Certbot SSL Renewal - same expiration date

AVD · January 26, 2023, 3:36am

Thanks rg305.

#1 - I will check the jobs, but this server is behind a router and port 80 is NOT forwarded to it so any requests sent to it currently will fail. I only open the port when needed to renew.

#3 - No, the two servers can't talk to each other and don't know about each other.

#4 - It is my understanding the "installation" is a combination of certificates concatenated together:

cat mydomain.crt intermediate.crt root.crt >> ssl-bundle.crt

Or something to that affect. I tried it manually once when setting up this server back in July, 2022 before setting up Let's Encrypt. So, I was thinking, since the certificate setup on my server isn't quite right I would just do it manually with the already issued certificate; if I could find a step-by-step plan to make sure I get it right.

Thanks.

MikeMcQ · January 26, 2023, 3:45am

No. Certbot creates cert.pem, chain.pem, fullchain.pem, and privkey.pem. Usually you just use fullchain.pem and privkey.pem although in some obscure servers you do odd combinations. If you let us know what mail server you are running we might be able to advise.

Have you tried running sudo certbot certificates ?
That will rule out your symlink errors being due to permissions. But, your comment makes me believe you corrupted the certbot files unintentionally.

rg305 · January 26, 2023, 4:01am

Do you have notes from that install?

AVD · January 26, 2023, 4:51am

rg305 - I might have some notes, I can check. However; I deleted everything to do with the SSL back then and then installed certbot and followed steps I thought were valid to create the certificate which worked the first and second time, but this third time something happened but I don't know what.

MikeMcQ - I ran the command "sudo certbot certificates" and still have the same errors:

Renewal configuration file /etc/letsencrypt/renewal/mail.allanimals.info-0001.conf produced an unexpected error: expected /etc/letsencrypt/live/mail.allanimals.info-0001/cert.pem to be a symlink. Skipping.

Renewal configuration file /etc/letsencrypt/renewal/mail.allanimals.info.conf produced an unexpected error: target /etc/letsencrypt/archive/mail.allanimals.info-0001/cert1.pem of symlink /etc/letsencrypt/live/mail.allanimals.info/cert.pem does not exist. Skipping.

If I can fix it, great, or I can rename the letsencrypt directory and grab a new certificate.

Here is the procedure I had used to get a new certificate the last two times. Somehow I did not know about the "certbot renew" and the second time the certbot renew did not run automatically so I used the --force-renewal option, which worked, which is why I tried it again this time.

I am running on Ubuntu Server 20.04

====================
Need to specify RSA key only - email server must have RSA key for now

sudo certbot certonly --force-renewal --key-type rsa --preferred-chain "ISRG Root X1"
sudo cp /etc/letsencrypt/live/mail.allanimals.info/privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
sudo chown zimbra:zimbra /opt/zimbra/ssl/zimbra/commercial/commercial.key
sudo wget -O /tmp/ISRG-X1.pem https://letsencrypt.org/certs/isrgrootx1.pem.txt
sudo cat /tmp/ISRG-X1.pem >> /etc/letsencrypt/live/mail.allanimals.info/chain.pem
sudo cp /etc/letsencrypt/live/mail.allanimals.info/* /opt/zimbra/ssl/letsencrypt/
sudo chown zimbra:zimbra /opt/zimbra/ssl/letsencrypt/*
sudo /opt/zimbra/libexec/zmfixperms
** change to zimbra admin **
cd ~
/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /opt/zimbra/ssl/letsencrypt/cert.pem /opt/zimbra/ssl/letsencrypt/chain.pem
/opt/zimbra/bin/zmcertmgr deploycrt comm /opt/zimbra/ssl/letsencrypt/cert.pem /opt/zimbra/ssl/letsencrypt/chain.pem
zmcontrol restart
Done, verify

==================
As I said above, this may be wrong, but it has worked fine, no errors, twice over the past 6 months and I only do it manually, NOT automatically.

I appreciate the insight and knowledge from your experience. Thanks.

rg305 · January 26, 2023, 6:07am

Please remove that from your command/script.

We are here to help with that.
To that end, let's start with:
ls -l /etc/letsencrypt/archive/mail.allanimals.info-0001/

AVD · January 26, 2023, 7:12am

I appreciate that.

===================
-rw-r--r-- 1 root root 1858 Oct 30 14:28 cert1.pem
-rw-r--r-- 1 root root 3765 Oct 30 14:48 chain1.pem
-rw-r--r-- 1 root root 3684 Oct 30 14:28 fullchain1.pem
-rw------- 1 root root 1704 Oct 30 14:28 privkey1.pem

rg305 · January 26, 2023, 7:16am

That's strange...
It said the cert1.pem did not exist there:

Show:
ls -l /etc/letsencrypt/live/mail.allanimals.info-0001/

AVD · January 26, 2023, 8:08am

There is nothing in that directory.

There is the original directory mail.allanimals.info, which has:

lrwxrwxrwx 1 root root  49 Jan 15 09:27 cert.pem -> ../../archive/mail.allanimals.info-0001/cert1.pem
lrwxrwxrwx 1 root root  50 Jan 15 09:27 chain.pem -> ../../archive/mail.allanimals.info-0001/chain1.pem
lrwxrwxrwx 1 root root  54 Jan 15 09:27 fullchain.pem -> ../../archive/mail.allanimals.info-0001/fullchain1.pem
lrwxrwxrwx 1 root root  52 Jan 15 09:27 privkey.pem -> ../../archive/mail.allanimals.info-0001/privkey1.pem
-rw-r--r-- 1 root root 692 Oct 30 14:28 README

Maybe I should mv/cp those files into the 0001?

rg305 · January 26, 2023, 8:08am

Negative.

AVD · January 26, 2023, 8:09am

/etc/letsencrypt/live# ls

mail.allanimals.info mail.allanimals.info-0001 README

rg305 · January 26, 2023, 8:11am

Show:
cat /etc/letsencrypt/live/mail.allanimals.info-0001/cert.pem

How old is the hard drive?
Is it rather full?

AVD · January 26, 2023, 8:13am

New hard drive, not full.
No files in 0001, but the file you asked about in the other directory is:

rg305 · January 26, 2023, 8:25am

That output contradicts:

You showed it does exist.

All we can do is...
If you don't need the -0001 cert, we can remove all trace of it and move on as if it never happened.
[I don't like not knowing what went wrong - and I would suspecet that it could happen again]
But that is your call.
You can back up the entire /etc/letsencrypt/ if you like before we do anything [to be extra safe].

AVD · January 26, 2023, 8:26am

For this situation, I am ok with moving on. I can just rename the directory just in case we need it.

rg305 · January 26, 2023, 8:27am

I'm confused.
Did you show only the -0001 directories/files OR did you mix them up?

rg305 · January 26, 2023, 8:28am

You really need to just follow directions.
I don't know what you've shown now.

I do apologize if I'm not reading your posts thoroughly [enough].
But this is something I'm not being paid to do and I'm trying to squeeze it in while doing seven other things.

So, I really need you to just give me what I ask of you.

AVD · January 26, 2023, 8:31am

I appreciate the time and help you are taking. As I said, 0001 has no files at all, nothing to show.

rg305 · January 26, 2023, 8:31am

Let's go for broke:
ls -lr /etc/letsencrypt/live/
AND
ls -lr /etc/letsencrypt/archive/

AVD · January 26, 2023, 8:31am

In the live folder, archive DOES have files.

rg305 · January 26, 2023, 8:32am

PLEASE PLEASE PLEASE
Just fill the request.