# Certificate renewal simulation failure **URL:** \ **Category:** Help\ **Created:** [September 13, 2024, 12:26pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780 "2024-09-13T12:26:53Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 13, 2024, 12:26pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/1 "2024-09-13T12:26:53Z")
First of all I apologize, I am probably one of the clumsiest people on this forum: Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [meteosanjuan.com](http://meteosanjuan.com) and meteoensevilla.es I ran this command: **sudo certbot renew --dry-run** It produced this output: All simulated renewals failed. The following certificates could not be renewed: /etc/letsencrypt/live/meteoensevilla.es/fullchain.pem (failure) /etc/letsencrypt/live/meteosanjuan.com/fullchain.pem (failure) /etc/letsencrypt/live/www.meteoensevilla.es/fullchain.pem (failure) /etc/letsencrypt/live/www.meteosanjuan.com/fullchain.pem (failure) My web server is (include version): Server version: Apache/2.4.58 (Ubuntu) Server built: 2024-07-17T18:55:23 The operating system my web server runs on is (include version): Ubuntu 24.04.1 LTS (GNU/Linux 6.8.0-44-generic x86\_64) My hosting provider, if applicable, is: Ionos I can login to a root shell on my machine (yes or no, or I don't know): Yes The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): Installed: 2.9.0-1 ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [September 13, 2024, 12:30pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/2 "2024-09-13T12:30:07Z")
Please provide the entire output of Certbot, preferably with the option `-v` for more verbose output. Just the output with "it failed" without actually mentioning _WHY_ it failed is kinda useless. 🙂 Also, from [crt.sh | meteoensevilla.es](https://crt.sh/?deduplicate=Y&q=meteoensevilla.es) and [crt.sh | meteosanjuan.com](https://crt.sh/?deduplicate=Y&q=meteosanjuan.com) it seems like you have some duplicate certificates: one certificate _just_ for the `www` subdomain **and** a certificate for both the `www` subdomain _and_ the apex domain name. Which makes the certificate with _just_ the `www` subdomain redundant/superfluous. Can you post the output of `sudo certbot certificates`? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 13, 2024, 12:37pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/3 "2024-09-13T12:37:05Z")
Also, there are multiple IPs involved: ```nohighlight Name: meteoensevilla.es Address: 212.227.90.101 Name: meteosanjuan.com Addresses: 2001:8d8:100f:f000::200 217.160.0.146 ``` Please ensure your server is at the correct IP. ---
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 13, 2024, 4:24pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/4 "2024-09-13T16:24:51Z")
use Google Translate to communicate so I hope I am understood. In the first message I did not want to put the output to the command that I used to do a certbot renewal drill: sudo certbot renew --dry-run I know I have SSL activated with my hosting and domain provider, which I have tried to revoke but it doesn't seem to work. Since I have two domains and only one of them covers me, that's why I decided to use Let's Encrypt. My lack of experience leads me to not knowing how to solve the problem. I attach the output of the sudo certbot certificates command root@ubuntu:~# sudo certbot certificates Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * Found the following certs: > Certificate Name: meteoensevilla.es > Serial Number: 45be2b4b68573a0888800c181d56edfccad > Key Type: ECDSA > Domains: meteoensevilla.es [meteosanjuan.com](http://meteosanjuan.com) www.meteoensevilla.es [www.meteosanjuan.com](http://www.meteosanjuan.com) > Expiry Date: 2024-12-12 06:22:21+00:00 (VALID: 89 days) > Certificate Path: /etc/letsencrypt/live/meteoensevilla.es/fullchain.pem > Private Key Path: /etc/letsencrypt/live/meteoensevilla.es/privkey.pem > > Certificate Name: [meteosanjuan.com](http://meteosanjuan.com) > Serial Number: 4ea831fdfe57b443862359ec2788238c413 > Key Type: ECDSA > Domains: [meteosanjuan.com](http://meteosanjuan.com) > Expiry Date: 2024-12-12 08:15:42+00:00 (VALID: 89 days) > Certificate Path: /etc/letsencrypt/live/meteosanjuan.com/fullchain.pem > Private Key Path: /etc/letsencrypt/live/meteosanjuan.com/privkey.pem > > Certificate Name: www.meteoensevilla.es > Serial Number: 4c594070eb3fffa82a490fc75ae483fa4aa > Key Type: ECDSA > Domains: www.meteoensevilla.es [www.meteosanjuan.com](http://www.meteosanjuan.com) > Expiry Date: 2024-12-12 06:40:19+00:00 (VALID: 89 days) > Certificate Path: /etc/letsencrypt/live/www.meteoensevilla.es/fullchain.pem > Private Key Path: /etc/letsencrypt/live/www.meteoensevilla.es/privkey.pem > > Certificate Name: [www.meteosanjuan.com](http://www.meteosanjuan.com) > Serial Number: 490dc6a162bccaa81c677675034b53310e9 > Key Type: ECDSA > Domains: [www.meteosanjuan.com](http://www.meteosanjuan.com) > Expiry Date: 2024-11-29 21:44:11+00:00 (VALID: 77 days) > Certificate Path: /etc/letsencrypt/live/www.meteosanjuan.com/fullchain.pem > Private Key Path: /etc/letsencrypt/live/www.meteosanjuan.com/privkey.pem * * * root@ubuntu:~# ![ssl](https://global.discourse-cdn.com/letsencrypt/original/3X/b/1/b1b05c2d2508220bd569f2ea8aad3046809dc3cb.png) ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 13, 2024, 5:23pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/5 "2024-09-13T17:23:30Z")
Thank you for that info. Let us talk about one domain at a time. I do not believe you need a Let's Encrypt cert for your `meteosanjuan.com` domain (or its www subdomain). You have a redirect service at your hosting site that takes care of the cert for that name. And, it is working properly. Your hosting service uses a cert from DigiCert for that. Do you agree with this? If not please explain how you want `meteosanjuan.com` to work and we can talk about certificates. These are requests for your "home" page at that domain and you can see they redirect properly to `meteoensevilla.es` ```nohighlight curl -I http://meteosanjuan.com HTTP/1.1 302 Found Server: Apache Location: https://www.meteoensevilla.es curl -I https://meteosanjuan.com HTTP/2 302 location: https://www.meteoensevilla.es server: Apache ``` ---
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 13, 2024, 5:41pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/6 "2024-09-13T17:41:27Z")
In the contract with my hosting site I am only allowed one certificate, one of the domains would be left out. so I understand (maybe I'm wrong) that the redirect would not cover me. That is why it occurred to me to use the Let's Encrypt service. I know I'm not doing something right, but I don't know how to solve it. Thanks ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 13, 2024, 6:15pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/7 "2024-09-13T18:15:36Z")
> [@meteosanjuan](#): > > I know I'm not doing something right, but I don't know how to solve it. What do you think is not working? Because requests to all of your domains work correctly right now. Enter each of the names into an SSL Checker site like below. Enter both of your domain names and their www subdomains. They all validate correctly. One domain uses the DigiCert certificate and the other a Let's Encrypt cert. > **[SSL Checker](https://decoder.link/sslchecker)** > > Verify that your SSL certificate is installed correctly, identify installation issues if any. ---
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 13, 2024, 7:24pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/8 "2024-09-13T19:24:20Z")
I am concerned about the errors obtained when simulating the renewal when doing a drill: **sudo certbot renew --dry-run** Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet. 2024-09-13 21:15:07,960:DEBUG:certbot.\_internal.error\_handler:Encountered exception: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/certbot/\_internal/auth\_handler.py", line 108, in handle\_authorizations self.\_poll\_authorizations(authzrs, max\_retries, max\_time\_mins, best\_effort) File "/usr/lib/python3/dist-packages/certbot/\_internal/auth\_handler.py", line 212, in \_poll\_authorizations raise errors.AuthorizationError('Some challenges have failed.') certbot.errors.AuthorizationError: Some challenges have failed. 2024-09-13 21:15:07,960:DEBUG:certbot.\_internal.error\_handler:Calling registered functions 2024-09-13 21:15:07,960:INFO:certbot.\_internal.auth\_handler:Cleaning up challenges 2024-09-13 21:15:08,104:ERROR:certbot.\_internal.renewal:Failed to renew certificate [www.meteosanjuan.com](http://www.meteosanjuan.com) with error: Some challenges have failed. 2024-09-13 21:15:08,106:DEBUG:certbot.