Failure renew SSL

Help
1

root@ip-172-31-47-28:~# /opt/letsencrypt/certbot-auto renew
Your system is not supported by certbot-auto anymore.
certbot-auto and its Certbot installation will no longer receive updates.
You will not receive any bug fixes including those fixing server compatibility
or security problems.
Please visit https://certbot.eff.org/ to check for other alternatives.
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/library.mominoun.com.conf

Attempting to parse the version 1.12.0 renewal configuration file found at /etc/letsencrypt/renewal/library.mominoun.com.conf with version 1.9.0 of Certbot. This might not work.
Cert is due for renewal, auto-renewing...
Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',)
Attempting to renew cert (library.mominoun.com) from /etc/letsencrypt/renewal/library.mominoun.com.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',). Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/library.mominoun.com/fullchain.pem (failure)

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/library.mominoun.com/fullchain.pem (failure)

1 renew failure(s), 0 parse failure(s)
root@ip-172-31-47-28:~#

My domain is: library.mominoun.com

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

1 Like
2

Firstly, Happy Cake Day! :slightly_smiling_face:

(You'll notice that there's a :cake: next to your username indicating that it has been 2 years since you joined our community.)

As for the trouble you're facing, you're trying to use the manual authenticator with the renew command, which won't work unless you supply scripts via hook parameters to setup and cleanup the necessary challenge(s).

What is the content of this file?

/etc/letsencrypt/renewal/library.mominoun.com.conf

2 Likes
3

thank you very much for replying
really I don't know
just use Aws amazon for that
so what now what should I do for this issu

2 Likes
4

the content of this file

/etc/letsencrypt/renewal/library.mominoun.com.conf

is

renew_before_expiry = 30 days

version = 1.12.0
archive_dir = /etc/letsencrypt/archive/library.mominoun.com
cert = /etc/letsencrypt/live/library.mominoun.com/cert.pem
privkey = /etc/letsencrypt/live/library.mominoun.com/privkey.pem
chain = /etc/letsencrypt/live/library.mominoun.com/chain.pem
fullchain = /etc/letsencrypt/live/library.mominoun.com/fullchain.pem

Options used in the renewal process

[renewalparams]
authenticator = manual
account = d9f0dcad015bf70443d8b1819f9d6121
server = https://acme-v02.api.letsencrypt.org/directory
installer = nginx

1 Like
5

So, I did a little digging and it looks like GoDaddy is both the registrar and DNS provider for mominoun.com. As GoDaddy DNS plugin support is currently very limited for certbot, let's try something else first.

What's the output of this command?

sudo certbot-auto certonly --nginx -d "library.mominoun.com" --dry-run

2 Likes
6

root@ip-172-31-47-28:~# sudo certbot certonly --nginx -d "library.mominoun.com" --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Simulating renewal of an existing certificate for library.mominoun.com
The dry run was successful.
root@ip-172-31-47-28:~#
root@ip-172-31-47-28:~#

1 Like
7

Beautiful! :smiley:

Let's try this command then:

sudo certbot --cert-name library.mominoun.com --nginx -d "library.mominoun.com,ec2-34-255-45-199.eu-west-1.compute.amazonaws.com"

1 Like
8

when i run this command the nginx failed

Job for nginx.service failed because the control process exited with error code. See "systemctl status nginx.service" and "journalctl -xe" for details.
root@ip-172-31-47-28:~# systemctl status nginx.service
● nginx.service - nginx - high performance web server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: en
Active: failed (Result: exit-code) since Fri 2021-06-04 19:02:46 UTC; 1min 5s
Docs: nginx documentation
Process: 4759 ExecStop=/bin/kill -s TERM $MAINPID (code=exited, status=0/SUCCE
Process: 5172 ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf (code=exited,
Main PID: 18940 (code=exited, status=0/SUCCESS)

