Certificate expired and cannot get renewed

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: https://bazareh.com

I ran this command: ./init.sh which initializes and deploys a series of commands from docker-compose file.

It produced this output:

Waiting for verification...
bazareh.com
Some challenges have failed.
IMPORTANT NOTES:

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.

Error response from daemon: Container (my nginx container) is restarting, wait until the container is running.

My web server is (include version): nginx

The operating system my web server runs on is (include version): Ubuntu 18.04 LTS

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 0.27.0

with the same configuration my website used to work perfectly for a long time, till I didn't renew the certs manually, with the assumption that it will do automatically. After the certs expired, the nginx container keeps restarting, so that it's not possible to request for the certs. attempts to delete the old nginx container and build a new one as a resolution failed.

2

Hi @Nexept

a working port 80 / http is required. Your port 80 doesn't work. That - https://check-your-website.server-daten.de/?q=bazareh.com - looks like a blocking firewall:

Domainname Http-Status redirect Sec. G
• http://bazareh.com/ 5.9.192.167 -2 1.066 V
ConnectFailure - Unable to connect to the remote server
• http://www.bazareh.com/ 5.9.192.167 -2 1.063 V
ConnectFailure - Unable to connect to the remote server
3

Thanks, but my website was perfectly working with the same configuration till 2 days ago. What I don't understand is that why I cannot somehow get rid of the old cert and ask for new one without problem. The nginx container keeps restarting. I had solved the same problem last time, didn't change any firewall setup, but now cannot remember the course of action i've gone through.

4

Your configuration is buggy, your script is buggy / expired. There are tons of reasons why something has worked - and now not.

Ah - there are some reasons - https://check-your-website.server-daten.de/?q=bazareh.com#ct-logs

Issuer not before not after Domain names LE-Duplicate next LE
Let's Encrypt Authority X3 2020-09-21 2020-12-20 admin.bazareh.com, api.bazareh.com, bazareh.com, blog.bazareh.com, img.bazareh.com, kibana.bazareh.com, pgadmin.bazareh.com, static.bazareh.com, www.bazareh.com, www.blog.bazareh.com
10 entries
Let's Encrypt Authority X3 2020-08-13 2020-11-11 admin.bazareh.com, api.bazareh.com, bazareh.com, blog.bazareh.com, img.bazareh.com, pgadmin.bazareh.com, static.bazareh.com, www.bazareh.com, www.blog.bazareh.com
9 entries
Let's Encrypt Authority X3 2020-08-05 2020-11-03 admin.bazareh.com, api.bazareh.com, bazareh.com, img.bazareh.com, kibana.bazareh.com, pgadmin.bazareh.com, static.bazareh.com, www.bazareh.com
8 entries
Let's Encrypt Authority X3 2020-08-05 2020-11-03 admin.bazareh.com, api.bazareh.com, bazareh.com, img.bazareh.com, kibana.bazareh.com, pgadmin.bazareh.com, static.bazareh.com, www.bazareh.com
8 entries

May be some of these domains don't work.

And that's the old intermediate certificate.

So may be that script doesn't work with the new intermediate certificate.

5

If the certificate is requested inside a container, you should make sure that your public port 80 is forwarded to the container's port 80 when requesting the certificate.

6

Thanks for your reply to this issue. But it hasn't helped. Neither my config nor my script were buggy. Otherwise it couldn't have worked out before. I will explain the steps I've taken to troubleshoot.

7

I went through this problem myself, and I realized there's absolute simple thing I was missing. I just deleted all dangling images, deleted all cetbot related volumes (in which keys and other data are kept) and deleted all containers, then ran docker-compose up and rebuilt the whole thing, and everything now is working perfectly. So, If you have a config in place that actually used to work before your cert expires, you simply need to take all containers and dangling images and cert bot volumes down and delete them, and simply build a new series of container from scratch.

8

That's not a solution, that's a terrible hack.

Certificate creation isn't free, it requires resources. So it's required to use a certificate 60 - 85 days, then create the next.

Deleting all certificates -> you don't understand your configuration, you don't modify it, instead, you start new.

9

yes exactly as i did. It expired and I created a new. I didn't go around and just randomly create a new one. I understand my configuration and I know exactly how to modify it, as I did whenever necessary. These steps are required and aren't terrible hack. The terrible thing is that you've got problem understanding the main issue in the first place just before rushing to answer nonsense and simply insult people.