Certificate not auto renewing

Help
1

My website is mindmapmaker.org

It's certificate was going to renew on 30th August 2026.

This is the output for 'certbot certificates' on 29th August.

Certificate Name: mindmapmaker.org

This is the output for 'certbot certificates' on 30th August.

Certificate Name: mindmapmaker.org

The following were in the log for auto renewing by snap on 30th August.

2026-08-30 19:00:10,665:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/mindmapmaker.org.conf
2026-08-30 19:00:10,668:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None
2026-08-30 19:00:10,668:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None
2026-08-30 19:00:10,680:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/acme/renewal-info/uVnyjs8i8IbTN0j_dhQYuoLYVYc.BX49UfC7AJs9HD_3OWlmOA5k.
2026-08-30 19:00:10,726:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "GET /acme/renewal-info/uVnyjs8i8IbTN0j_dhQYuoLYVYc.BX49UfC7AJs9HD_3OWlmOA5k HTTP/1.1" 200 101
2026-08-30 19:00:10,727:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Sun, 30 Aug 2026 13:30:10 GMT
Content-Type: application/json
Content-Length: 101
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: https://acme-v02.api.letsencrypt.org/directory;rel="index"
Retry-After: 21756
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{

  • "suggestedWindow": {*
  • "start": "2026-08-29T06:23:34Z",*
  • "end": "2026-08-31T01:34:24Z"*
  • }*
    }
    2026-08-30 19:00:10,729:INFO:certbot._internal.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/mindmapmaker.org/cert2.pem
    2026-08-30 19:00:10,730:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
    2026-08-30 19:00:10,731:DEBUG:certbot._internal.plugins.selection:Requested authenticator nginx and installer nginx
    2026-08-30 19:00:10,731:DEBUG:certbot._internal.plugins.selection:Selecting plugin: * nginx
    Description: Nginx Web Server plugin
    Interfaces: Authenticator, Installer, Plugin
    Entry point: EntryPoint(name='nginx', value='certbot_nginx._internal.entrypoint:ENTRYPOINT', group='certbot.plugins')
    Initialized: <certbot._internal.plugins.nginx.configurator.NginxConfigurator object at 0x7f258fabaea0>

It was showing as 'Certificate not yet due for renewal'

After 5 minutes, I ran the command, 'certbot renew' manually. Then it was renewed properly.

The following was in the log.

__
Entry point: EntryPoint(name='nginx', value='certbot_nginx._internal.entrypoint:ENTRYPOINT', group='certbot.plugins')
Initialized: <certbot._internal.plugins.nginx.configurator.NginxConfigurator object at 0x7f66265d3e00>
2026-08-30 19:33:15,831:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/mindmapmaker.org.conf
2026-08-30 19:33:15,833:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None
2026-08-30 19:33:15,833:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None
2026-08-30 19:33:15,843:DEBUG:certbot._internal.renewal:Skipped ACME Renewal Info check because ari_retry_after 2026-08-31T01:02:46 is in the future
2026-08-30 19:33:15,843:INFO:certbot._internal.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/mindmapmaker.org/cert2.pem
2026-08-30 19:33:15,844:INFO:certbot._internal.renewal:Certificate is due for renewal, auto-renewing...
2026-08-30 19:33:15,844:DEBUG:certbot._internal.plugins.selection:Requested authenticator nginx and installer nginx
2026-08-30 19:33:17,021:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * nginx
Description: Nginx Web Server plugin
Interfaces: Authenticator, Installer, Plugin
Entry point: EntryPoint(name='nginx', value='certbot_nginx._internal.entrypoint:ENTRYPOINT', group='certbot.plugins')
Initialized: <certbot._internal.plugins.nginx.configurator.NginxConfigurator object at 0x7f6628e178c0>
Prep: True
2026-08-30 19:33:17,022:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * nginx
Description: Nginx Web Server plugin
Interfaces: Authenticator, Installer, Plugin
Entry point: EntryPoint(name='nginx', value='certbot_nginx._internal.entrypoint:ENTRYPOINT', group='certbot.plugins')
Initialized: <certbot._internal.plugins.nginx.configurator.NginxConfigurator object at 0x7f6628e178c0>
Prep: True

What was the issue? Why it didn't get renewed while trying to renew using the snap timer command in the background?

Thanks

2

Its certificate was actually going to expire on the 29th of September as your logs show:
Expiry Date: 2026-09-29 03:39:29+00:00 (VALID: 30 days)

Thanks for including logs btw!

3

Yeah. I meant, the certificate should get renewed on August 30th. But it didnt get renewed automatically via Snap.

I had to run the command, 'certbot renew' manually. So, what is the issue?

4

My guess is that it would have renewed automatically if you had waited another day or two. I suggest you set a reminder for yourself to check of the next renewal at 28 days before expiration, if it didn't renew then you can continue digging into it.

Edit: And maybe don't manually trigger the renew next time so you can try to fix the automation instead.

5

It didn't automatically renew via Snap.

When I manually ran the command after 5 minutes, it got renewed.

6

ACME clients use randomness in deciding when to renew within this window:
{
"start": "2026-08-29T06:23:34Z",
"end": "2026-08-31T01:34:24Z"
}

The end time had not yet passed so I don't think you have proof that the automation failed.

7

...the one time it ran inside that window. That it didn't renew when it was inside the window was curious, but may not have been a problem. Keep an eye on it when the next renewal cycle comes, but don't be quite so quick on the trigger to renew it manually.

8

That's a really good question. Your first log ran within the ARI window and also with less than 30 days remaining before expiry which is a fallback check. Certbot should have tried renewal.

