# Double Expiration Note And Failed Renewal **URL:** \ **Category:** Help\ **Created:** [September 21, 2017, 1:03am UTC](https://community.letsencrypt.org/t/double-expiration-note-and-failed-renewal/42688 "2017-09-21T01:03:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![daviceroy](https://avatars.discourse-cdn.com/v4/letter/d/4bbf92/32.png) [@daviceroy](https://community.letsencrypt.org/u/daviceroy)\ **Post date:** [September 21, 2017, 1:03am UTC](https://community.letsencrypt.org/t/double-expiration-note-and-failed-renewal/42688/1 "2017-09-21T01:03:41Z")
I think I ended up screwing up the original creation of the certificate because it seems to have 2 certificates and I’m not sure how to remove one so that I can renew the other. I got two emails about expiration. One email: Your certificate (or certificates) for the names listed below will expire in 9 days (on 30 Sep 17 01:53 +0000). Please make sure to renew your certificate before then, or visitors to your website will encounter errors. [loveagamer.com](http://loveagamer.com) [mail.loveagamer.com](http://mail.loveagamer.com) [www.loveagamer.com](http://www.loveagamer.com) 2nd Email: Your certificate (or certificates) for the names listed below will expire in 19 days (on 03 Oct 17 22:59 +0000). Please make sure to renew your certificate before then, or visitors to your website will encounter errors. [beta.nflpicks.org](http://beta.nflpicks.org) [bugs.pandoraproject.net](http://bugs.pandoraproject.net) [coloniesgame.net](http://coloniesgame.net) [loveagamer.com](http://loveagamer.com) [mail.coloniesgame.net](http://mail.coloniesgame.net) [mail.loveagamer.com](http://mail.loveagamer.com) [mail.nflpicks.org](http://mail.nflpicks.org) [mail.pandoraproject.net](http://mail.pandoraproject.net) [mail.secfenia.org](http://mail.secfenia.org) [mail.trinitywar.net](http://mail.trinitywar.net) [my.pandoraproject.net](http://my.pandoraproject.net) [nflpicks.org](http://nflpicks.org) [pandoraproject.net](http://pandoraproject.net) [trinitywar.net](http://trinitywar.net) [www.coloniesgame.net](http://www.coloniesgame.net) [www.loveagamer.com](http://www.loveagamer.com) [www.nflpicks.org](http://www.nflpicks.org) [www.pandoraproject.net](http://www.pandoraproject.net) [www.trinitywar.net](http://www.trinitywar.net) * * * Command Line used: certbot renew It came back with a bunch of invalid tls challenge: Domain: [bugs.pandoraproject.net](http://bugs.pandoraproject.net) Type: unauthorized Detail: Incorrect validation certificate for tls-sni-01 challenge. Requested 8b7b92082e35c6d4e9fc43f373ddbc5f.183befc0f307f236e0603a1cf2b93012.acme.invalid from 23.92.30.62:443. Received 2 certificate(s), first certificate had names “[beta.nflpicks.org](http://beta.nflpicks.org), [bugs.pandoraproject.net](http://bugs.pandoraproject.net), [coloniesgame.net](http://coloniesgame.net), [loveagamer.com](http://loveagamer.com), [mail.coloniesgame.net](http://mail.coloniesgame.net), [mail.loveagamer.com](http://mail.loveagamer.com), [mail.nflpicks.org](http://mail.nflpicks.org), [mail.pandoraproject.net](http://mail.pandoraproject.net), [mail.secfenia.org](http://mail.secfenia.org), [mail.trinitywar.net](http://mail.trinitywar.net), [my.pandoraproject.net](http://my.pandoraproject.net), [nflpicks.org](http://nflpicks.org), [pandoraproject.net](http://pandoraproject.net), [trinitywar.net](http://trinitywar.net), [www.coloniesgame.net](http://www.coloniesgame.net), [www.loveagamer.com](http://www.loveagamer.com), [www.nflpicks.org](http://www.nflpicks.org), [www.pandoraproject.net](http://www.pandoraproject.net), [www.trinitywar.net](http://www.trinitywar.net)” Ubuntu 16.04 LTS Apache I have Shell Access, but not sure how to fix this issue. ---
**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\ **Post date:** [September 21, 2017, 1:21am UTC](https://community.letsencrypt.org/t/double-expiration-note-and-failed-renewal/42688/2 "2017-09-21T01:21:06Z")
> [@daviceroy](#): > > it seems to have 2 certificates What does `certbot certificates` say? > [@daviceroy](#): > > I got two emails about expiration. If you "add domains to a certificate" you actually create a new one, and due to a limitation on Let's Encrypt's side you end up getting expiration e-mails for the old one. But certbot replaces your old certificate with your new one, so there might not be two certificates on your system. The command above will allow you to check this. > [@daviceroy](#): > > Detail: Incorrect validation certificate for tls-sni-01 challenge. Did you recently add any sort of CDN, proxy, or load balancer to the affected domain(s)? Apache must be listening directly on port 443 at the IP address listed for your A record for tls-sni-01 verification to work. Any sort of middle-man will break it and cause this error. ---
