# Certificate renewal failed **URL:** \ **Category:** Help\ **Created:** [August 23, 2024, 11:12am UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198 "2024-08-23T11:12:45Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 11:12am UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/1 "2024-08-23T11:12:45Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: suhozid.hr I ran this command: certbot renew --force-renewal --cert-name suhozid.hr It produced this output: * * * Processing /etc/letsencrypt/renewal/www.suhozid.hr.conf * * * Renewing an existing certificate for www.suhozid.hr Error while running apache2ctl graceful. httpd not running, trying to start Action 'graceful' failed. The Apache error log may have more information. (98)Address already in use: AH00072: make\_sock: could not bind to address [::]:80 (98)Address already in use: AH00072: make\_sock: could not bind to address 0.0.0.0:80 no listening sockets available, shutting down AH00015: Unable to open logs Unable to restart apache using ['apache2ctl', 'graceful'] Error while running apache2ctl graceful. httpd not running, trying to start Action 'graceful' failed. The Apache error log may have more information. (98)Address already in use: AH00072: make\_sock: could not bind to address [::]:80 (98)Address already in use: AH00072: make\_sock: could not bind to address 0.0.0.0:80 no listening sockets available, shutting down AH00015: Unable to open logs Unable to restart apache using ['apache2ctl', 'graceful'] Encountered exception during recovery: certbot.errors.MisconfigurationError: Error while running apache2ctl graceful. httpd not running, trying to start Action 'graceful' failed. The Apache error log may have more information. (98)Address already in use: AH00072: make\_sock: could not bind to address [::]:80 (98)Address already in use: AH00072: make\_sock: could not bind to address 0.0.0.0:80 no listening sockets available, shutting down AH00015: Unable to open logs Failed to renew certificate www.suhozid.hr with error: Error while running apache2ctl graceful. httpd not running, trying to start Action 'graceful' failed. The Apache error log may have more information. (98)Address already in use: AH00072: make\_sock: could not bind to address [::]:80 (98)Address already in use: AH00072: make\_sock: could not bind to address 0.0.0.0:80 no listening sockets available, shutting down AH00015: Unable to open logs * * * All renewals failed. The following certificates could not be renewed: /etc/letsencrypt/live/www.suhozid.hr/fullchain.pem (failure) * * * 1 renew failure(s), 0 parse failure(s) My web server is (include version): apache2.4.52 The operating system my web server runs on is (include version): ubuntu 22.04 My hosting provider, if applicable, is: orbis.hr \>\> aws Route 53 I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 2.11.0 ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 11:19am UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/3 "2024-08-23T11:19:09Z")
> [@ydrea](#): > > `--force-renewal` That doesn't fix anything - don't use it. What shows?: # - `certbot certificates` `- cat /etc/letsencrypt/renewal/www.suhozid.hr.conf` Also, note: ```nohighlight Name: suhozid.hr Addresses: 65.8.178.66 65.8.178.17 65.8.178.4 65.8.178.56 ``` ---
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 11:40am UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/4 "2024-08-23T11:40:15Z")
> [@ydrea](#): > > --force-renewal ok. `$ cat /etc/letsencrypt/renewal/www.suhozid.hr.conf` ```nohighlight # renew_before_expiry = 30 days version = 2.10.0 archive_dir = /etc/letsencrypt/archive/www.suhozid.hr cert = /etc/letsencrypt/live/www.suhozid.hr/cert.pem privkey = /etc/letsencrypt/live/www.suhozid.hr/privkey.pem chain = /etc/letsencrypt/live/www.suhozid.hr/chain.pem fullchain = /etc/letsencrypt/live/www.suhozid.hr/fullchain.pem # Options used in the renewal process [renewalparams] account = 0767909cd4f13bf268b1c2ae6f20f9c7 authenticator = apache installer = apache server = https://acme-v02.api.letsencrypt.org/directory key_type = ecdsa ``` > [@](#): > > ```nohighlight > Name: suhozid.hr > Addresses: 65.8.178.66 > 65.8.178.17 > 65.8.178.4 > 65.8.178.56 > > ``` what does this mean in the context of my question? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 11:42am UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/5 "2024-08-23T11:42:27Z")
