Getting some kind of parse error now

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: marcchamberlin.com

I ran this command: (copy/paste kinda mucked this up, it is simply one long command line)

certbot certonly -debug --dry-run -v -c /etc/letsencrypt/letsencrypt_forApache/cli.ini --config-dir /etc/letsencrypt/letsencrypt_forApache --webroot -w /websites/home/marc/marcchamberlin.com -d marcchamberlin.com -d www.marcchamberlin.com -d ftp.marcchamberlin.com -d ssh.marcchamberlin.com -d vnc.marcchamberlin.com -d mail.marcchamberlin.com -d smtp.marcchamberlin.com -d imap.marcchamberlin.com -d pop3.marcchamberlin.com

It produced this output:

usage:
certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates. By default,
it will attempt to use a webserver both for obtaining and installing the
certificate.
certbot: error: unrecognized arguments: --ftp.marcchamberlin.com,=\ --vnc.marcchamberlin.com,=\ --mail.marcchamberlin.com,=imap.marcchamberlin.com, \ --pop3.marcchamberlin.com,=smtp.marcchamberlin.com --agree-eula=True

My web server is (include version):

httpd -v
Server version: Apache/2.4.51 (Linux/SUSE)
Server built: 2023-03-10 12:56:22.000000000 +0000

The operating system my web server runs on is (include version):

Operating System: openSUSE Leap 15.4
KDE Plasma Version: 5.24.4
KDE Frameworks Version: 5.90.0
Qt Version: 5.15.2
Kernel Version: 5.14.21-150400.24.97-default (64-bit)
Graphics Platform: X11
Processors: 12 � Intel� Xeon� CPU E5-1650 v3 @ 3.50GHz
Memory: 62.7 GiB of RAM
Graphics Processor: Quadro K420/PCIe/SSE2

My hosting provider, if applicable, is: N/A

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot --version
certbot 1.22.0

I dunno why but I am getting some sort of parsing error as can be seen from the output of the certbot command I am using. Because so many changes are taking place with my sub domains, I am simply trying to start over, and have removed most of the old certificates and associated certbot directories under /etc/certbot and /etc/letsencrypt. (On my system, /etc/certbot is a symlink to /etc/letsencrypt) The certbot command is a variation of the command I originally used to set up my original certificates, so I think it is correct and cannot find anything wrong with it. Maybe two eyes will prove to be better than one!

My Apache2 cli.ini (with comments removed) is shown below, hopefully that will prove to be helpful also.

rsa-key-size = 4096
server = https://acme-v02.api.letsencrypt.org/directory
email = marc@marcchamberlin.com
domains = marcchamberlin.com, www.marcchamberlin.com, \
ftp.marcchamberlin.com, \
vnc.marcchamberlin.com, \
mail.marcchamberlin.com, imap.marcchamberlin.com, \
pop3.marcchamberlin.com, smtp.marcchamberlin.com
agree-eula = True
agree-tos = True
renew-by-default = True
preferred-challenges = http
webroot-path = /websites/home/marc/marcchamberlin.com
max-log-backups = 0
work-dir = /var/lib/letsencrypt/letsencrypt_forApache
config-dir = /etc/letsencrypt/letsencrypt_forApache

Any ideas on what I am missing? Kinda got me stuck! Much appreciate any and all offers to help me out, thanks in advance.

 Marc...
2

Welcome back. Are you following some kind of (flawed) tutorial? There are a few things wrong here:

  • You are needlessly repeating domains argument both on the command line and in the cli.ini
  • You are specifying --config-dir that is inside of the default /etc/letsencrypt. Why?

Did this exact arrangement used to work previously? I'm not so sure \<newline> trick works in cli.ini, so you'll have to either.

  • make domains arg one big line
  • stop using cli.ini and just obtain certificate manually through the certbot invocation similar to the one you posted but dropping the -c arg.
3 Likes
3

^^ that looks like the culprit [to me]

1 Like
4

That cli.ini looks more like a Certbot cli.ini. Apache does not use that file.

Also, I would NOT recommend putting all those configurations into cli.ini.

ESPECIALLY renew-by-default IS A VERY BAD BAD BAD IDEA!!!

1 Like
5

Since you are starting over, it would be worth uninstalling that outdated version. You can find certbot 2.7.4 in an OpenSUSE community repo for OpenSUSE 15.5. If you aren't ready to upgrade your OS, the snap version or a pip installation (in a venv) are both reliable ways to obtain the current version of certbot.

3 Likes