# Certificate expired and renew not working **URL:** \ **Category:** Help\ **Created:** [June 24, 2018, 2:59pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108 "2018-06-24T14:59:56Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![messerbill](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@messerbill](https://community.letsencrypt.org/u/messerbill)\ **Post date:** [June 24, 2018, 2:59pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/1 "2018-06-24T14:59:56Z")
Hi at all, due to i am very nooby in point of server hosting i sadly was not able to fix this issue even there are a lot of quite similar posts here on the board…My certificate is expired and now i tried the following: My domain is: [https://www.entwicklercouch.de](https://www.entwicklercouch.de) I ran this command: certbot renew / sudo certbot renew It produced this output: ``` # certbot renew ``` Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * ## Processing /etc/letsencrypt/renewal/www.entwicklercouch.de.conf Cert is due for renewal, auto-renewing… Starting new HTTPS connection (1): [acme-v01.api.letsencrypt.org](http://acme-v01.api.letsencrypt.org) Renewing an existing certificate Performing the following challenges: http-01 challenge for [www.entwicklercouch.de](http://www.entwicklercouch.de) http-01 challenge for [entwicklercouch.de](http://entwicklercouch.de) Waiting for verification… Cleaning up challenges Attempting to renew cert from /etc/letsencrypt/renewal/www.entwicklercouch.de.conf produced an unexpected error: Failed authorization procedure. [www.entwicklercouch.de](http://www.entwicklercouch.de) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [http://www.entwicklercouch.de/.well-known/acme-challenge/LIKpwcfRsWfAlyOgtX33JtnWL6-4h-DIvhLxaekP06k:](http://www.entwicklercouch.de/.well-known/acme-challenge/LIKpwcfRsWfAlyOgtX33JtnWL6-4h-DIvhLxaekP06k:) Connection refused, [entwicklercouch.de](http://entwicklercouch.de) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [http://entwicklercouch.de/.well-known/acme-challenge/nKCb7Jd3La5gClevMSGkQum9U0dhb2VcPFaq2zttiQw:](http://entwicklercouch.de/.well-known/acme-challenge/nKCb7Jd3La5gClevMSGkQum9U0dhb2VcPFaq2zttiQw:) Connection refused. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/www.entwicklercouch.de/fullchain.pem (failure) 1 renew failure(s), 0 parse failure(s) IMPORTANT NOTES: - The following errors were reported by the server: My web server is (include version): Debian 8.5 64Bit My hosting provider, if applicable, is: ZAP Hosting I can login to a root shell on my machine (yes or no, or I don’t know): yes And here is my nginx config: ``` server { listen 80 default_server; listen [::]:80 default_server; server_name entwicklercouch.de www.entwicklercouch.de; return 301 https://$server_name$request_uri; } server { # SSL configuration # listen 443 ssl default_server; listen [::]:443 ssl default_server; include snippets/ssl-entwicklercouch.de.conf; include snippets/ssl-params.conf; access_log /root/log/nginx/entwicklercouch.de.log; # Self signed certs generated by the ssl-cert package # Don't use them in a production server! # # include snippets/snakeoil.conf; # Add index.php to the list if you are using PHP location ~ /.well-known { allow all; } location /sockettest/ { root /root/webserver/sockettest; index index.html index.htm; } location /alexa-api/ { proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_set_header X-Real-IP $remote_addr; proxy_http_version 1.1; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_pass http://localhost:3000; } location /alexa-skill/ { proxy_pass http://localhost:3009; } location /bamboo/ { proxy_pass http://localhost:8085; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_redirect off; } location / { proxy_pass http://localhost:8080; root /root/webserver/app/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; } ``` Please help me with this ☹ i really have no idea what i am doing wrong ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [June 24, 2018, 3:09pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/2 "2018-06-24T15:09:53Z")
Hi @messerbill > [@messerbill](#): > > Failed authorization procedure. [www.entwicklercouch.de](http://www.entwicklercouch.de) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [Die etwas andere Domain Börse](http://www.entwicklercouch.de/.well-known/acme-challenge/LIKpwcfRsWfAlyOgtX33JtnWL6-4h-DIvhLxaekP06k:) Connection refused is there a firewall or something else? Port 80 doesn't work. > This site can’t be reached > [www.entwicklercouch.de](http://www.entwicklercouch.de) refused to connect. Port 80 must be open. Actual, there is a self signed certificate, not an older letsencrypt-certificate. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [June 24, 2018, 3:10pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/3 "2018-06-24T15:10:31Z")
