# Found bug in my renewal script and have a queston **URL:** \ **Category:** Help\ **Created:** [April 14, 2023, 3:25pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454 "2023-04-14T15:25:11Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![dj423](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dj423](https://community.letsencrypt.org/u/dj423)\ **Post date:** [April 14, 2023, 3:25pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/1 "2023-04-14T15:25:11Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [mail.jewettfarm.com](http://mail.jewettfarm.com), [mail.jewettracing.com](http://mail.jewettracing.com), [mail.mail-lab.us](http://mail.mail-lab.us) I ran this command: certbot renew It produced this output: ERROR:certbot.\_internal.renewal:Failed to renew certificate [mail.jewettfarm.com](http://mail.jewettfarm.com) with error: [Errno 2] No such file or directory: '/etc/letsencrypt/archive/mail.jewettfarm.com/privkey6.pem' My web server is (include version): Nginx 1.18 The operating system my web server runs on is (include version): Ubuntu 20.04 My hosting provider, if applicable, is: Cloudflare for DNS-001 validation using plugin I can login to a root shell on my machine (yes or no, or I don't know): Yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): Certbot 2.5 I see my script was unable to locate a directory to save the privkey.pem file. I have corrected this. This got missed during a container migration process last week and I screwed up. My question, can I use the last acme response "-----BEGIN CERTIFICATE----" information I found in /var/log/letsencrypt/letsencrypt.log, since I am rate limited for 24 hours. Or am I stuck waiting? Thank you ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 14, 2023, 3:35pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/2 "2023-04-14T15:35:37Z")
You can retreive the certificate(s) from the logs indeed. Or use a service such as [https://crt.sh/](https://crt.sh/) although they are often overloaded and backlogged. Also, why would you be rate limited? Holy cow, looking at your certificate issuance ([https://crt.sh/?deduplicate=Y&q=mail.mail-lab.us](https://crt.sh/?deduplicate=Y&q=mail.mail-lab.us)), what are you DOING? Looks like you're getting a certificate almost DAILY? Why? ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 14, 2023, 3:37pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/3 "2023-04-14T15:37:16Z")
No, the privkey.pem is not included in the letsencrypt.log file You should be able to get a fresh cert tomorrow once your Apr8 cert "rolls off". But, you should quit getting a cert every day or so. Your cert history is here: [https://tools.letsdebug.net/cert-search?m=domain&q=mail.jewettfarm.com&d=744](https://tools.letsdebug.net/cert-search?m=domain&q=mail.jewettfarm.com&d=744) ---
**Author:** ![dj423](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dj423](https://community.letsencrypt.org/u/dj423)\ **Post date:** [April 14, 2023, 3:40pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/4 "2023-04-14T15:40:00Z")
Sorry, I forgot to add that info: It kept trying with the directory error that I did not catch until this morning. Max of 5 attempts was reached. > Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168 hours: [mail.jewettfarm.com](http://mail.jewettfarm.com),[mail.jewettracing.com](http://mail.jewettracing.com),[mail.mail-lab.us](http://mail.mail-lab.us), retry after 2023-04-15T07:12:49Z: see [Duplicate Certificate Limit - Let's Encrypt](https://letsencrypt.org/docs/duplicate-certificate-limit/) So in the logs I see two certificate strings, is the first the certificate, and second "----BEGIN CERTIFICATE----" block is the privkey file? Just need to know how to match them up. I can just paste them into new files in the correct path. Thanks! ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 14, 2023, 3:41pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/5 "2023-04-14T15:41:30Z")
> [@dj423](#): > > and second "----BEGIN CERTIFICATE----" block is the privkey file? No, that's a certificate, not a key. Keys are not logged. The second (and possibly third) certificates are the certificate chain. Also, as already said (in case you missed it above), please stop getting certs (almost) DAILY. Why are you doing that? ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 14, 2023, 3:41pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/6 "2023-04-14T15:41:54Z")
No, you actually got 5 certs in last week and that's the limit. See below. As I noted, the privkey is not in the log But please start using persistent storage to save your cert files. You have numerous un-expired certs outstanding. It's more than 20 certs just in the past 30 days > **[Duplicate Certificate Limit - Let's Encrypt](https://letsencrypt.org/docs/duplicate-certificate-limit/)** > > Description All issuance requests are subject to a Duplicate Certificate limit of 5 per week. You should receive an error message like the following from your ACME client when you’ve exceeded the Duplicate Certificate limit: > too many certificates (5)... ---
**Author:** ![dj423](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dj423](https://community.letsencrypt.org/u/dj423)\ **Post date:** [April 14, 2023, 3:49pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/7 "2023-04-14T15:49:35Z")
Yes, I am digging into why on the daily renewals, they are set to cron monthly at the most. So something is off. Killing the cron jobs for now till I get this sorted out. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 14, 2023, 3:51pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/8 "2023-04-14T15:51:45Z")
> [@dj423](#): > > they are set to cron monthly at the most. You should not do just monthly renewal attempts. If it fails due to comms or LE issue you won't try again until the next month which might be too late. The recommendation is to use `certbot renew` daily. If the cert is not due for renewal nothing is done. You possibly have used --force-renewal or similar which often causes grief ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 14, 2023, 3:52pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/9 "2023-04-14T15:52:02Z")
Usually this is due to the usage of the `--force-renewal` option. ---
