Error renew certificate on Ubuntu VPS

jtbmedia · March 24, 2022, 12:40pm

My domain is:
ticketservice.shop

I ran this command:
certbot renew

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/ticketservice.shop-0001.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/renewal.py", line 65, in _reconstitute
    renewal_candidate = storage.RenewableCert(full_path, config)
  File "/usr/lib/python3/dist-packages/certbot/storage.py", line 465, in __init__
    self._check_symlinks()
  File "/usr/lib/python3/dist-packages/certbot/storage.py", line 522, in _check_symlinks
    raise errors.CertStorageError(
certbot.errors.CertStorageError: expected /etc/letsencrypt/live/ticketservice.shop-0001/cert.pem to be a symlink
Renewal configuration file /etc/letsencrypt/renewal/ticketservice.shop-0001.conf is broken. Skipping.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/ticketservice.shop-0002.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/renewal.py", line 65, in _reconstitute
    renewal_candidate = storage.RenewableCert(full_path, config)
  File "/usr/lib/python3/dist-packages/certbot/storage.py", line 465, in __init__
    self._check_symlinks()
  File "/usr/lib/python3/dist-packages/certbot/storage.py", line 522, in _check_symlinks
    raise errors.CertStorageError(
certbot.errors.CertStorageError: expected /etc/letsencrypt/live/ticketservice.shop-0002/cert.pem to be a symlink
Renewal configuration file /etc/letsencrypt/renewal/ticketservice.shop-0002.conf is broken. Skipping.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/ticketservice.shop-0003.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/renewal.py", line 65, in _reconstitute
    renewal_candidate = storage.RenewableCert(full_path, config)
  File "/usr/lib/python3/dist-packages/certbot/storage.py", line 465, in __init__
    self._check_symlinks()
  File "/usr/lib/python3/dist-packages/certbot/storage.py", line 522, in _check_symlinks
    raise errors.CertStorageError(
certbot.errors.CertStorageError: expected /etc/letsencrypt/live/ticketservice.shop-0003/cert.pem to be a symlink
Renewal configuration file /etc/letsencrypt/renewal/ticketservice.shop-0003.conf is broken. Skipping.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/ticketservice.shop.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.')
Attempting to renew cert (ticketservice.shop) from /etc/letsencrypt/renewal/ticketservice.shop.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.'). Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/ticketservice.shop/fullchain.pem (failure)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/ticketservice.shop/fullchain.pem (failure)

Additionally, the following renewal configurations were invalid:
  /etc/letsencrypt/renewal/ticketservice.shop-0001.conf (parsefail)
  /etc/letsencrypt/renewal/ticketservice.shop-0002.conf (parsefail)
  /etc/letsencrypt/renewal/ticketservice.shop-0003.conf (parsefail)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 3 parse failure(s)

My web server is (include version):
nginx newest version

The operating system my web server runs on is (include version):
ubuntu 20.04.3 LTS

My hosting provider, if applicable, is:
Digital Ocean Ubuntu droplet

I can login to a root shell on my machine (yes or no, or I don't know):

YES

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot 0.40.0

The server is running a wordpress multisite with some shopdomains. Please help me understand why it isn't renewing.

danb35 · March 24, 2022, 1:01pm

You're running quite an old version of certbot, but that isn't likely to be your immediate problem--the bigger problem is that it looks like you've been doing some manual messing around in the /etc/letsencrypt directory. Let's see what all is there. Can you give the output of ls -lR /etc/letsencrypt/? Edit: and certbot certificates?

9peppe · March 24, 2022, 1:02pm

(or they downgraded certbot and the renewal conf belongs to a newer version)

jtbmedia · March 24, 2022, 2:18pm

/etc/letsencrypt/:
total 32
drwxr-xr-x 3 root root 4096 Oct 27 17:36 accounts
drwx------ 6 root root 4096 Mar 24 12:34 archive
-rw-r--r-- 1 root root  121 Feb 11  2019 cli.ini
drwxr-xr-x 2 root root 4096 Mar 24 12:32 csr
drwx------ 2 root root 4096 Mar 24 12:32 keys
drwx------ 3 root root 4096 Oct 27 18:03 live
drwxr-xr-x 2 root root 4096 Oct 27 18:03 renewal
drwxr-xr-x 5 root root 4096 Oct 27 17:36 renewal-hooks

/etc/letsencrypt/accounts:
total 4
drwxr-xr-x 3 root root 4096 Oct 27 17:36 acme-v02.api.letsencrypt.org

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org:
total 4
drwx------ 3 root root 4096 Oct 27 17:36 directory

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory:
total 4
drwx------ 2 root root 4096 Oct 27 17:36 7275f6af82aa27fd0a83d268824ab75a

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/7275f6af82aa27fd0a83d268824ab75a:
total 12
-rw-r--r-- 1 root root   78 Oct 27 17:36 meta.json
-r-------- 1 root root 1632 Oct 27 17:36 private_key.json
-rw-r--r-- 1 root root   79 Oct 27 17:36 regr.json