\_internal.renewal:Traceback was: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/certbot/\_internal/renewal.py", line 540, in handle\_renewal\_request main.renew\_cert(lineage\_config, plugins, renewal\_candidate) File "/usr/lib/python3/dist-packages/certbot/\_internal/main.py", line 1550, in renew\_cert renewed\_lineage = \_get\_and\_save\_cert(le\_client, config, lineage=lineage) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/certbot/\_internal/main.py", line 131, in \_get\_and\_save\_cert renewal.renew\_cert(config, domains, le\_client, lineage) File "/usr/lib/python3/dist-packages/certbot/\_internal/renewal.py", line 399, in renew\_cert new\_cert, new\_chain, new\_key, \_ = le\_client.obtain\_certificate(domains, new\_key) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/certbot/\_internal/client.py", line 428, in obtain\_certificate orderr = self.\_get\_order\_and\_authorizations(csr.data, self.config.allow\_subset\_of\_names) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/certbot/\_internal/client.py", line 496, in \_get\_order\_and\_authorizations authzr = self.auth\_handler.handle\_authorizations(orderr, self.config, best\_effort) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/certbot/\_internal/auth\_handler.py", line 108, in handle\_authorizations self.\_poll\_authorizations(authzrs, max\_retries, max\_time\_mins, best\_effort) File "/usr/lib/python3/dist-packages/certbot/\_internal/auth\_handler.py", line 212, in \_poll\_authorizations raise errors.AuthorizationError('Some challenges have failed.') certbot.errors.AuthorizationError: Some challenges have failed. 2024-09-13 21:15:08,112:DEBUG:certbot.\_internal.display.obj:Notifying user: * * * 2024-09-13 21:15:08,113:ERROR:certbot.\_internal.renewal:All simulated renewals failed. The following certificates could not be renewed: 2024-09-13 21:15:08,114:ERROR:certbot.\_internal.renewal: /etc/letsencrypt/live/meteoensevilla.es/fullchain.pem (failure) /etc/letsencrypt/live/meteosanjuan.com/fullchain.pem (failure) /etc/letsencrypt/live/www.meteoensevilla.es/fullchain.pem (failure) /etc/letsencrypt/live/www.meteosanjuan.com/fullchain.pem (failure) 2024-09-13 21:15:08,114:DEBUG:certbot.\_internal.display.obj:Notifying user: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 2024-09-13 21:15:08,114:DEBUG:certbot.\_internal.log:Exiting abnormally: Traceback (most recent call last): File "/usr/bin/certbot", line 33, in sys.exit(load\_entry\_point('certbot==2.9.0', 'console\_scripts', 'certbot')()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/certbot/main.py", line 19, in main return internal\_main.main(cli\_args) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/certbot/\_internal/main.py", line 1894, in main return config.func(config, plugins) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/certbot/\_internal/main.py", line 1642, in renew renewed\_domains, failed\_domains = renewal.handle\_renewal\_request(config) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/certbot/\_internal/renewal.py", line 568, in handle\_renewal\_request raise errors.Error( certbot.errors.Error: 4 renew failure(s), 0 parse failure(s) 2024-09-13 21:15:08,115:ERROR:certbot.\_internal.log:4 renew failure(s), 0 parse failure(s) ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 13, 2024, 8:25pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/9 "2024-09-13T20:25:39Z")
> [@meteosanjuan](#): > > I am concerned about the errors obtained when simulating the renewal when doing a drill: > **sudo certbot renew --dry-run** I understand that but I see you have 4 certificate profiles in Certbot but all of them are wrong. You must have changed something in your system configuration since you got some of these certs because they will not work today. I was trying to understand what you wanted so I could help you to success. I will make a guess as to the best fix and we can try more from there. Would you show the contents of this file ```nohighlight /etc/letsencrypt/renewal/meteoensevilla.es.conf ``` ---
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 13, 2024, 10:01pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/10 "2024-09-13T22:01:08Z")