Jun 04 19:02:45 ip-172-31-47-28 nginx[5172]: nginx: [emerg] bind() to [::]:443 f
Jun 04 19:02:46 ip-172-31-47-28 nginx[5172]: nginx: [emerg] bind() to 0.0.0.0:80
Jun 04 19:02:46 ip-172-31-47-28 nginx[5172]: nginx: [emerg] bind() to [::]:80 fa
Jun 04 19:02:46 ip-172-31-47-28 nginx[5172]: nginx: [emerg] bind() to 0.0.0.0:44
Jun 04 19:02:46 ip-172-31-47-28 nginx[5172]: nginx: [emerg] bind() to [::]:443 f
Jun 04 19:02:46 ip-172-31-47-28 nginx[5172]: nginx: [emerg] still could not bind
Jun 04 19:02:46 ip-172-31-47-28 systemd[1]: nginx.service: Control process exite
Jun 04 19:02:46 ip-172-31-47-28 systemd[1]: Failed to start nginx - high perform
Jun 04 19:02:46 ip-172-31-47-28 systemd[1]: nginx.service: Unit entered failed s
Jun 04 19:02:46 ip-172-31-47-28 systemd[1]: nginx.service: Failed with result 'e
lines 1-18/18 (END)

1 Like
9

Which command caused the failure?

1 Like
10

sudo certbot-auto certonly --nginx -d "library.mominoun.com" --dry-run

1 Like
11

root@ip-172-31-47-28:~# sudo certbot --cert-name library.mominoun.com --nginx -d "library.mominoun.com,ec2-34-255-45-199.eu-west-1.compute.amazonaws.com"
Saving debug log to /var/log/letsencrypt/letsencrypt.log

You are updating certificate library.mominoun.com to include new domain(s):

You are also removing previously included domain(s):
(None)

Did you intend to make this change?

(U)pdate certificate/(C)ancel: U
Renewing an existing certificate for library.mominoun.com and ec2-34-255-45-199.eu-west-1.compute.amazonaws.com
An unexpected error occurred:
The server will not issue certificates for the identifier :: Error creating new order :: Cannot issue for "ec2-34-255-45-199.eu-west-1.compute.amazonaws.com": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
root@ip-172-31-47-28:~#

1 Like
12

Interesting... :thinking:

What's the output of this command?

sudo nginx -s reload

After that, what's the output of this command?

sudo nginx -T

2 Likes
13

Ah... we will get back to that in a moment. Not a problem.

1 Like
14

root@ip-172-31-47-28:~# sudo nginx -s reload
nginx: [error] open() "/var/run/nginx.pid" failed (2: No such file or directory)
root@ip-172-31-47-28:~# sudo nginx -T
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

configuration file /etc/nginx/nginx.conf:

user nginx;
worker_processes 1;

error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
worker_connections 1024;
}

http {
include /etc/nginx/mime.types;
include /etc/nginx/sites-enabled/*;

default_type  application/octet-stream;
1 Like
15

OK. Looking good so far.

What's the output of this command?

sudo certbot --cert-name library.mominoun.com --nginx -d "library.mominoun.com"

2 Likes
16

root@ip-172-31-47-28:~# sudo certbot --cert-name library.mominoun.com --nginx -d "library.mominoun.com"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for library.mominoun.com
Encountered exception during recovery: certbot.errors.MisconfigurationError: nginx restart failed:
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] still could not bind()
nginx restart failed:
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] still could not bind()

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
root@ip-172-31-47-28:~#
root@ip-172-31-47-28:~#

1 Like
17

Yike!

Let's see the output of this:

sudo nginx

2 Likes
18

root@ip-172-31-47-28:~# sudo nginx
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
nginx: [emerg] bind() to [::]:443 failed (98: Address already in use)
nginx: [emerg] still could not bind()
root@ip-172-31-47-28:~#
root@ip-172-31-47-28:~#

1 Like
19

Let's clear the world.

ps aux | grep '[n]ginx' | awk '{print $2}'

2 Likes
20

root@ip-172-31-47-28:~# ps aux | grep '[n]ginx' | awk '{print $2}'
5092
5096
5180

1 Like