Early renewal for bncert (bitnami)

Hallo! Is there a procedure to do it starting from bitnami in Amazon AWS? Thanks a lot!

1 Like

Thanks for your reply!

One more last question...

After using those commend to renew, will it be automatically renewed as like before?

1 Like

Yes. Note the renew --days 90 flag at the end of the command below.

sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="DOMAIN" --path="/opt/bitnami/letsencrypt" renew --days 90

Ensure the renew --days 90 is lowered (to normal), or removed from the command, after this one-time reissuance.
[or it will be trying to reissue all certs each and every day]


Sorry for the confusion.

I mean, is it auto-renewing like when using bncert-tool?
In other words, is it automatically updated every time regardless of the 90-day period?

We are on Lightsail and the following worked for us.

To check for the account ID:

sudo nano /opt/bitnami/letsencrypt/accounts/acmev02.api.letsencrypt.org/email@domain.com/account.json

*replace email address

To renew

1. sudo /opt/bitnami/ctlscript.sh stop
2. sudo /opt/bitnami/letsencrypt/lego --tls --email=email@domain.com --domains=domain.com --path="/opt/bitnami/letsencrypt" renew --days 90
3. sudo /opt/bitnami/ctlscript.sh start

*replace email address and domain.com


For sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="DOMAIN" --path="/opt/bitnami/letsencrypt" renew --days 90 it is giving me following error.

Incorrect Usage. flag provided but not defined: -domanis

   lego - Let's Encrypt client written in Go

   lego [global options] command [command options] [arguments...]


   run      Register an account, then create and install a certificate
   revoke   Revoke a certificate
   renew    Renew a certificate
   dnshelp  Shows additional help for the '--dns' global option
   list     Display certificates and accounts information.
   help, h  Shows a list of commands or help for one command

   --domains value, -d value    Add a domain to the process. Can be specified multiple times.
   --server value, -s value     CA hostname (and optionally :port). The server certificate must be trusted in order to avoid further modifications to the client. (default: "https://acme-v02.api.letsencrypt.org/directory")
   --accept-tos, -a             By setting this flag to true you indicate that you accept the current Let's Encrypt terms of service.
   --email value, -m value      Email used for registration and recovery contact.
   --csr value, -c value        Certificate signing request filename, if an external CSR is to be used.
   --eab                        Use External Account Binding for account registration. Requires --kid and --hmac.
   --kid value                  Key identifier from External CA. Used for External Account Binding.
   --hmac value                 MAC key from External CA. Should be in Base64 URL Encoding without padding format. Used for External Account Binding.
   --key-type value, -k value   Key type to use for private keys. Supported: rsa2048, rsa4096, rsa8192, ec256, ec384. (default: "ec256")
   --filename value             (deprecated) Filename of the generated certificate.
   --path value                 Directory to use for storing the data. (default: "/home/bitnami/.lego") [$LEGO_PATH]
   --http                       Use the HTTP challenge to solve challenges. Can be mixed with other types of challenges.
   --http.port value            Set the port and interface to use for HTTP based challenges to listen on.Supported: interface:port or :port. (default: ":80")
   --http.proxy-header value    Validate against this HTTP header when solving HTTP based challenges behind a reverse proxy. (default: "Host")
   --http.webroot value         Set the webroot folder to use for HTTP based challenges to write directly in a file in .well-known/acme-challenge. This disables the built-in server and expects the given directory to be publicly served with access to .well-known/acme-challenge
   --http.memcached-host value  Set the memcached host(s) to use for HTTP based challenges. Challenges will be written to all specified hosts.
   --tls                        Use the TLS challenge to solve challenges. Can be mixed with other types of challenges.
   --tls.port value             Set the port and interface to use for TLS based challenges to listen on. Supported: interface:port or :port. (default: ":443")
   --dns value                  Solve a DNS challenge using the specified provider. Can be mixed with other types of challenges. Run 'lego dnshelp' for help on usage.
   --dns.disable-cp             By setting this flag to true, disables the need to wait the propagation of the TXT record to all authoritative name servers.
   --dns.resolvers value        Set the resolvers to use for performing recursive DNS queries. Supported: host:port. The default is to use the system resolvers, or Google's DNS resolvers if the system's cannot be determined.
   --http-timeout value         Set the HTTP timeout value to a specific value in seconds. (default: 0)
   --dns-timeout value          Set the DNS timeout value to a specific value in seconds. Used only when performing authoritative name servers queries. (default: 10)
   --pem                        Generate a .pem file by concatenating the .key and .crt files together.
   --cert.timeout value         Set the certificate timeout value to a specific value in seconds. Only used when obtaining certificates. (default: 30)
   --help, -h                   show help
   --version, -v                print the version
2022/01/27 20:33:06 flag provided but not defined: -domanis