**Author:** ![dj423](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dj423](https://community.letsencrypt.org/u/dj423)\ **Post date:** [April 14, 2023, 4:02pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/10 "2023-04-14T16:02:18Z")
No, the main issue is the directory where the certs are stored was moved, and I missed this in my review of the changes. For clarity, here are the lines that run from the cron job script: /usr/bin/certbot certonly -d [mail.jewettfarm.com](http://mail.jewettfarm.com) -d [mail.mail-lab.us](http://mail.mail-lab.us) -d [mail.jewettracing.com](http://mail.jewettracing.com) --manual-public-ip-logging-ok -n --preferred-chain "ISRG Root X1" --agree-tos --register-unsafely-without-email --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini I have moved the /etc/letsencrypt/archive/mail.jewettracing.com directory to it's proper location. Somehow it was renamed as "[mail.jewettfarm.com](http://mail.jewettfarm.com)" and the initial certs were pulled in under [mail.jewettracing.com](http://mail.jewettracing.com) - so the renewal had no place to write. I am fixing these issues, just wanted to know if I can somehow manually update the certs with one of the many it has already been sent. Sorry for the confusion. I need to add my email to the command string so I get these notifications sooner. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 14, 2023, 4:06pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/11 "2023-04-14T16:06:18Z")
> [@dj423](#): > > This got missed during a container migration process last week and I screwed up. Here you say the migration was "last week", but your "daily" certificate issuance is going on since 2023-03-13 already? That's not 1 week earlier, but 1 month? So I'm not fully convinced. Or multiple things are going wrong, starting 2023-03-13, that's possible too of course. > [@dj423](#): > > just wanted to know if I can somehow manually update the certs with one of the many it has already been sent. Certs? Sure. Private keys? Nope, not with Certbot 2.5. With Certbot 2.2.0 or earlier, the private keys were saved in `/keys/`, but you're using 2.5 so no private keys were saved except for in `/archive/`. ---
**Author:** ![dj423](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dj423](https://community.letsencrypt.org/u/dj423)\ **Post date:** [April 14, 2023, 4:24pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/12 "2023-04-14T16:24:22Z")
> [@Osiris](#): > > but you're using 2.5 so no private keys were saved except for in `/archive/`. and that is the directory that was moved - so it seems to have been stuck in a loop somehow since it could not write to the archive path. ---
**Author:** ![dj423](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dj423](https://community.letsencrypt.org/u/dj423)\ **Post date:** [April 14, 2023, 4:26pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/13 "2023-04-14T16:26:07Z")
> [@Osiris](#): > > That's not 1 week earlier, but 1 month? So I'm not fully convinced. Or multiple things are going wrong, starting 2023-03-13, that's possible too of course. This may be when the directories were renamed initially, breaking the script process. So a multitude of issues. ---
**Author:** ![dj423](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dj423](https://community.letsencrypt.org/u/dj423)\ **Post date:** [April 14, 2023, 4:33pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/14 "2023-04-14T16:33:35Z")
Sorry if this is a duplicate, but this is the event that seems to have started this mess back in March: ```plaintext ERROR:certbot._internal.renewal:Failed to renew certificate mail.jewettfarm.com with error: [Errno 2] No such file or directory: '/etc/letsencrypt/archive/mail.jewettfarm.com/privkey6.pem' FileNotFoundError: [Errno 2] No such file or directory: '/etc/letsencrypt/archive/mail.jewettfarm.com/privkey6.pem' ``` Still don't know what it was running daily yet, but this seems to be the trigger point. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 14, 2023, 4:49pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/15 "2023-04-14T16:49:01Z")
> [@dj423](#): > > Still don't know what it was running daily yet Running twice a day is recommended currently, so that's fine. But usually Certbot is able to store the issued cert, except when that's not possible, e.g. due to your migration issue. With [ARI](https://datatracker.ietf.org/doc/draft-ietf-acme-ari/01/) it might be recommended to run your ACME client even more frequent! It's probably a good idea to have your cronjob setup so it'll notify the responsible person(s) when a cronjob fails when it shouldn't. ---
**Author:** ![dj423](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dj423](https://community.letsencrypt.org/u/dj423)\ **Post date:** [April 14, 2023, 4:58pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/16 "2023-04-14T16:58:19Z")
Thanks for the help guys. This has been a learning experience for sure, never move certificates path!! Yes, I am an idiot. lol ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 14, 2023, 5:05pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/17 "2023-04-14T17:05:15Z")
Usually one just transfers the entire `/etc/letsencrypt/` directory using e.g. `rsync` with the `--archive` option or `tar`. It's also perfectly possible to use e.g. `cp` but you'd want to use the `--archive` option for that one too. ---
**Author:** ![dj423](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dj423](https://community.letsencrypt.org/u/dj423)\ **Post date:** [April 14, 2023, 8:11pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/18 "2023-04-14T20:11:21Z")
So I thought I would try the workaround in [Duplicate Certificate Limit - Let's Encrypt (letsencrypt.org)](https://letsencrypt.org/docs/duplicate-certificate-limit/) It renewed the cert for [mail.jewettfarm.com](http://mail.jewettfarm.com), however the private key does not match the certificate in the new directory it created. Oh and it saved the fullchain.pem file as a file and not a symlink, the symlink is named fullchain.pem.orig. So im stumped. Guess I have to wait. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 14, 2023, 8:24pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/19 "2023-04-14T20:24:18Z")
What does this show? ```plaintext certbot certificates ``` ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [April 14, 2023, 8:26pm UTC](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454/20 "2023-04-14T20:26:11Z")
> [@dj423](#): > > For clarity, here are the lines that run from the cron job script: It seems as though all of that could be replaced with a simple `certbot renew`. Why are you doing it this way? [Next page](https://community.letsencrypt.org/t/found-bug-in-my-renewal-script-and-have-a-queston/196454.md?page=2)