/etc/letsencrypt/archive:
total 16
drwxr-xr-x 2 root root 4096 Oct 27 17:58 ticketservice.shop
drwxr-xr-x 2 root root 4096 Oct 27 17:54 ticketservice.shop-0001
drwxr-xr-x 2 root root 4096 Oct 27 17:59 ticketservice.shop-0002
drwxr-xr-x 2 root root 4096 Oct 27 18:03 ticketservice.shop-0003

/etc/letsencrypt/archive/ticketservice.shop:
total 40
-rw-r--r-- 1 root root 1850 Oct 27 17:36 cert1.pem
-rw-r--r-- 1 root root 1883 Oct 27 17:58 cert2.pem
-rw-r--r-- 1 root root 3750 Oct 27 17:36 chain1.pem
-rw-r--r-- 1 root root 3750 Oct 27 17:58 chain2.pem
-rw-r--r-- 1 root root 5600 Oct 27 17:36 fullchain1.pem
-rw-r--r-- 1 root root 5633 Oct 27 17:58 fullchain2.pem
-rw------- 1 root root 1700 Oct 27 17:36 privkey1.pem
-rw------- 1 root root 1708 Oct 27 17:58 privkey2.pem

/etc/letsencrypt/archive/ticketservice.shop-0001:
total 20
-rw-r--r-- 1 root root 1858 Oct 27 17:54 cert1.pem
-rw-r--r-- 1 root root 3750 Oct 27 17:54 chain1.pem
-rw-r--r-- 1 root root 5608 Oct 27 17:54 fullchain1.pem
-rw------- 1 root root 1704 Oct 27 17:54 privkey1.pem

/etc/letsencrypt/archive/ticketservice.shop-0002:
total 20
-rw-r--r-- 1 root root 1883 Oct 27 17:59 cert1.pem
-rw-r--r-- 1 root root 3750 Oct 27 17:59 chain1.pem
-rw-r--r-- 1 root root 5633 Oct 27 17:59 fullchain1.pem
-rw------- 1 root root 1704 Oct 27 17:59 privkey1.pem

/etc/letsencrypt/archive/ticketservice.shop-0003:
total 20
-rw-r--r-- 1 root root 1883 Oct 27 18:03 cert1.pem
-rw-r--r-- 1 root root 3750 Oct 27 18:03 chain1.pem
-rw-r--r-- 1 root root 5633 Oct 27 18:03 fullchain1.pem
-rw------- 1 root root 1704 Oct 27 18:03 privkey1.pem

/etc/letsencrypt/csr:
total 84
-rw-r--r-- 1 root root 928 Oct 27 17:36 0000_csr-certbot.pem
-rw-r--r-- 1 root root 944 Oct 27 17:45 0001_csr-certbot.pem
-rw-r--r-- 1 root root 944 Oct 27 17:46 0002_csr-certbot.pem
-rw-r--r-- 1 root root 932 Oct 27 17:50 0003_csr-certbot.pem
-rw-r--r-- 1 root root 932 Oct 27 17:50 0004_csr-certbot.pem
-rw-r--r-- 1 root root 936 Oct 27 17:50 0005_csr-certbot.pem
-rw-r--r-- 1 root root 932 Oct 27 17:52 0006_csr-certbot.pem
-rw-r--r-- 1 root root 932 Oct 27 17:52 0007_csr-certbot.pem
-rw-r--r-- 1 root root 932 Oct 27 17:53 0008_csr-certbot.pem
-rw-r--r-- 1 root root 960 Oct 27 17:58 0009_csr-certbot.pem
-rw-r--r-- 1 root root 960 Oct 27 17:59 0010_csr-certbot.pem
-rw-r--r-- 1 root root 960 Oct 27 18:03 0011_csr-certbot.pem
-rw-r--r-- 1 root root 960 Mar 24 12:13 0012_csr-certbot.pem
-rw-r--r-- 1 root root 960 Mar 24 12:17 0013_csr-certbot.pem
-rw-r--r-- 1 root root 960 Mar 24 12:18 0014_csr-certbot.pem
-rw-r--r-- 1 root root 960 Mar 24 12:18 0015_csr-certbot.pem
-rw-r--r-- 1 root root 960 Mar 24 12:20 0016_csr-certbot.pem
-rw-r--r-- 1 root root 960 Mar 24 12:20 0017_csr-certbot.pem
-rw-r--r-- 1 root root 960 Mar 24 12:27 0018_csr-certbot.pem
-rw-r--r-- 1 root root 960 Mar 24 12:30 0019_csr-certbot.pem
-rw-r--r-- 1 root root 960 Mar 24 12:32 0020_csr-certbot.pem

