Early renewal for bncert (bitnami)

Help
1

Hi,

I applied "sudo /opt/bitnami/bncert-tool" for automatic renew.

If I also need to renew my certificate, what should I do?

2

I am using the bncert tool to manage the certs and it will not allow me to renew as the cert was issued 6 weeks ago.

3

On AWS I'm using sudo /opt/bitnami/bncert-tool, but it does not update the certificate dates. Anyone have a lead on forcing renewal?

1 Like
4

I am using LetsEncrypt on Amazon Lightsail (certificate issued using sudo /opt/bitnami/bncert-tool), will I be required to renew it manually or will it be automatic once the other gets removed?

5

I am not familiar with bn-cert but most ACME clients are not capable of renewing a certificate when the active one is revoked. You will need to manually renew your certificate before the revocation deadline to ensure an uninterrupted experience for your site visitors.

2 Likes
6

I found something on cyberciti.biz that suggests using "sudo certbot renew"

That indeed seems to update the certificate dates, but checking on various SSL sites and the Firefox plugin the old dates are still shown. Is it usual for there to be a propagation delay for certificates?

7

Try this site for certbot use: https://www.cyberciti.biz/faq/how-to-forcefully-renew-lets-encrypt-certificate/

Basically, the easiest approach is "sudo certbot renew"

If that doesn't work, try "sudo certbot renew --force-renewal"

9

I am not sure what client lightsail/ bitnami/AWS use. It might depend on each user’s installation guide. I am glad this worked for you!

If your renewal was successful and the certificate was updated on disk, then you probably need to reload your webserver to start using the certificate.

3 Likes
10

The issue is that the cert cannot be renewed because the renewal date has not been reached.

11

Yes, this will be true for many certificates affected by the TLS-ALPN-01 issue. Most clients set the renewal period to attempt renewal beginning at 30 days before expiry and if your certificate doesn’t meet that won’t requirement it won’t renew and utilize Let’s Encrypt resources unnecessarily. However, clients often have a flag or configuration option to change that and “force renew”. For certbot the command line argument is --force-renewal

2 Likes
12

This worked for me for my lightsail instance in AWS. See steps for " Renew a Let's Encrypt certificate installed using bncert-tool or Lego tool":

5 Likes
14

Thanks for your help.

If I registered for the domains like example.com, www.example.com

Then should I put "example.com, www.example.com" in "EMAIL-ADDRESS"?

2 Likes
15

yes this works for users who used /opt/bitnami/bncert-tool! Worked for my bitnami wordpress ec2 instance. (not lightsail) The dates were updated :+1:
Thank you

3 Likes
16

Thank you so much for posting this documentation.

1 Like
17

you only need to provide the root domain (i.e. example.com)

18

worked for me as well.

19

Hallo! Is there a procedure to do it starting from bitnami in Amazon AWS? Thanks a lot!

1 Like
20

Thanks for your reply!

One more last question...

After using those commend to renew, will it be automatically renewed as like before?

1 Like
21

Yes. Note the renew --days 90 flag at the end of the command below.

sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="DOMAIN" --path="/opt/bitnami/letsencrypt" renew --days 90
22

Ensure the renew --days 90 is lowered (to normal), or removed from the command, after this one-time reissuance.
[or it will be trying to reissue all certs each and every day]

2 Likes