Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
I ran this command: certbot -v certonly --preferred-challenges=dns -a manual -i nginx --manual-auth-hook /usr/local/bin/certbot-nsd-auth --manual-cleanup-hook /usr/local/bin/certbot-nsd-auth-clean -d p.changeme.fr.eu.org
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for p.changeme.fr.eu.org
Hook '--manual-auth-hook' for p.changeme.fr.eu.org ran with output:
* Reloading config and zone files ... [ ok ]
Hook '--manual-cleanup-hook' for p.changeme.fr.eu.org ran with output:
* Reloading config and zone files ... [ ok ]
An unexpected error occurred:
FileNotFoundError: [Errno 2] No such file or directory: '/etc/letsencrypt/archive/p.changeme.fr.eu.org/privkey2.pem'
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer nginx
Certificate is due for renewal, auto-renewing...
Renewing an existing certificate for p.changeme.fr.eu.org
An unexpected error occurred:
FileExistsError: [Errno 17] File exists: '/etc/letsencrypt/archive/p.changeme.fr.eu.org/privkey3.pem'
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version): nginx 1.26.2
The operating system my web server runs on is (include version): Gentoo Linux
My hosting provider, if applicable, is: self-hosted
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.11.0
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewal configuration file /etc/letsencrypt/renewal/p.changeme.fr.eu.org-0001.conf produced an unexpected error: expected /etc/letsencrypt/live/p.changeme.fr.eu.org-0001/cert.pem to be a symlink. Skipping.
/usr/lib/python3.12/site-packages/certbot/ocsp.py:238: CryptographyDeprecationWarning: Properties that return a naïve datetime object have been deprecated. Please switch to this_update_utc.
if not response_ocsp.this_update:
/usr/lib/python3.12/site-packages/certbot/ocsp.py:240: CryptographyDeprecationWarning: Properties that return a naïve datetime object have been deprecated. Please switch to this_update_utc.
if response_ocsp.this_update > now + timedelta(minutes=5):
/usr/lib/python3.12/site-packages/certbot/ocsp.py:242: CryptographyDeprecationWarning: Properties that return a naïve datetime object have been deprecated. Please switch to next_update_utc.
if response_ocsp.next_update and response_ocsp.next_update < now - timedelta(minutes=5):
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: changeme.fr.eu.org-0001
Serial Number: 3db522d03aca76dcbdd1d65412496b1236f
Key Type: ECDSA
Domains: changeme.fr.eu.org conference.changeme.fr.eu.org xshare.changeme.fr.eu.org
Expiry Date: 2024-05-30 22:00:37+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/changeme.fr.eu.org-0001/fullchain.pem
Private Key Path: /etc/letsencrypt/live/changeme.fr.eu.org-0001/privkey.pem
Certificate Name: changeme.fr.eu.org
Serial Number: 3c26f3c5099b8ff96d74ca1472ae5542b27
Key Type: ECDSA
Domains: changeme.fr.eu.org conference.changeme.fr.eu.org xshare.changeme.fr.eu.org xw.changeme.fr.eu.org
Expiry Date: 2024-11-30 13:25:30+00:00 (VALID: 53 days)
Certificate Path: /etc/letsencrypt/live/changeme.fr.eu.org/fullchain.pem
Private Key Path: /etc/letsencrypt/live/changeme.fr.eu.org/privkey.pem
Certificate Name: m.p.changeme.fr.eu.org
Serial Number: 4b0407c676e9037e8b525e0d3e9ed3b58f4
Key Type: ECDSA
Domains: m.p.changeme.fr.eu.org
Expiry Date: 2024-10-07 20:23:26+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/m.p.changeme.fr.eu.org/fullchain.pem
Private Key Path: /etc/letsencrypt/live/m.p.changeme.fr.eu.org/privkey.pem
Certificate Name: p.changeme.fr.eu.org
Serial Number: 44c1b3b3e4c1075dcb0dcec34eda3cc2b69
Key Type: ECDSA
Domains: p.changeme.fr.eu.org
Expiry Date: 2024-10-07 20:21:09+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/p.changeme.fr.eu.org/fullchain.pem
Private Key Path: /etc/letsencrypt/live/p.changeme.fr.eu.org/privkey.pem
Certificate Name: x.changeme.fr.eu.org
Serial Number: 32983e4949a9322dad0d433cc35bbeb7c21
Key Type: ECDSA
Domains: x.changeme.fr.eu.org xc.changeme.fr.eu.org xs.changeme.fr.eu.org
Expiry Date: 2023-08-29 20:10:04+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/x.changeme.fr.eu.org/fullchain.pem
Private Key Path: /etc/letsencrypt/live/x.changeme.fr.eu.org/privkey.pem
The following renewal configurations were invalid:
/etc/letsencrypt/renewal/p.changeme.fr.eu.org-0001.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Note that x.changeme.fr.eu.org is supposed to be expired.
I think this may be due to me trying to first create a certificate only for p.changeme.fr.eu.org then for both p.changeme.fr.eu.organdm.p.changeme.fr.eu.org, then going back to two certificates.
Similarly, I added some domains to the changeme.fr.eu.org domain name at some point (it’s an XMPP server and needs one certificate for the main domain, plus a few subdomains for file uploads and groups…).
I do use it.
Maybe it switched to -0001 when I added a subdomain then reused the (unused?) other slot when I added xw.changeme.fr.eu.org?
I don’t know if these will also have issues on next renewal, for now I only have issues on p.changeme.fr.eu.org, which used to work I think.
No! Please don't manually alter anything within the /etc/letsencrypt/ folders.
Yes, there is a removal command.
Use certbot for all that is needed.
In this case: certbot delete --cert-name {name-of-cert}
Okay, for p.changeme.fr.eu.org I also had a line saying No certificate found with name p.changeme.fr.eu.org (expected /etc/letsencrypt/renewal/p.changeme.fr.eu.org.conf)., but deleting it and requesting it again seems to have fixed the issue. Thanks!