Of course, yes to whatever you ask me. I am very grateful to you. I know little, but I learn and take note of everything, so that it doesn't happen to me again. In my server (VPS) / folder there are 4 files: "meteosevilla.es" "[meteosanjuan.com](http://meteosanjuan.com)" "www.meteoensevilla.es" "[www.meteosanjuan.com](http://www.meteosanjuan.com)" The content of /etc/letsencrypt/renewal/meteoensevilla.es.conf: ```nohighlight # renew_before_expiry = 30 days version = 2.9.0 archive_dir = /etc/letsencrypt/archive/meteoensevilla.es cert = /etc/letsencrypt/live/meteoensevilla.es/cert.pem privkey = /etc/letsencrypt/live/meteoensevilla.es/privkey.pem chain = /etc/letsencrypt/live/meteoensevilla.es/chain.pem fullchain = /etc/letsencrypt/live/meteoensevilla.es/fullchain.pem # Options used in the renewal process [renewalparams] account = 879e47d92751f04edd6d6011d7b246d1 authenticator = apache installer = apache server = https://acme-v02.api.letsencrypt.org/directory key_type = ecdsa ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 13, 2024, 10:37pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/11 "2024-09-13T22:37:43Z")
Okay. Try this command. It is a test only. Please show the output. It should ask you if you intend to remove domains from the cert. You should confirm that is okay for this test. ```nohighlight sudo certbot certonly --apache --dry-run --cert-name meteoensevilla.es -d meteosevilla.es -d www.meteosevilla.es ``` ---
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 13, 2024, 11:24pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/12 "2024-09-13T23:24:03Z")
This is the answer: The line "Some challenges have failed" appears in red root@ubuntu:~# sudo certbot certonly --apache --dry-run --cert-name meteoensevil la.es -d meteosevilla.es -d www.meteosevilla.es Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * You are updating certificate meteoensevilla.es to include new domain(s): - meteosevilla.es - www.meteosevilla.es You are also removing previously included domain(s): - meteoensevilla.es - [meteosanjuan.com](http://meteosanjuan.com) - www.meteoensevilla.es - [www.meteosanjuan.com](http://www.meteosanjuan.com) Did you intend to make this change? * * * (U)pdate certificate/(C)ancel: U Simulating renewal of an existing certificate for meteosevilla.es and www.meteosevilla.es Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems: Domain: meteosevilla.es Type: unauthorized Detail: 185.176.40.98: Invalid response from [http://meteosevilla.es/.well-known/acme-challenge/szm0Tl1QwY9nao2jH7FCDK6GMyDJmg4TSSMhvBGn2aI:](http://meteosevilla.es/.well-known/acme-challenge/szm0Tl1QwY9nao2jH7FCDK6GMyDJmg4TSSMhvBGn2aI:) 404 Domain: www.meteosevilla.es Type: unauthorized Detail: 185.176.40.98: Invalid response from [http://www.meteosevilla.es/.well-known/acme-challenge/wHMcISOhXrl1btU3GrMEZggRrhgDgRjX5UPdpJlSGiE:](http://www.meteosevilla.es/.well-known/acme-challenge/wHMcISOhXrl1btU3GrMEZggRrhgDgRjX5UPdpJlSGiE:) 404 Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet. Some challenges have failed. Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 13, 2024, 11:31pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/13 "2024-09-13T23:31:15Z")
> [@meteosanjuan](#): > > sudo certbot certonly --apache --dry-run --cert-name meteoensevilla.es -d meteosevilla.es -d www.meteosevilla.es Yeah, sorry, there was a typo in that command. You had misspelled one of your domain names and I used that in the command. It should be: ```nohighlight sudo certbot certonly --apache --dry-run --cert-name meteoensevilla.es -d meteoensevilla.es -d www.meteoensevilla.es ``` ---
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 14, 2024, 7:08am UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/14 "2024-09-14T07:08:03Z")
In this case no errors have been generated. I understand that the [meteosanjuan.com](http://meteosanjuan.com) certificates have been cleaned because they are already working with DigiCert. The truth is that from my hosting provider's control panel I don't see anything regarding the certificate issued for meteosanjuan, in fact it appears as if it were not issued. Well, in any case, it is clear that it is and there is about a year left, so perhaps the prudent thing to do would be to wait. I pass you the output of the command: root@ubuntu:~# sudo certbot certonly --apache --dry-run --cert-name meteoensevil la.es -d meteoensevilla.es -d www.meteoensevilla.es Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * You are updating certificate meteoensevilla.es to include new domain(s): (None) You are also removing previously included domain(s): - [meteosanjuan.com](http://meteosanjuan.com) - [www.meteosanjuan.com](http://www.meteosanjuan.com) Did you intend to make this change? * * * (U)pdate certificate/(C)ancel: U Simulating renewal of an existing certificate for meteoensevilla.es and www.mete oensevilla.es The dry run was successful. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 14, 2024, 2:41pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/15 "2024-09-14T14:41:52Z")
