pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/9 "2021-03-30T14:03:34Z")
> [@Amit](#): > > lrwxrwxrwx 1 naveen naveen On my system everything is owned by root. Could this be the issue? Although I would think root can access the file(s), even if it's owned by a different user.. As it's root we're talking about. What's the output of `ls -l /etc/letsencrypt/archive/sprigsys.com/` ? To see the owner. Note that the _contents_ of `privkey.pem` should be kept safe, but `ls -l` can't hurt 🙂 ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 2:05pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/10 "2021-03-30T14:05:35Z")
> [@Osiris](#): > > `/etc/letsencrypt/archive/sprigsys.com/` Here is the output: $ cd /etc/letsencrypt/archive/sprigsys.com/ $ ls -l total 16 -rw-r--r-- 1 root root 1858 Mar 30 18:25 cert1.pem -rw-r--r-- 1 root root 1586 Mar 30 18:25 chain1.pem -rw-r--r-- 1 root root 3444 Mar 30 18:25 fullchain1.pem -rwxrwxrwx 1 root root 1704 Mar 30 18:25 privkey1.pem ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [March 30, 2021, 2:07pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/11 "2021-03-30T14:07:31Z")
> [@Amit](#): > > Please note i am too new to this Then you should **never** change such files manual. And you should **always** create a backup before changing things. ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 2:11pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/12 "2021-03-30T14:11:46Z")
@JuergenAuer - Noted, by the way it was done by a ex employee and I am unlucky fellow who is assigned to clean it up. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 30, 2021, 2:11pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/13 "2021-03-30T14:11:57Z")
> [@Amit](#): > > Here is the output: Although the permissions of privkey1.pem are a little bit weird, I don't see anything why certbot would need to complain about it? ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 2:13pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/14 "2021-03-30T14:13:21Z")
@JuergenAuer Any suggestions from your much appreciated. ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 2:15pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/15 "2021-03-30T14:15:36Z")
@Osiris What do you suggest in this case? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 30, 2021, 2:15pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/16 "2021-03-30T14:15:45Z")
You could try to re-do the symbolic links manually: ```nohighlight cd /etc/letsencrypt/live/sprigsys.com/ rm *.pem ln -s ../../archive/sprigsys.com/cert1.pem cert.pem ln -s ../../archive/sprigsys.com/chain1.pem chain.pem ln -s ../../archive/sprigsys.com/fullchain1.pem fullchain.pem ln -s ../../archive/sprigsys.com/privkey1.pem privkey.pem ``` ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 2:30pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/17 "2021-03-30T14:30:17Z")
@Osiris 1. I have already tried the manual linking step already. 2. Do you think it's a certbot BUG?? 3. Here is the conf file, hope this helps you to provide the expert opinion. ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/4/0/402c3c9892515b4dbad0c9cc9ad092259637d24f.png) ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 30, 2021, 2:39pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/18 "2021-03-30T14:39:35Z")
> [@Amit](#): > > - Do you think it's a certbot BUG?? Probably not, but version 0.31.0 is quite old, so to exclude a bug in an older version you might want to update to a newer version (which probably requires installing `snap`). > [@Amit](#): > > Here is the conf file, hope this helps you to provide the expert opinion. Nothing strange there unfortunately. If I had this issue, I'd probably dive into the certbot source code and debug it from the code directly. However, that's quite difficult without Python and/or Linux experience I'm afraid. ---
**Author:** ![Amit](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@Amit](https://community.letsencrypt.org/u/Amit)\ **Post date:** [March 30, 2021, 2:41pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/19 "2021-03-30T14:41:54Z")
@Osiris What's your suggestion? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 30, 2021, 3:28pm UTC](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611/20 "2021-03-30T15:28:07Z")
> [@Amit](#): > > What's your suggestion? As a last resort, you could always back up the `/live/`, `/archive/` and `/renewal/` directory (just in case) and remove those directories from `/etc/letsencrypt/` and start over. [Next page](https://community.letsencrypt.org/t/certbot-renew-symlink-fail-error/148611.md?page=2)