> [@ydrea](#): > > what does this mean in the context of my question? It means that your server may be behind a load-balancer. When using `HTTP-01` authentication, you have to be sure that the HTTP challenge requests reach the system in question. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 11:45am UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/6 "2024-08-23T11:45:33Z")
That is a confusing error message: > [@ydrea](#): > > (98)Address already in use: AH00072: make\_sock: could not bind to address [::]:80 > (98)Address already in use: AH00072: make\_sock: could not bind to address 0.0.0.0:80 Given: > [@ydrea](#): > > ```nohighlight > authenticator = apache > installer = apache > > ``` Which is explained by: > [@ydrea](#): > > Error while running apache2ctl graceful. > httpd not running, trying to start It seems something is already running on port 80. What shows?: # `ss -plnt | grep 80` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 11:51am UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/7 "2024-08-23T11:51:12Z")
I didn't see your response to this: > [@rg305](#): > > What shows?: > > # - `certbot certificates` ---
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 12:36pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/8 "2024-08-23T12:36:50Z")
$ ss -plnt | grep 80 LISTEN 0 511 \*:80 _:_ ubuntu@ip-172-31-27-140:~$ certbot certificates The following error was encountered: [Errno 13] Permission denied: '/var/log/letsencrypt/.certbot.lock' Either run as root, or set --config-dir, --work-dir, and --logs-dir to writeable paths. Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /tmp/certbot-log-r3k0keit/log or re-run Certbot with -v for more details. ubuntu@ip-172-31-27-140:~$ ---
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 12:39pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/9 "2024-08-23T12:39:01Z")
the first issue might not be relevant: apache was down, I rebooted the system and got it running... ---
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 12:41pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/10 "2024-08-23T12:41:54Z")
upon running ' certbot certificates' with sudo: Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * Found the following certs: Certificate Name: suhozid.hr-0001 Serial Number: 4889173f6a8af8d6d894bda722fc885d2a8 Key Type: ECDSA Domains: suhozid.hr Expiry Date: 2024-09-22 13:09:00+00:00 (VALID: 30 days) Certificate Path: /etc/letsencrypt/live/suhozid.hr-0001/fullchain.pem Private Key Path: /etc/letsencrypt/live/suhozid.hr-0001/privkey.pem Certificate Name: suhozid.hr Serial Number: 37177c633d535a7ce3051632eabe2277538 Key Type: ECDSA Domains: suhozid.hr www.suhozid.hr Expiry Date: 2024-07-11 11:56:05+00:00 (INVALID: EXPIRED) Certificate Path: /etc/letsencrypt/live/suhozid.hr/fullchain.pem Private Key Path: /etc/letsencrypt/live/suhozid.hr/privkey.pem Certificate Name: www.suhozid.hr Serial Number: 3c98780c83d4ba5a8fcb851c4b502c919ef Key Type: ECDSA Domains: www.suhozid.hr Expiry Date: 2024-07-24 12:54:41+00:00 (INVALID: EXPIRED) Certificate Path: /etc/letsencrypt/live/www.suhozid.hr/fullchain.pem Private Key Path: /etc/letsencrypt/live/www.suhozid.hr/privkey.pem * * * ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 12:44pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/11 "2024-08-23T12:44:40Z")
> [@ydrea](#): > > Certificate Name: suhozid.hr-0001 > Domains: **`suhozid.hr`** > > Certificate Name: suhozid.hr > Domains: **`suhozid.hr www.suhozid.hr`** > > Certificate Name: www.suhozid.hr > Domains: **`www.suhozid.hr`** That seems a bit _messy_. Which cert(s) are you actually using? ---
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 12:48pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/12 "2024-08-23T12:48:25Z")
I don't know 😊 ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 12:49pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/13 "2024-08-23T12:49:00Z")
Show the output of this: `sudo apachectl -t -D DUMP_VHOSTS` ---
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 12:50pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/14 "2024-08-23T12:50:19Z")
> [@rg305](#): > > `sudo apachectl -t -D DUMP_VHOSTS` VirtualHost configuration: \*:80 suhozid.hr (/etc/apache2/sites-enabled/suhozid.hr.conf:11) \*:443 suhozid.hr (/etc/apache2/sites-enabled/suhozid.hr.conf:40) ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 12:51pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/15 "2024-08-23T12:51:30Z")
Perfect. Let's have a look at that file: `cat /etc/apache2/sites-enabled/suhozid.hr.conf` ---
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 12:53pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/16 "2024-08-23T12:53:41Z")
