Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:domain.com
I ran this command: sudo certbot certonly --standalone --preferred-challenges http -d domain.com
It produced this output:
IMPORTANT NOTES:
Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/domain.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/domain.com/privkey.pem
Your cert will expire on 2021-08-12. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew all of your certificates, run
"certbot renew"
If you like Certbot, please consider supporting our work by:
i am using this cmd to check expiry details.
ssl-cert-check -c /etc/letsencrypt/live/[your_domain_name]/fullchain.pem
I am trying to renew certs and the expiry date for fullchain.pem shows 12th aug and for privkey.pem it shows expired .
"unable to load and privkey.pem expired"
The error message is misleading.
In your command, where do you point it to the private key?
If it is only given the fullchain file, and requires the private key, it may fail.
[that said, be very careful with any unknown script that requires access to your private key file]
The -c option is to be used for certificates. It should not be used to input private keys into the application. I.e.: garbage in, garbage out. Although the tool probably should have more user input checking and error out with a message to the user that it should provide a certificate and not a private key.
You are only pointing to one file.
A certificate is comprised of, at least, two files (when in .pem format):
a private key
a publicly signed cert
I don't know how the script works, but it seems to fail when only one file is given.
OR
It fails even when the correct file is given (fullchain.pem).
In this case, it is likely due to the local certificate store being out-of-date.
ssl-cert-check
Usage: /usr/bin/ssl-cert-check [ -e email address ] [-E sender email address] [ -x days ] [-q] [-a] [-b] [-h] [-i] [-n] [-N] [-v]
{ [ -s common_name ] && [ -p port] } || { [ -f cert_file ] } || { [ -c cert file ] } || { [ -d cert dir ] }
-a : Send a warning message through E-mail
-b : Will not print header
-c cert file : Print the expiration date for the PEM or PKCS12 formatted certificate in cert file
-d cert directory : Print the expiration date for the PEM or PKCS12 formatted certificates in cert directory
-e E-mail address : E-mail address to send expiration notices
-E E-mail sender : E-mail address of the sender
-f cert file : File with a list of FQDNs and ports
-h : Print this screen
-i : Print the issuer of the certificate
-k password : PKCS12 file password
-n : Run as a Nagios plugin
-N : Run as a Nagios plugin and output one line summary (implies -n, requires -f or -d)
-p port : Port to connect to (interactive mode)
-s commmon name : Server to connect to (interactive mode)
-t type : Specify the certificate type
-q : Don't print anything on the console
-v : Specify a specific protocol version to use (tls, ssl2, ssl3)
-V : Only print validation data
-x days : Certificate expiration interval (eg. if cert_date < days)
yes when checked with fullchain it works fine
I am getting error while renewing certs , and thats why i was checking if any pem file got expired
getting following error
Attempting to renew cert (domain.com) from /etc/letsencrypt/renewal/domain.com.conf produced an unexpected error: Some challenges have failed.. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/domain.com/fullchain.pem (failure)
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/domain.com/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
IMPORTANT NOTES:
The following errors were reported by the server:
Domain: domain.com
Type: connection
Detail: Fetching Website Domain Names, Online Stores & Hosting | Domain.com
Timeout during connect (likely firewall problem)
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
As for the failure, try running certbot with -v, -vv, or -vvv until you see enough of a clue as to why it fails.
Feel free to post the LE logs here if you can't make heads/tails of the entries.
