# "certificate verify failed" error when renewing

**URL:** <https://community.letsencrypt.org/t/certificate-verify-failed-error-when-renewing/167621>\
**Category:** Help\
**Created:** [December 13, 2021, 6:52pm UTC](https://community.letsencrypt.org/t/certificate-verify-failed-error-when-renewing/167621 "2021-12-13T18:52:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dacmann](https://avatars.discourse-cdn.com/v4/letter/d/9f8e36/32.png) [@dacmann](https://community.letsencrypt.org/u/dacmann)\
**Post date:** [December 13, 2021, 6:52pm UTC](https://community.letsencrypt.org/t/certificate-verify-failed-error-when-renewing/167621/1 "2021-12-13T18:52:06Z")

</div>

My domain is: [dacworld.net](http://dacworld.net)

I ran this command: sudo certbot renew

It produced this output: Attempting to renew cert ([dacworld.net](http://dacworld.net)) from /etc/letsencrypt/renewal/dacworld.net.conf produced an unexpected error: ("bad handshake: Error([('SSL routines', 'ssl3\_get\_server\_certificate', 'certificate verify failed')],)",).

My web server is (include version): ??

The operating system my web server runs on is (include version): Ubuntu LTS 16.04

My hosting provider, if applicable, is: A2hosting

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 0.31.0

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [December 13, 2021, 7:02pm UTC](https://community.letsencrypt.org/t/certificate-verify-failed-error-when-renewing/167621/2 "2021-12-13T19:02:11Z")

</div>

@dacmann I've moved your post into its own thread instead of in someone elses.

---

<div class="post-metadata">

**Author:** ![dacmann](https://avatars.discourse-cdn.com/v4/letter/d/9f8e36/32.png) [@dacmann](https://community.letsencrypt.org/u/dacmann)\
**Post date:** [December 13, 2021, 7:29pm UTC](https://community.letsencrypt.org/t/certificate-verify-failed-error-when-renewing/167621/3 "2021-12-13T19:29:45Z")

</div>

Thanks @Osiris, my website's certificate is now expired. Who can help me with this?

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [December 13, 2021, 7:49pm UTC](https://community.letsencrypt.org/t/certificate-verify-failed-error-when-renewing/167621/4 "2021-12-13T19:49:07Z")

</div>

You most likely are missing the `ISRG Root X1` from the system CA root store.

For Ubuntu 16, this explains how to update that. It has helped others with this Ubuntu version

> [@Bad handshake error during renew](https://community.letsencrypt.org/t/bad-handshake-error-during-renew/165366/2):
>
> …

If that does not work, let us know and we can proceed gathering more info

---

<div class="post-metadata">

**Author:** ![dacmann](https://avatars.discourse-cdn.com/v4/letter/d/9f8e36/32.png) [@dacmann](https://community.letsencrypt.org/u/dacmann)\
**Post date:** [December 13, 2021, 7:54pm UTC](https://community.letsencrypt.org/t/certificate-verify-failed-error-when-renewing/167621/5 "2021-12-13T19:54:09Z")

</div>

Thanks @MikeMcQ! After running those updates, I was able to complete the renewal.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [January 12, 2022, 7:54pm UTC](https://community.letsencrypt.org/t/certificate-verify-failed-error-when-renewing/167621/6 "2022-01-12T19:54:25Z")

</div>

Closed on January 12, 2022, 7:54pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.