**Author:** ![daviceroy](https://avatars.discourse-cdn.com/v4/letter/d/4bbf92/32.png) [@daviceroy](https://community.letsencrypt.org/u/daviceroy)\ **Post date:** [September 21, 2017, 2:14am UTC](https://community.letsencrypt.org/t/double-expiration-note-and-failed-renewal/42688/3 "2017-09-21T02:14:44Z")
Certbot certificates says: "Found the following certs: Certificate Name: [loveagamer.com](http://loveagamer.com) Domains: [pandoraproject.net](http://pandoraproject.net),[beta.nflpicks.org](http://beta.nflpicks.org),[bugs.pandoraproject.net](http://bugs.pandoraproject.net),[coloniesgame.net](http://coloniesgame.net),[loveagamer.com](http://loveagamer.com),[mail.coloniesgame.net](http://mail.coloniesgame.net),[mail.loveagamer.com](http://mail.loveagamer.com),[mail.nflpicks.org](http://mail.nflpicks.org),[mail.pandoraproject.net](http://mail.pandoraproject.net),[mail.secfenia.org](http://mail.secfenia.org),[mail.trinitywar.net](http://mail.trinitywar.net),[my.pandoraproject.net](http://my.pandoraproject.net),[nflpicks.org](http://nflpicks.org),[trinitywar.net](http://trinitywar.net),[www.coloniesgame.net](http://www.coloniesgame.net),[www.loveagamer.com](http://www.loveagamer.com),[www.nflpicks.org](http://www.nflpicks.org),[www.pandoraproject.net](http://www.pandoraproject.net),[www.trinitywar.net](http://www.trinitywar.net) Expiry Date: 2017-10-03 22:59:00+00:00 (VALID: 12 days) Certificate Path: /etc/letsencrypt/live/loveagamer.com/fullchain.pem Private Key Path: /etc/letsencrypt/live/loveagamer.com/privkey.pem" However, the error says in renew: "Received 2 certificate(s), first certificate" > [@Patches](#): > > Did you recently add any sort of CDN, proxy, or load balancer to the affected domain(s)? Apache must be listening directly on port 443 at the IP address listed for your A record for tls-sni-01 verification to work. Any sort of middle-man will break it and cause this error. I do have a CDN on the Secfenia domain, but had it when I did the original certificate. If this is the potential break point, what is the work around for this? Is there another challenge I can use? ---
**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\ **Post date:** [September 21, 2017, 4:28am UTC](https://community.letsencrypt.org/t/double-expiration-note-and-failed-renewal/42688/4 "2017-09-21T04:28:43Z")
> [@daviceroy](#): > > Certbot certificates says: certbot is working with one certificate. You can safely ignore the other e-mail. > [@daviceroy](#): > > I do have a CDN on the Secfenia domain, but had it when I did the original certificate. It would only fail for that domain. I doubt you have the CDN enabled for the mail subdomain, so it should work. I actually think you have > [@daviceroy](#): > > “Received 2 certificate(s), first certificate” This is actually a clue, but not how you think. Ordinarily this would indicate that the domain uses SNI, and the default certificate that is used for clients that don't support SNI is the second one it is talking about. But I checked your domain, and it does not have a second certificate, so I think the second certificate the ACME server is talking about is actually the `acme.invalid` certificate the validation server is looking for. Are there any duplicate/conflicting VirtualHost entries in your Apache configuration? If nothing seems out of the ordinary, you could share your Apache configuration files and we might be able to identify what is tripping it up. > [@daviceroy](#): > > Is there another challenge I can use? There are two other validation methods: `http-01` requires placing a file in your web serving directory for each domain (and dealing with any RewriteRules or authentication that may be in the way), while `dns-01` requires placing a TXT