Error cannot load certificate "/etc/letsencrypt/live/domainname/fullchain.pem"

Ok, let’s start over.

Check that your dns edits have been propagated and tell me which tutorial you’re trying to follow.

You should uninstall certbot from the host machine (and nginx too) – don’t remove their data yet.

1 Like

I’ve checked my DNS edits by testing the record set:

image

So I should only do: sudo yum remove certbot python2-certbot-nginx

What after that?

After that, you try getting some certs with the script you have.

remove or stop nginx on the host. (or anything else that’s bound to port 80, maybe another copy of that container docker-compose down --remove-orphans)

I've removed all the containter but it still seems something is running because when I run: ps -eaf | grep 5231

systemctl status nginx

systemctl disable --now nginx :wink:

Still the same, status gives this:

● nginx.service - The nginx HTTP and reverse proxy server
   Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled; vendor preset: disabled)
   Active: inactive (dead)

then I run the second command and nothing happens and when I run this for more details:

sudo netstat -tlnp | grep 80

try

docker ps

maybe?

and then docker stop anything you don’t like

I stopped all containters, this is docker ps -a (empty):

Ok. and is there still a rogue nginx running on port 80?

I’ve solved that with: sudo lsof -t -i tcp:80 -s tcp:listen | sudo xargs kill

Now I have the same error I had before + the one from docker-compose…

I’ve run that script I showed you in posts before.

Connection refused.

Meaning “there’s a firewall somewhere blocking validation”

Please be aware that your domain points to some website with a cPanel-issued certificate https://www.gotobot.co/ – are you sure that your dns is pointing the right way?

(your dns ttl is ~15k seconds, more than four hours, OMG. if you did not do that on purpose, lower it, lower it a lot – to 600-1800 seconds, I’d say)

1 Like

Well I’ve told you I set my A record to my AWS EC2 public ip so I think that should be OK?

Can I somehow verify that further?

Also where can I modify my DNS TTL? :smiley:

it should be ok. the ttl should be somewhere close, it’s part of the A record.

image

It was set to this?

Any ideas how I can solve that error from the image?

Ignore this ttl stuff, your config is ok. It was my resolver doing stuff.

The error in the last image could be transient, you could retry and see if it disappears.

did you check if this is ok, though?

Yes I know that but that is only MX record set.

I tried multiple times to rerun it and it didn’t work…

you’ll have to wait. I can see that record in caches around the world but not in your authoritative servers. try again ~tomorrow (in 14000 seconds at least)

Okay, but do you maybe think I should somehow add some permission in that script that I sent you so they can see those files because they actually exist so I don’t understand the issue.