Is nginx running at all? Because most of the time, when some port (in this case 80) is _filtered_ by a firewall, the client would get a time out (because all packets are silently dropped). However, in your case, your server replies to the client with an “active” “go away” kind of signal, causing the “connection refused” error. And with the tip of @JuergenAuer above: what is actually running on port 443? Because it doesn’t seem to be the nginx configuration you’ve posted here. ---
**Author:** ![messerbill](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@messerbill](https://community.letsencrypt.org/u/messerbill)\ **Post date:** [June 24, 2018, 3:19pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/4 "2018-06-24T15:19:36Z")
Hi, thanks for the fast reply. Maybe nginx really is not working: > systemctl restart nginx leads to > Job for nginx.service failed. See 'systemctl status nginx.service' and 'journalctl -xn' for details. while > systemctl status nginx.service shows > ~# systemctl status nginx.service > ● nginx.service - A high performance web server and a reverse proxy server > Loaded: loaded (/lib/systemd/system/nginx.service; enabled) > Active: failed (Result: exit-code) since So 2018-06-24 17:01:53 CEST; 1min 59s ago > Process: 18324 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=0/SUCCESS) > Process: 9555 ExecReload=/usr/sbin/nginx -g daemon on; master\_process on; -s reload (code=exited, status=0/SUCCESS) > Process: 18521 ExecStart=/usr/sbin/nginx -g daemon on; master\_process on; (code=exited, status=1/FAILURE) > Process: 18519 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master\_process on; (code=exited, status=0/SUCCESS) > Main PID: 6293 (code=exited, status=0/SUCCESS) Jun 24 17:01:52 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) nginx[18521]: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use) Jun 24 17:01:52 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) nginx[18521]: nginx: [emerg] bind() to [::]:443 failed (98: Address already in use) Jun 24 17:01:52 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) nginx[18521]: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use) Jun 24 17:01:52 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) nginx[18521]: nginx: [emerg] bind() to [::]:443 failed (98: Address already in use) Jun 24 17:01:53 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) nginx[18521]: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use) Jun 24 17:01:53 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) nginx[18521]: nginx: [emerg] bind() to [::]:443 failed (98: Address already in use) Jun 24 17:01:53 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) nginx[18521]: nginx: [emerg] still could not bind() Jun 24 17:01:53 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) systemd[1]: nginx.service: control process exited, code=exited status=1 Jun 24 17:01:53 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) systemd[1]: Failed to start A high performance web server and a reverse proxy server. Jun 24 17:01:53 [rs-zap336199-1.zap-srv.com](http://rs-zap336199-1.zap-srv.com) systemd[1]: Unit nginx.service entered failed state. why is it already in use and why cant it be restarted? greetings ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [June 24, 2018, 3:30pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/6 "2018-06-24T15:30:34Z")
Hi, Can you try `netstat -l | grep "443"` to see what is binding to your https port currently? Thank you ---
**Author:** ![messerbill](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@messerbill](https://community.letsencrypt.org/u/messerbill)\ **Post date:** [June 24, 2018, 5:44pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/7 "2018-06-24T17:44:27Z")
Hi stevenzhu, `netstat -l | grep "443"` returns an empty list. So it seems that nginx is not running...but how can i start it again? Edit: maybe this helps you? > ~# netstat -l | grep "80" > unix 2 [ACC] STREAM LISTENING 8042 /run/rpcbind.sock ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [June 24, 2018, 6:45pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/8 "2018-06-24T18:45:43Z")
Hi @messerbill, You should use switch `-n` so the command show the port number instead of service name. `netstat -ln | grep 443` Cheers, sahsanu ---
**Author:** ![messerbill](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@messerbill](https://community.letsencrypt.org/u/messerbill)\ **Post date:** [June 30, 2018, 12:55pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/9 "2018-06-30T12:55:16Z")
Hi, i was busy during the last days so i’ve had no time. `netstat -ln | grep 443` shows: `tcp6 0 0 :::443 :::* LISTEN` is this correct? ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [June 30, 2018, 2:03pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/10 "2018-06-30T14:03:30Z")