Can you upload each of those complete log files? If you copy each to a .txt you can use the upload button on this forum. Or, at least show all the lines that lead up to what you showed. I'm curious which version of Certbot is running and whether they are the same between your two methods of operation.

Also, which O/S and version are you running on? (still Centos 9 stream?)

This is probably a better question for the Certbot team but they'll want to see that part of the log too. But, maybe we'll see something with this extra log info before getting them involved. Thanks

9

Certbot version is 5.7.0

OS is Centos 9 stream.

I use 3 websites btw.

Uploaded each log files as .txt file.

Please analyse.

Thanks
letsencrypt.log.2.txt (97.8 KB)
letsencrypt.log.4.txt (9.0 KB)
letsencrypt.log.5.txt (2.5 KB)
letsencrypt.log.7.txt (2.5 KB)
letsencrypt.log.8.txt (2.5 KB)
letsencrypt.log.10.txt (2.5 KB)

10

Excellent. Thanks. I'll contact the Certbot team

To recap using these logs
letsencrypt.log.4.txt shows mindmapmaker not due for renewal even though the log run time is within the ARI window and the cert has less than 30 days before expiry

letsencrypt.log.2.txt shows your manual renew request 3 minutes later. It does not refresh ARI because of the retry-after (as expected). But correctly identifies mindmapmaker as needing renewal and that succeeds.

The other two certs are not yet due for renewal. It does look like a bug. Maybe related to getting a fresh ARI window in combination with the first cert not needing renewal but the second (mindmapmaker) does.

11

To me, it seems that renewal was denied/deferred due to TOP OF THE HOUR congestion:
[notice the timestamp: 2026-08-30 19:00:10,665]

2026-08-30 19:00:10,665:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/mindmapmaker.org.conf
2026-08-30 19:00:10,668:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None
2026-08-30 19:00:10,668:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None
2026-08-30 19:00:10,680:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/acme/renewal-info/uVnyjs8i8IbTN0j_dhQYuoLYVYc.BX49UfC7AJs9HD_3OWlmOA5k.
2026-08-30 19:00:10,726:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "GET /acme/renewal-info/uVnyjs8i8IbTN0j_dhQYuoLYVYc.BX49UfC7AJs9HD_3OWlmOA5k HTTP/1.1" 200 101
2026-08-30 19:00:10,727:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Sun, 30 Aug 2026 13:30:10 GMT
Content-Type: application/json
Content-Length: 101
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Retry-After: 21756
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "suggestedWindow": {
    "start": "2026-08-29T06:23:34Z",
    "end": "2026-08-31T01:34:24Z"
  }
}
12

Thanks. What you mean exactly by TOP OF THE HOUR congestion

13

But the renewal was not even requested by Certbot. Certbot still should have made the request and maybe would have seen a 429 or similar http response to the request. If Certbot was now rejecting any renewal request at the top of hour that would be a serious regression.

@cvazeem the "00" minute mark of each hour (the top) is historically a very busy time and it is best not to have cronjobs renewing at that time. Although, Certbot has some delay built-in to compensate. And, you said you used a systemd timer. If the timer was from the snap install that should have randomization as well so it's a coincidence it ran at :00 but not impossible. Avoiding schedules at :00 is ideal but shouldn't cause Certbot to think renewal is not required. There is no law about trying a renewal at that time :slight_smile:

See: FAQ - Let's Encrypt

I have alerted the Certbot devs about this thread. I can't speak to how quickly they will take a look.

15

Certbot via Snap uses default timers.
Certbot

16

Based on these logs, I agree with @MikeMcQ that certbot should've requested renewal here.

@cvazeem just to sanity check, could you check whether autorenewal is disabled for your certificate? Run something like grep autorenew /etc/letsencrypt/renewal/mindmapmaker.org.conf, and let me know if you see autorenew = False.

17

@wgreenberg

Hi,

I ran 'grep autorenew /etc/letsencrypt/renewal/mindmapmaker.org.conf', but it returned nothing.

This is the content of 'mindmapmaker.org.conf'

--
version = 5.7.0
archive_dir = /etc/letsencrypt/archive/mindmapmaker.org
cert = /etc/letsencrypt/live/mindmapmaker.org/cert.pem
privkey = /etc/letsencrypt/live/mindmapmaker.org/privkey.pem
chain = /etc/letsencrypt/live/mindmapmaker.org/chain.pem
fullchain = /etc/letsencrypt/live/mindmapmaker.org/fullchain.pem
[renewalparams]
account = 4f7fd7c25d9acb783924f7ee54e8dcff
authenticator = nginx
installer = nginx
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
[acme_renewal_info]
ari_retry_after = 2026-09-04T08:18:47

18

@wgreenberg

It was properly auto renewing before. I changed nothing after that.

Also, there was an error for auto-renewing mindmapmaker.org only. In logs, it showed something like, '"detail": "No such authorization"'

There also I had to run the renew command manually.

19

@wgreenberg

I see you are a Certbot Engineer. Are you looking at this issue?

Do I need to post this bug in Certbot github?

Thanks

20

I don't see anything like that error in the 6 logs you uploaded, is it in another log file perhaps?

And if you don't mind saying, what time zone are you in? I'm pretty sure there's no time zone that'd cause a local time of 2026-08-30 19:00 to be before 2026-08-29 6:23Z, but another datapoint couldn't hurt.

And I am looking into this, but we can continue talking in this thread until I find an actionable bug, after which I'll open an issue on the Github repo.

21

India perhaps. Log time is 5.5 H after GMT

2026-08-30 19:00:10,578:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Sun, 30 Aug 2026 13:30:10 GMT