```nohighlight #ServerName suhozid.hr LoadModule wsgi_module "/home/ubuntu/dev/lib/python3.10/site-packages/mod_wsgi/server/mod_wsgi-py310.cpython-310-x86_64-linux-gnu.so" WSGIPythonHome "/home/ubuntu/dev" WSGIApplicationGroup %{GLOBAL} #HTTP #WSGIPassAuthorization on #WSGIDaemonProcess arches python-home=/home/ubuntu/dev/ python-path=/home/ubuntu/suhozid #WSGIScriptAlias / /home/ubuntu/suhozid/suhozid/wsgi.py process-group=arches WSGIApplicationGroup %{GLOBAL} # WSGIDaemonProcess arches # WSGIProcessGroup arches # WSGIScriptAlias / /home/ubuntu/suhozid/suhozid/wsgi.py process-group=arches ServerName suhozid.hr ServerAlias 3.124.4.144 Redirect permanent / https://suhozid.hr/ ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined # This is optional, in case you want to redirect people # from http to https automatically. #RewriteEngine On #RewriteCond %{SERVER_PORT} !^443$ #RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L] #HTTPS WSGIPassAuthorization on WSGIDaemonProcess arches python-home=/home/ubuntu/dev/ python-path=/home/ubuntu/suhozid WSGIScriptAlias / /home/ubuntu/suhozid/suhozid/wsgi.py process-group=arches Options Indexes FollowSymLinks AllowOverride None Require all granted Alias /static/ /home/ubuntu/suhozid/suhozid/static/ Options Indexes FollowSymLinks AllowOverride None Require all granted Alias /files/uploadedfiles /home/ubuntu/suhozid/suhozid/uploadedfiles Options Indexes FollowSymLinks AllowOverride None Require all granted #RedirectMatch permanent ^(.*)$ https://suhozid.hr$1 ServerName suhozid.hr #ServerAdmin admin@localhost ServerAlias 3.124.4.144 #DocumentRoot /var/www/default #DocumentRoot /home/ubuntu/suhozid LogLevel debug ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined SSLEngine on SSLCertificateFile /etc/letsencrypt/live/suhozid.hr-0001/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/suhozid.hr-0001/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 12:55pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/17 "2024-08-23T12:55:27Z")
> [@ydrea](#): > > ```nohighlight > SSLCertificateFile /etc/letsencrypt/live/suhozid.hr-0001/fullchain.pem > SSLCertificateKeyFile /etc/letsencrypt/live/suhozid.hr-0001/privkey.pem > > ``` It's using the first cert. But that one doesn't have both names on it. I would edit that file to use the second cert [with both names on it]. ```nohighlight SSLCertificateFile /etc/letsencrypt/live/suhozid.hr/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/suhozid.hr/privkey.pem ``` Then restart `Apache`. Then delete the two unused certs. ---
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 12:57pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/18 "2024-08-23T12:57:58Z")
I see, but the secod one is expired! ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 1:03pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/20 "2024-08-23T13:03:10Z")
Good catch! Then we must renew it first. `certbot renew --cert-name suhozid.hr` [although that sounds like where you started... you also said you recently rebooted] > [@ydrea](#): > > I rebooted the system and got it running... ---
**Author:** ![ydrea](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ydrea/32/79414_2.png) [@ydrea](https://community.letsencrypt.org/u/ydrea)\ **Post date:** [August 23, 2024, 1:04pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/21 "2024-08-23T13:04:25Z")
yes... Processing /etc/letsencrypt/renewal/suhozid.hr.conf * * * Renewing an existing certificate for suhozid.hr and www.suhozid.hr Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems: Domain: www.suhozid.hr Type: dns Detail: DNS problem: NXDOMAIN looking up A for www.suhozid.hr - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for www.suhozid.hr - check that a DNS record exists for this domain Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet. Failed to renew certificate suhozid.hr with error: Some challenges have failed. * * * All renewals failed. The following certificates could not be renewed: /etc/letsencrypt/live/suhozid.hr/fullchain.pem (failure) * * * 1 renew failure(s), 0 parse failure(s) Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 23, 2024, 1:17pm UTC](https://community.letsencrypt.org/t/certificate-renewal-failed/224198/22 "2024-08-23T13:17:58Z")
Well that explains this: ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/e/f/ef2cd66ad91cb2ca316740078fc2432013bff6cf.png) To quote the maintainer of that: "DNS resolution was awfully slow: Like 56 seconds just to get an A record." You need to verify/fix DNS first. [Next page](https://community.letsencrypt.org/t/certificate-renewal-failed/224198.md?page=2)