# Certificate error (date invalid) **URL:** \ **Category:** Help\ **Created:** [October 9, 2023, 5:37pm UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372 "2023-10-09T17:37:01Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![wat](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@wat](https://community.letsencrypt.org/u/wat)\ **Post date:** [October 9, 2023, 5:37pm UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/1 "2023-10-09T17:37:01Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: admin.workandtravel.world I ran this command: It produced this output: My web server is (include version): apache2 and php 8 The operating system my web server runs on is (include version): debian 11.7 My hosting provider, if applicable, is: not the problem I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 1.12.0 the problem is, when i renew a certificate it runs an error date invalid and it says that my certificate is due for renewal, i have checked certbot, and it looks like it is using old certificates in the browser while i manually installed new ones with this command: certbot certonly --manual --preferred-challenges=dns --email [info@universeorange.com](mailto:info@universeorange.com) --server [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory) --agree-tos -d \*.workandtravel.world -d workandtravel.world ---
**Author:** ![wat](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@wat](https://community.letsencrypt.org/u/wat)\ **Post date:** [October 9, 2023, 5:41pm UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/2 "2023-10-09T17:41:04Z")
i had to restart the webserver and run certbot the get back to live, never mind... ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 9, 2023, 6:06pm UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/3 "2023-10-09T18:06:15Z")
> [@wat](#): > > i have checked certbot, and it looks like it is using old certificates in the browser You probably didn't check Certbot. Checking Certbot would be done using the command `sudo certbot certificates` and not using a browser. When using a browser, you're actually just checking Apache. Also, when using the `certonly` subcommand, Apache isn't automatically reloaded. So unless you've set up a `--deploy-hook` with a reload command, you indeed would need to do that manually too. But that's not Certbots fault. ---
**Author:** ![wat](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@wat](https://community.letsencrypt.org/u/wat)\ **Post date:** [October 9, 2023, 7:35pm UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/4 "2023-10-09T19:35:53Z")
well my server (apache2) should restart every night at 1 minute past 12. not implemented yet but a compare of html with a snapshot will keep the server up and running or send an error email. thanks for the certbot certificates command, can it also output it in json format, that would be a nice feature. Do you know how to get the certificates from a headless chrome browser ? with kind regards, Remco van der Velde ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [October 9, 2023, 7:45pm UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/5 "2023-10-09T19:45:54Z")
Can you? ```plaintext openssl s_client -connect admin.workandtravel.world:443 -showcerts ``` You might need to add `-servername admin.workandtravel.world` if your openssl is old. Many examples in google for parsing certs into X509 info ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 9, 2023, 9:06pm UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/6 "2023-10-09T21:06:15Z")
> [@wat](#): > > well my server (apache2) should restart every night at 1 minute past 12 A reload should work better. > [@wat](#): > > certonly That only updates the cert. > [@wat](#): > > --manual That leaves room for improvement - automation is the goal. > [@wat](#): > > certbot 1.12.0 That needs an update. Follow the recommended installation instructions: [Certbot (eff.org)](https://certbot.eff.org/) ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [October 10, 2023, 1:57am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/7 "2023-10-10T01:57:45Z")
Check the system time on both your server and the client machine you are browsing from. Their system time has to be correct, synced with an (internet) time service. ---
**Author:** ![wat](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@wat](https://community.letsencrypt.org/u/wat)\ **Post date:** [October 10, 2023, 6:41am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/8 "2023-10-10T06:41:23Z")
You are right, but currently no time to improve it. I have lets encrypt tasks wat init --restore-lets-encrypt & wat init --backup-lets-encrypt which makes a copy (zip) and restores the zip into lets encrypt directory. if you do it like that, lets encrypt needs improvement too, because the challanges don't have to change everytime because it also stores a session. This isn't working properly yet I am currently on debian 11 and will migrate to debian 12. we are a small team and there is more todo then renew certificates. That i am not automating through your code shouldn't be a problem. why refresh dns challenges so often for example, those can be valid for 5 years ? so the first time is manual and then with a restore (You keep all certificates) you get a new one because you have the previous one and the challenges right... also room to think, automation is the goal ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 10, 2023, 6:44am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/9 "2023-10-10T06:44:28Z")
> [@wat](#): > > the challanges don't have to change everytime That is not possible - the challenges must change with every request. LE doesn't make the rules, it follows them. ---
**Author:** ![wat](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@wat](https://community.letsencrypt.org/u/wat)\ **Post date:** [October 10, 2023, 6:44am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/10 "2023-10-10T06:44:30Z")
If i test the certificates i can only try it 5 times a day and then need to wait 2 days before we get secure again ? My backup / restore got messed up and now its unsecure but working on my machine... is there a way to get new certificates or a setting to test certificates backups for example (I move them to a seperate data directory and wanna backup that stuff so i don't run into issues ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [October 10, 2023, 6:44am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/11 "2023-10-10T06:44:54Z")
> [@wat](#): > > why refresh dns challenges so often The domain you own today could be controlled by someone else tomorrow. The validation process is to confirm you currently control the domain. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 10, 2023, 6:44am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/12 "2023-10-10T06:44:59Z")
> [@wat](#): > > If i test the certificates i can only try it 5 times a day Are you issuing new certs 5 times per day? ---
**Author:** ![wat](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@wat](https://community.letsencrypt.org/u/wat)\ **Post date:** [October 10, 2023, 6:46am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/13 "2023-10-10T06:46:09Z")
testing my backup zip of the certificates, yes... ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 10, 2023, 6:46am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/14 "2023-10-10T06:46:41Z")
> [@wat](#): > > a setting to test certificates backups If you backup the `/etc/letsencrypt/` folder [with symlinks], you should be able to restore it [fully functional]. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 10, 2023, 6:47am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/15 "2023-10-10T06:47:15Z")
> [@wat](#): > > yes... You need to "test" using the testing environment - NOT production. ---
**Author:** ![wat](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@wat](https://community.letsencrypt.org/u/wat)\ **Post date:** [October 10, 2023, 6:47am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/16 "2023-10-10T06:47:41Z")
i tested it, and the certbot renew prompt is not working then, if i put it back with a script (copy the full folder and restore it) ---
**Author:** ![wat](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@wat](https://community.letsencrypt.org/u/wat)\ **Post date:** [October 10, 2023, 6:48am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/17 "2023-10-10T06:48:20Z")
i did not know of a testing environment, i will check that out later ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 10, 2023, 6:48am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/18 "2023-10-10T06:48:24Z")
Please use more words... I don't fully understand what you are saying. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 10, 2023, 6:48am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/19 "2023-10-10T06:48:58Z")
> [@wat](#): > > the certbot renew prompt is not working How? Did it provide an error message? ---
**Author:** ![wat](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@wat](https://community.letsencrypt.org/u/wat)\ **Post date:** [October 10, 2023, 6:51am UTC](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372/20 "2023-10-10T06:51:23Z")
i make a zip of the folder /etc/letsencrypt/ to backup the certificates. i have a `wat init --restore-lets-encrypt` command which restores the files and the symlinks inside /etc/letsencrypt. certbot renew should then work, and the first time is then only manual to setup the encryption. certbot renew is fixing something is says. and then certbot renew isn;t working. So what i am saying is. First time manual dns challenge and then auto-renew / backup / restore should work [Next page](https://community.letsencrypt.org/t/certificate-error-date-invalid/206372.md?page=2)