[Im new here. And my previous programmar did this job. Sorry if this sounds silly]
The certificate is working fine in . And I have checked the validity of my certificate in from different platforms (browser & different third party certificate check websites). All show the cert is valid with the same expiry date (07/12/2021).
However, when I certbot certificates, it says my certificate is expired, and has a different expiry date (25/09/2021).
$ sudo certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/<mydomain>.conf with version 0.31.0 of Certbot. This might not work.
OCSP check failed for /etc/letsencrypt/live/<mydomain>/cert.pem (are we offline?)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: <mydomain>
Domains: <mydomain>
Expiry Date: 2021-09-25 14:08:28+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/<mydomain>/fullchain.pem
Private Key Path: /etc/letsencrypt/live/<mydomain>/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Then I further investigated. and go to crt.sh. I found the following info.
I am surprised the cert issued on Mar 12 has been renewing every 2 months AUTOMATICALLY. However, there's no such info when I run certbot certificates.
So I went checking the corresponding certificate folders in my server.
$ sudo ls -la /etc/letsencrypt/live/<mydomain>/
total 12
drwxr-xr-x 2 root root 4096 Jun 27 15:08 .
drwx------ 4 root root 4096 Mar 12 2021 ..
-rw-r--r-- 1 root root 692 Mar 12 2021 README
lrwxrwxrwx 1 root root 37 Jun 27 15:08 cert.pem -> ../../archive/<mydomain>/cert2.pem
lrwxrwxrwx 1 root root 38 Jun 27 15:08 chain.pem -> ../../archive/<mydomain>/chain2.pem
lrwxrwxrwx 1 root root 42 Jun 27 15:08 fullchain.pem -> ../../archive/<mydomain>/fullchain2.pem
lrwxrwxrwx 1 root root 40 Jun 27 15:08 privkey.pem -> ../../archive/<mydomain>/privkey2.pem
Further getting into the archive folder
$ sudo ls -la /etc/letsencrypt/archive/<mydomain>/
total 44
drwxr-xr-x 2 root root 4096 Jun 27 15:08 .
drwx------ 5 root root 4096 Mar 12 2021 ..
-rw-r--r-- 1 root root 1834 Mar 12 2021 cert1.pem
-rw-r--r-- 1 root root 1838 Jun 27 15:08 cert2.pem
-rw-r--r-- 1 root root 1586 Mar 12 2021 chain1.pem
-rw-r--r-- 1 root root 3749 Jun 27 15:08 chain2.pem
-rw-r--r-- 1 root root 3420 Mar 12 2021 fullchain1.pem
-rw-r--r-- 1 root root 5587 Jun 27 15:08 fullchain2.pem
-rw------- 1 root root 1704 Mar 12 2021 privkey1.pem
-rw------- 1 root root 1708 Jun 27 15:08 privkey2.pem
I realized there IS the cert issued on Mar 12 in my server. However, it's not showing the updating certificate info in my server. And it's symlink to the one that is issued on Jun 27.
For Automatic renewal, I checked my certbot service too. It seems nothing special with this.
/lib/systemd/system$ cat certbot.timer
[Unit]
Description=Run certbot twice daily
[Timer]
OnCalendar=*-*-* 00,12:00:00
RandomizedDelaySec=43200
Persistent=true
[Install]
WantedBy=timers.target
/lib/systemd/system$ cat certbot.service
[Unit]
Description=Certbot
Documentation=file:///usr/share/doc/python-certbot-doc/html/index.html
Documentation=https://letsencrypt.readthedocs.io/en/latest/
[Service]
Type=oneshot
ExecStart=/usr/bin/certbot -q renew
PrivateTmp=true
So, why does it happen? Is it possible for the key to be stored somewhere else with automatic renewal enabled somewhere else after the initial creation in this server on Mar 12?
I mean this doesn't hurt, since the certificate is working with auto renewal. Just that my boss is asking me why it is showing expired in the server. And I have no clue AT ALL.