record in your DNS for each domain. To use http-01/webroot authentication, you would need to reissue the certificate, relisting all your domains again, and tell certbot the directory files are served to the Internet from, e.g. ``` sudo certbot -a webroot -i apache -w /var/www/example1.com -d example.com,www.example.com -w /var/www/sub.example2.com -d sub.example2.com ``` List `loveagamer.com` first to reuse the same certificate name. If you use linode DNS for all your domains (I only checked one), dns-01 is a feasible option, but only the [acme.sh](https://github.com/Neilpang/acme.sh) and [dehydrated](https://github.com/lukas2511/dehydrated) clients have support for its API; unfortunately certbot doesn't. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [September 21, 2017, 4:39am UTC](https://community.letsencrypt.org/t/double-expiration-note-and-failed-renewal/42688/5 "2017-09-21T04:39:35Z")
> [@Patches](#): > > This is actually a clue, but not how you think. Ordinarily this would indicate that the domain uses SNI, and the default certificate that is used for clients that don’t support SNI is the second one it is talking about. But I checked your domain, and it does not have a second certificate, so I think the second certificate the ACME server is talking about is actually the acme.invalid certificate the validation server is looking for. Hi @Patches, I don't agree with your interpretation here — normally the "two certificates" are the end-entity certificate and the chain certificate. (I agree that this situation arises when a server sends its default certificate chain, but the two certificates are almost always the two certificates _in that chain_, not the `acme.invalid` certificate together with some other certificate.) I tried connecting to this host with `openssl s_client -connect loveagamer.com:443 -servername test.invalid` and I see two certificates which are indeed the default end-entity certificate plus the Let's Encrypt X3 intermediate, typical of other hosts with an existing HTTPS listener that fail TLS-SNI-01 challenges. This doesn't necessarily affect the overall diagnosis or advice, but I just wanted to point out this clarification about what the "two certificates" are in this situation. ---
**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\ **Post date:** [September 21, 2017, 5:07am UTC](https://community.letsencrypt.org/t/double-expiration-note-and-failed-renewal/42688/6 "2017-09-21T05:07:34Z")
That makes sense. 😳 Now that I understand Boulder’s error message, I suspect your server just isn’t set up for SNI. Does the following line exist anywhere in your Apache configuration? ``` NameVirtualHost *:443 ``` If not, does validation work if you add it? (You can stick it in an existing `` if desired but it should otherwise be defined at the top-level and not in any ``.) Apache will probably warn you that this line is unneeded (and that may be why you may have removed it at some point since validation last worked) but you can safely ignore that, because you do need it from time to time. ---
**Author:** ![daviceroy](https://avatars.discourse-cdn.com/v4/letter/d/4bbf92/32.png) [@daviceroy](https://community.letsencrypt.org/u/daviceroy)\ **Post date:** [September 22, 2017, 2:22am UTC](https://community.letsencrypt.org/t/double-expiration-note-and-failed-renewal/42688/7 "2017-09-22T02:22:23Z")
Here is an example of one of my SSL Apache Configs: ``` ServerAdmin support@nflpicks.org ServerName nflpicks.org ServerAlias www.nflpicks.org DocumentRoot /web/nflpicks/public_html ErrorLog /web/nflpicks/logs/error.log CustomLog /web/nflpicks/logs/access.log combined Require all granted RewriteEngine on # Some rewrite rules in this file were disabled on your HTTPS site, # because they have the potential to create redirection loops. SSLCertificateFile /etc/letsencrypt/live/loveagamer.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/loveagamer.com/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf ``` Hope that helps and thank you for your help so far. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 22, 2017, 2:36am UTC](https://community.letsencrypt.org/t/double-expiration-note-and-failed-renewal/42688/8 "2017-10-22T02:36:52Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.