Certificate renewal error

Help
24

Better:

curl -Ii soge.iu-data.fr
HTTP/1.1 301 Moved Permanently
Date: Wed, 18 Sep 2024 09:20:46 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.1.33
Location: https://soge.iu-data.fr/
Content-Type: text/html; charset=iso-8859-1

Now again:

25

[root@soge ~]# certbot certonly
--webroot -w /applis/soge/web/sographic/htdocs/web
-d soge.iu-data.fr
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Requesting a certificate for soge.iu-data.fr
Performing the following challenges:
http-01 challenge for soge.iu-data.fr
Using the webroot path /applis/soge/web/sographic/htdocs/web for all unmatched domains.
Waiting for verification...
Cleaning up challenges
archive directory exists for soge.iu-data.fr

26

I remove the archive and restart the command

27

[root@soge ~]# certbot certonly --webroot -w /applis/soge/web/sographic/htdocs/web -d soge.iu-data.fr
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Requesting a certificate for soge.iu-data.fr

IMPORTANT NOTES:

  • Congratulations! Your certificate and chain have been saved at:
    /etc/letsencrypt/live/soge.iu-data.fr-0001/fullchain.pem
    Your key file has been saved at:
    /etc/letsencrypt/live/soge.iu-data.fr-0001/privkey.pem
    Your certificate will expire on 2024-12-17. To obtain a new or
    tweaked version of this certificate in the future, simply run
    certbot again. To non-interactively renew all of your
    certificates, run "certbot renew"

  • If you like Certbot, please consider supporting our work by:

    Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
    Donating to EFF: Support EFF's Work on Let's Encrypt | Electronic Frontier Foundation

[root@soge ~]#

28

[root@soge ~]# echo | openssl s_client -connect soge.iu-data.fr:443 2>/dev/null | openssl x509 -noout -dates
notBefore=Apr 17 13:06:05 2024 GMT
notAfter=Jul 16 13:06:04 2024 GMT

Always 16 jul ! Hum.. strange..

30

Show:
certbot certificates

31

You need to change these three lines:

To:

SSLCertificateFile /etc/letsencrypt/live/soge.iu-data.fr-0001/cert.pem
SSLCertificateChainFile /etc/letsencrypt/live/soge.iu-data.fr-0001/chain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/soge.iu-data.fr-0001/privkey.pem

Then restart or reload Apache.

32

[root@soge ~]# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewal configuration file /etc/letsencrypt/renewal/soge.iu-data.fr.conf produced an unexpected error: renewal config file {} is missing a required file reference. Skipping.

Found the following certs:
Certificate Name: soge.iu-data.fr-0001
Serial Number: 3fb264930e29c827076dc26763193b5b1e9
Key Type: RSA
Domains: soge.iu-data.fr
Expiry Date: 2024-12-17 08:36:52+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/soge.iu-data.fr-0001/fullchain.pem
Private Key Path: /etc/letsencrypt/live/soge.iu-data.fr-0001/privkey.pem

The following renewal configurations were invalid:
/etc/letsencrypt/renewal/soge.iu-data.fr.conf

33

Just need to add the -0001 to the three cert lines.

34

Done.. and it seems OK

A big thank you @rg305 for your help, your efficiency and your reactivity ! :star_struck:

35

Yes it's done but always this message on the certbot certificates command.

36

it's ok, i remove the file /etc/letsencrypt/renewal/soge.iu-data.fr.conf and just keep /etc/letsencrypt/renewal/soge.iu-data.fr-0001.conf

[root@soge renewal]# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Found the following certs:
Certificate Name: soge.iu-data.fr-0001
Serial Number: 3fb264930e29c827076dc26763193b5b1e9
Key Type: RSA
Domains: soge.iu-data.fr
Expiry Date: 2024-12-17 08:36:52+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/soge.iu-data.fr-0001/fullchain.pem
Private Key Path: /etc/letsencrypt/live/soge.iu-data.fr-0001/privkey.pem

37

Hi, is it possible to delete this topic please ? Or hide all the mention about the domain please ?
Since this topic there have been attempted attacks on the server. Thank you

38

Any domain on the publicly trusted certificate is exposed via Certificate Transparency logs. E.g. your domain: crt.sh | %.iu-data.fr

Removing it from this forum won't remove it from those logs. And it's impossible to remove anything from CT logs in general.

39

And before this topic...?
I suspect that since you've had an IP on the Internet, your IP has been under attack.