On port 443, there is a website: > Moneygame Control Panel > Moneygame Admin Tool (MAT) Documentation Game-Client I've accepted the self signed certificate. There is no AAAA-record, so tcp6 can't see the server. ---
**Author:** ![messerbill](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@messerbill](https://community.letsencrypt.org/u/messerbill)\ **Post date:** [June 30, 2018, 2:05pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/11 "2018-06-30T14:05:41Z")
ok and how to set the AAAA record? And how could you access the webpages? ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [June 30, 2018, 2:09pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/12 "2018-06-30T14:09:29Z")
> [@messerbill](#): > > ok and how to set the AAAA record? And how could you access the webpages? You don't need an AAAA - record. If you would have one, you would need to have a listener. No AAAA-record -\> no listener needed. Open [https://www.entwicklercouch.de/](https://www.entwicklercouch.de/) and accept the certificate. ---
**Author:** ![messerbill](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@messerbill](https://community.letsencrypt.org/u/messerbill)\ **Post date:** [June 30, 2018, 3:02pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/13 "2018-06-30T15:02:44Z")
chrome doees not give me the possibility to accept the certificate (also Firefox doesn't). And I'd still love to renew the certificate again. 5 min ago I tried `certbot renew` again and i now receive: > Attempting to renew cert from /etc/letsencrypt/renewal/www.entwicklercouch.de.conf produced an unexpected error: Failed authorization procedure. [www.entwicklercouch.de](http://www.entwicklercouch.de) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [Die etwas andere Domain Börse](http://www.entwicklercouch.de/.well-known/acme-challenge/kjMZc60QzvXnf8L8XqOdIh6OhTCPWSZORnOyzYLoobY:) Connection refused, [entwicklercouch.de](http://entwicklercouch.de) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching [Die etwas andere Domain Börse](http://entwicklercouch.de/.well-known/acme-challenge/S3-Y2Ua0lhvec88WcbZHEJlCPgloHv_JXAMg5rD-lNI:) Connection refused. Skipping. > All renewal attempts failed. The following certs could not be renewed: > /etc/letsencrypt/live/www.entwicklercouch.de/fullchain.pem (failure) > 1 renew failure(s), 0 parse failure(s) but the webserver seems to be running: > root@rs-zap336199-1:~# netstat -ln | grep 443 > tcp6 0 0 :::443 :::\* LISTEN > root@rs-zap336199-1:~# netstat -ln | grep 80 > tcp6 0 0 :::8080 :::\* LISTEN > unix 2 [ACC] STREAM HÖRT 8042 /run/rpcbind.sock ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [June 30, 2018, 3:08pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/14 "2018-06-30T15:08:14Z")
> [@messerbill](#): > > Failed authorization procedure. [www.entwicklercouch.de](http://www.entwicklercouch.de) (http-01) If you want to use http-01 - validation, you have to open port 80 and you have to create a web service on port 80. So > **[Die etwas andere Domain Börse](https://domain-rebellen.de/)** must work. Not Port 8080 + tcp6. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [June 30, 2018, 3:11pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/15 "2018-06-30T15:11:13Z")
PS: Post the picture of your chrome + [https://www.entwicklercouch.de/](https://www.entwicklercouch.de/) Normally, there is an option to expand ---
**Author:** ![messerbill](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@messerbill](https://community.letsencrypt.org/u/messerbill)\ **Post date:** [June 30, 2018, 8:11pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/16 "2018-06-30T20:11:44Z")
Here is a screenshot with the opened extras (usually i can accept here and say smth like “visit website anyway”, but not in this case) ![screen](https://global.discourse-cdn.com/letsencrypt/original/3X/3/9/39789e37da4c542e4e80d3ea81696342a34e3026.png) ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [June 30, 2018, 10:52pm UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/17 "2018-06-30T22:52:19Z")
Hi, That’s wierd (since you don’t have hsts configtured but you are forced to use hsts…) You could remove that hsts flag by go-to chrome://net-internal, find domain security policies, then go-to clear domain policy Thank you ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [July 1, 2018, 9:38am UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/18 "2018-07-01T09:38:38Z")
HSTS is a wonderful feature. But it should only used when the certificate management process works. Anyway: If it is not possible to use http-01 - challenge (Port 80 doesn’t work), check if you can switch to dns-01 - challenge (creating two dns - txt entries). ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 31, 2018, 9:38am UTC](https://community.letsencrypt.org/t/certificate-expired-and-renew-not-working/65108/19 "2018-07-31T09:38:46Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.