/etc/letsencrypt/keys:
total 84
-rw------- 1 root root 1700 Oct 27 17:36 0000_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 17:45 0001_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 17:46 0002_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 17:50 0003_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 17:50 0004_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 17:50 0005_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 17:52 0006_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 17:52 0007_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 17:53 0008_key-certbot.pem
-rw------- 1 root root 1708 Oct 27 17:58 0009_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 17:59 0010_key-certbot.pem
-rw------- 1 root root 1704 Oct 27 18:03 0011_key-certbot.pem
-rw------- 1 root root 1704 Mar 24 12:13 0012_key-certbot.pem
-rw------- 1 root root 1708 Mar 24 12:17 0013_key-certbot.pem
-rw------- 1 root root 1704 Mar 24 12:18 0014_key-certbot.pem
-rw------- 1 root root 1708 Mar 24 12:18 0015_key-certbot.pem
-rw------- 1 root root 1704 Mar 24 12:20 0016_key-certbot.pem
-rw------- 1 root root 1704 Mar 24 12:20 0017_key-certbot.pem
-rw------- 1 root root 1704 Mar 24 12:27 0018_key-certbot.pem
-rw------- 1 root root 1704 Mar 24 12:30 0019_key-certbot.pem
-rw------- 1 root root 1704 Mar 24 12:32 0020_key-certbot.pem

/etc/letsencrypt/live:
total 8
-rw-r--r-- 1 root root  740 Oct 27 17:36 README
drwxr-xr-x 2 root root 4096 Oct 27 18:03 ticketservice.shop

/etc/letsencrypt/live/ticketservice.shop:
total 4
-rw-r--r-- 1 root root 692 Oct 27 18:03 README
lrwxrwxrwx 1 root root  47 Oct 27 18:03 cert.pem -> ../../archive/ticketservice.shop-0003/cert1.pem
lrwxrwxrwx 1 root root  48 Oct 27 18:03 chain.pem -> ../../archive/ticketservice.shop-0003/chain1.pem
lrwxrwxrwx 1 root root  52 Oct 27 18:03 fullchain.pem -> ../../archive/ticketservice.shop-0003/fullchain1.pem
lrwxrwxrwx 1 root root  50 Oct 27 18:03 privkey.pem -> ../../archive/ticketservice.shop-0003/privkey1.pem

/etc/letsencrypt/renewal:
total 16
-rw-r--r-- 1 root root 612 Oct 27 17:54 ticketservice.shop-0001.conf
-rw-r--r-- 1 root root 577 Oct 27 17:59 ticketservice.shop-0002.conf
-rw-r--r-- 1 root root 577 Oct 27 18:03 ticketservice.shop-0003.conf
-rw-r--r-- 1 root root 552 Oct 27 17:58 ticketservice.shop.conf

/etc/letsencrypt/renewal-hooks:
total 12
drwxr-xr-x 2 root root 4096 Oct 27 17:36 deploy
drwxr-xr-x 2 root root 4096 Oct 27 17:36 post
drwxr-xr-x 2 root root 4096 Oct 27 17:36 pre

/etc/letsencrypt/renewal-hooks/deploy:
total 0

/etc/letsencrypt/renewal-hooks/post:
total 0

/etc/letsencrypt/renewal-hooks/pre:
total 0

danb35 · March 24, 2022, 9:01pm

This is quite strange. You have renewal configuration files, and archived cert files, for four different certs: ticketservice.shop, ticketservice.shop-0001, ticketservice.shop-0002, and ticketservice.shop-0003. But you only have a live certificate directory for the first. Did you delete the other directories manually?

jtbmedia · March 25, 2022, 8:11am

Not that I am aware of. Could it be because this a wordpress multisite?

What is the best course of action?

danb35 · March 25, 2022, 10:48am

First, make a backup of /etc/letsencrypt. Then try certbot delete --cert-name ticketservice.shop-0001. If that succeeds, repeat for -0002 and -0003, and then try the renewal again.

jtbmedia · March 25, 2022, 11:23am

That didn't work out. Deleted al certificates including ticketservice.shop and generated a new one using.

sudo certbot certonly --manual --agree-tos --preferred-challenges dns -d ticketservice.shop -d *.ticketservice.shop

Then i got an rate limit error. Is it possible to circumvent that? The dry run is succesfull.

IMPORTANT NOTES:
 - The dry run was successful.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.

danb35 · March 25, 2022, 11:25am

For which rate limit? There are several, and some last as little as an hour.

Edit: and why did you delete a perfectly good certificate for ticketservice.shop?

jtbmedia · March 25, 2022, 12:03pm


An unexpected error occurred:
There were too many requests of a given type :: Error creating new order :: too                                       many certificates (5) already issued for this exact set of domains in the last 1                                      68 hours: *.ticketservice.shop,ticketservice.shop: see https://letsencrypt.org/d                                      ocs/rate-limits/

Because it wouldn't renew. After deleting it the error where gone in the dry-run.

danb35 · March 25, 2022, 12:54pm

But it did. Five times, all yesterday. I advised you to delete the broken certs; you deleted the perfectly valid cert as well. Wait a week, and you'll be able to create a new one.

system · April 24, 2022, 12:55pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
certbot.errors.CertStorageError: expected /etc/letsencrypt/live/vriezon-tel.werkonderweg.nl/fullchain.pem to be a symlink Help	7	1174	December 15, 2021
Attempt to Renew SSL Cert Help	32	760	September 16, 2023
Renewal failure after server migration Help	12	3081	January 27, 2019
Error rate limit when trying to renew Help	12	1124	June 4, 2019
Error renewing certificate Help	8	638	November 3, 2022

Error renew certificate on Ubuntu VPS

Related topics