Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If youāre using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
My web server is (include version):nginx/1.12.1
The operating system my web server runs on is (include version):Freenas 11U2
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I donāt know):Yes
Iām using a control panel to manage my site (no, or provide the name and version of the control panel):NO
This error indicates that www.xxxx.ddns.net does not exist. Remember that this is a separate DNS record from xxxx.ddns.net. Since you didnāt post your domain name, we canāt confirm whether this is correct. However, you should check your DNS configuration.
I had tried to renew and thought it was sucessfull Copy letsencrypt to new server install
It turns out the certificate expired so the site is not reachable now. How can I create a new certificate? Do I have to delete the old letsencrypt directory before issuing the certbot command?
I eliminated the www.xxxx.ddns.net from the certbot command and got:
You have an existing certificate that has exactly the same domains or certificate name you requested and isnāt close to expiry.
(ref: /usr/local/etc/letsencrypt/renewal/xxxx.ddns.net.conf)
What would you like to do?
1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)
Select the appropriate number [1-2] then [enter] (press ācā to cancel):
No sure if I should do 2. Surprised it says itās not expired. May something else is broken?
When I go to the website I get this error in explorer
The websiteās security certificate is not yet valid or has expired.
Error Code: DLG_FLAGS_SEC_CERT_DATE_INVALID
Because this site uses HTTP Strict Transport Security, you canāt continue to this site at this time.
So, the reason for the different Certbot behavior in these two cases is probably that your existing certificate covers xxxx.ddns.net but you originally requested a new certificate for both www.xxxx.ddns.net and xxxx.ddns.net. Certbot tried to obtain that new certificate because it would have covered a domain name that your old certificate didnāt.
By contrast, when you only asked for a certificate that covered xxxx.ddns.net (with the www), Certbot noticed that you already have one and that itās already renewed and not near expiry.
That probably means that you have already renewed your certificate but that the new certificate isnāt being used by your web server. I can give you lots of ways of checking this, but the first step would be to reload your web server (e.g. sudo service apache2 reload or a similar command depending on your OS and web server). Renewals using --webroot do not perform this step for you automatically unless you add a --renew-hook option telling them that they should.
after doing a service nginx reload the site works. Not sure why I needed to do. Thanks for your help as usual. My site is supposed to autorenew with a script in the /etc/periodic/daily/220.renew.letsencrypt
it contains
#!/bin/sh
If that were having the effect you intended, you wouldnāt be able to renew at all, because --webroot requires that your web server is running! (In that regard itās the opposite of --standalone, which normally requires that your web server is not running.)
So, either that particular command is not being running automatically, or the hooks arenāt having the effect that you expected.
With --webroot I would normally suggest --renew-hook "service nginx reload" because you just need a reload to pick up the new certificates when they exist. However, I donāt think changing your current command to this command will fix things unless you can also figure out why your current command isnāt working (whether itās not running at all, or whether the hooks donāt work, or whatever).
So the command: certbot --renew-hook āservice nginx reloadā would work in the script?
If I run service cron status it says itās running.
How else could I check if itās running at all or if the hooks donāt work? Is there a log file to check? Sorry if this is an obvious question.
You could see if the script is running by adding a line like
date >> /tmp/$$
at the end, and then seeing if files get created in /tmp showing the PIDs of the script interpreters and the dates that the script ran.
You could check if the hooks are working by running your renew command from the command line with the addition of --force-renewal (but donāt do this frequently, because it counts against your rate limit unless you also use --dry-run!).
after adding the code to the script I get a file
-rw-r--r-- 1 root wheel 29 Sep 22 13:32 33935
in the /tmp directory showing it works if I run it manually.
Congratulations, all renewals succeeded. The following certs have been renewed:
/usr/local/etc/letsencrypt/live/xxxx.ddns.net/fullchain.pem (success)
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates above have not been saved.)
in my script will work going forward?
What command shows me how many days till my cert expires?
Other than waiting till I get an email that my cert is expiring how can I know that my scripts is working?
if I remove the --quiet parameter and run the script
I get:
usage:
certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...
Certbot can obtain and install HTTPS/TLS/SSL certificates. By default,
it will attempt to use a webserver both for obtaining and installing the
certificate.
certbot: error: unrecognized arguments: nginx reloadā
It looks like the forum(?) replaced the regular ASCII quotation marks around service nginx reload with fancy Unicode quotation marks. You need to fix the command.
The following certs are not due for renewal yet:
/usr/local/etc/letsencrypt/live/xxxx.ddns.net/fullchain.pem (skipped)
No renewals were attempted.
No hooks were run.