Looks like you made a typo in your command.


Oh. Thanks for noticing. Also one more question. Let's say I have domain rootdomain.com. I have www to non-www redirect setup currently and have two certificates issued with output of command sudo /opt/bitnami/letsencrypt/lego --path /opt/bitnami/letsencrypt list as

Found the following certs:
  Certificate Name: rootdomain.com
    Domains: rootdomain.com, www.rootdomain.com
    Expiry Date: 2021-12-02 04:18:27 +0000 UTC
    Certificate Path: /opt/bitnami/letsencrypt/certificates/rootdomain.com.crt

  Certificate Name: www.rootdomain.com
    Domains: rootdomain.com, www.rootdomain.com
    Expiry Date: 2022-04-12 23:00:13 +0000 UTC
    Certificate Path: /opt/bitnami/letsencrypt/certificates/www.rootdomain.com.crt

What should be value for --domains ?

You may have changed the name(s), so I can't be certain...
But it looks like both certs cover the exact same set of names.
If so, you don't need two certs to do the job one cert can do.
If the sites are truly unrelated, then I would use separate certs [one domain per cert].

1 Like

I don't remember explicitly creating two certificates but I just need one certificate for rootdomain.com and setup redirect from www to non-www rootdomain.com.

You now have two that cover that name.


Certificates don't do that.
Setup redirection in HTML (or .htaccess file).


Thanks for your clear answer!

I got a question regarding cron job after using the command.

Usually, bncert-tool command make certificate renew automatically every time.

So I'd like to check whether those command also make certificate renew automatically every time.

Is there any command to check for automatic job?

Thanks for your help!

1 Like

For an installation of Apache on Google Cloud Platform, and a range of apps, like Wordpress. I've successfully completed "early renewal" with the steps noted by Bitnami here:

Under, "Step 5: Renew the Let's Encrypt Certificate"

You need to check to be sure the domains you are renewing are matching what was previously installed, see the files at the path "/opt/bitnami/letsencrypt/certificates/" on your server to confirm. You can add a wildcard for instance, by just specifying the --domain option again and including the second domain (as noted on the guide linked above).

Path to this documentation on the Bitnami Docs Site is:
Bitnami Documentation > Google Cloud Platform > Bitnami How-To Guides for Google Cloud Platform > Generate and Install a Let's Encrypt SSL Certificate for a Bitnami Application

1 Like

Thank you.
This worked for me.
I use Bitnami WordPress, Lightsail instance....bncert tool.

1 Like

This method has resolved the issue an saved me a big time. Thank you @mousekepros

1 Like

Hi, i have renewed my cert using certbot (i just noticed that ssl are revoked for my project assignment website). It is renewed but i am facing this type of error sec_error_revoked_certificate. Can you help me with this? i dont know how to fix this error. This is my website www.fleurheart.com

My website run through aws lightsail Magento

Screenshot 2022-02-05 at 2.07.40 PM

Hi @zraznra and welcome to the LE community forum :slight_smile:

Please show the output of:
certbot certificates

1 Like

This is my SSL