Okay. Good. I am pretty sure the `meteosanjuan` DigiCert is managed automatically by your hosting service. You showed your panel that said it was in a state of "Redirection". And, this domain name has DNS entries that point to a different server than your `meteoensevilla.es`. In short, you do not have to worry about meteosanjuan with "Redirection" enabled. Now we need to do two things. First, fix your ensevilla cert and then we will delete the others so the auto-renew runs without problem. Run this to fix it ```nohighlight sudo certbot --apache --cert-name meteoensevilla.es -d meteoensevilla.es -d www.meteoensevilla.es ``` As before, agree to update the cert with the domain name change ---
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 14, 2024, 5:25pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/16 "2024-09-14T17:25:35Z")
Well we're not going well. The page has remained in HTTP ERROR 500 > **[MeteoenSevilla](https://www.meteoensevilla.es)** > > Personal weather station. I understand that when redirecting to www.meteoensevilla it has been left without a certificate. I wonder if any changes had to be made (since [meteosanjuan.com](http://meteosanjuan.com) continues to appear) in the files: /etc/apache2/sites-available/000-default.conf and /etc/apache2/sites-available/your\_domain.conf This is the output to the command: root@ubuntu:~# sudo certbot --apache --cert-name meteoensevilla.es -d meteoensev illa.es -d www.meteoensevilla.es Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * You are updating certificate meteoensevilla.es to include new domain(s): (None) You are also removing previously included domain(s): - [meteosanjuan.com](http://meteosanjuan.com) - [www.meteosanjuan.com](http://www.meteosanjuan.com) Did you intend to make this change? * * * (U)pdate certificate/(C)ancel: U Renewing an existing certificate for meteoensevilla.es and www.meteoensevilla.es Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/meteoensevilla.es/fullchain.pem Key is saved at: /etc/letsencrypt/live/meteoensevilla.es/privkey.pem This certificate expires on 2024-12-13. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in t he background. Deploying certificate Successfully deployed certificate for meteoensevilla.es to /etc/apache2/sites-en abled/000-default.conf Successfully deployed certificate for www.meteoensevilla.es to /etc/apache2/sites-enabled/000-default.conf Your existing certificate has been successfully renewed, and the new certificate has been installed. * * * If you like Certbot, please consider supporting our work by: - Donating to ISRG / Let's Encrypt: [Additional Donation Information - Let's Encrypt](https://letsencrypt.org/donate) - Donating to EFF: [Support EFF's Work on Let's Encrypt | Electronic Frontier Foundation](https://eff.org/donate-le) * * * ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 14, 2024, 5:57pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/17 "2024-09-14T17:57:30Z")
> [@meteosanjuan](#): > > Well we're not going well. The page has remained in HTTP ERROR 500 That is not related to certificates. We can look at that later. Let us finish fixing your certs first. > [@meteosanjuan](#): > > I understand that when redirecting to www.meteoensevilla it has been left without a certificate. I don't know what that means. Your meteosanjuan is still redirecting properly to meteoensevilla. The certs for both are correct. > [@meteosanjuan](#): > > Your existing certificate has been successfully renewed, and the new certificate has been installed. This is very good. And, your Apache server is using the new cert. This new cert will also work for auto-renew. Do these to delete the unused certs. No worry. If needed they can be created again later but you don't need these now. ```nohighlight sudo certbot delete --cert-name meteosanjuan.com sudo certbot delete --cert-name www.meteoensevilla.es sudo certbot delete --cert-name www.meteosanjuan.com ``` If any errors for these commands please show that output. Once those are done show us output of this ```nohighlight sudo certbot renew --dry-run ``` ---
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 14, 2024, 6:02pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/18 "2024-09-14T18:02:07Z")
The redirection from [meteosanjuan.com](http://meteosanjuan.com) to meteoensevilla.es works, but meteoensevilla.es does not load the page, I don't know if I understand myself. > [@MikeMcQ](#): > > `sudo certbot renew --dry-run` root@ubuntu:~# sudo certbot renew --dry-run Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * Processing /etc/letsencrypt/renewal/meteoensevilla.es.conf * * * Simulating renewal of an existing certificate for meteoensevilla.es and www.meteoensevilla.es * * * Congratulations, all simulated renewals succeeded: /etc/letsencrypt/live/meteoensevilla.es/fullchain.pem (success) * * * ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [September 14, 2024, 6:28pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/19 "2024-09-14T18:28:05Z")
> [@meteosanjuan](#): > > Congratulations, all simulated renewals succeeded: Excellent. We have now solved the original problem. You have valid certs which work for auto-renew. You may see several emails from Let's Encrypt in about 60-70 days alerting you to certs that are expiring. This is because you created so many certs with different combinations of names that you are no longer using. Read those emails with care and the domain names it describes. > [@meteosanjuan](#): > > The redirection from `meteosanjuan.com` to meteoensevilla.es works, but meteoensevilla.es does not load the page Yes, that is because your Apache server replies with a "500 Internal Server Error" for requests to your home page. Your Apache replies properly for the cert challenges so something is affecting other requests to your server. Making Apache work for your "home" page is something best handled with an Apache support forum or your hosting service. But, I will take a quick look. Please show output of this command to start ```nohighlight sudo apache2ctl -t -D DUMP_VHOSTS ``` Just for your info below is how I test redirects. ```nohighlight # This http request for home page to sanjuan goes to https for ensevilla # Note just "Server: Apache" indicates your hosting "Redirect" service curl -i http://meteosanjuan.com HTTP/1.1 302 Found Server: Apache Location: https://www.meteoensevilla.es # Following that redirect gets the same 500 error as when trying ensevilla directly # Note "Server: Apache/2.4.58" is your Apache curl -i https://www.meteoensevilla.es HTTP/1.0 500 Internal Server Error Server: Apache/2.4.58 (Ubuntu) ``` For testing if the domains use the correct cert I use the link I provided earlier. All 4 of your domain names use the correct cert. See: [SSL Checker](https://decoder.link/sslchecker) ---
**Author:** ![meteosanjuan](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@meteosanjuan](https://community.letsencrypt.org/u/meteosanjuan)\ **Post date:** [September 14, 2024, 6:35pm UTC](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780/20 "2024-09-14T18:35:00Z")
I don't know why the problem has occurred. It used to work although it is true that it had a tremendous mess with the certificates. It is possible that the error is in the Apache configuration files, but I don't know how to resolve it. I hope you can help me, > [@MikeMcQ](#): > > `sudo apache2ctl -t -D DUMP_VHOSTS` root@ubuntu:~# sudo apache2ctl -t -D DUMP\_VHOSTS VirtualHost configuration: \*:80 127.0.0.1 (/etc/apache2/sites-enabled/000-default.conf:1) \*:443 is a NameVirtualHost default server [meteosanjuan.com](http://meteosanjuan.com) (/etc/apache2/sites-enabled/000-default-le-ssl.conf:2) port 443 namevhost [meteosanjuan.com](http://meteosanjuan.com) (/etc/apache2/sites-enabled/000-default-le-ssl.conf:2) port 443 namevhost [meteosanjuan.com](http://meteosanjuan.com) (/etc/apache2/sites-enabled/000-default.conf:12) port 443 namevhost [www.meteosanjuan.com](http://www.meteosanjuan.com) (/etc/apache2/sites-enabled/000-default.conf:18) port 443 namevhost meteoensevilla.es (/etc/apache2/sites-enabled/000-default.conf:27) port 443 namevhost www.meteoensevilla.es (/etc/apache2/sites-enabled/000-default.conf:36) [Next page](https://community.letsencrypt.org/t/certificate-renewal-simulation-failure/225780.md?page=2)