# Got email, Action required: Let's Encrypt certificate renewals **URL:** \ **Category:** Help\ **Created:** [January 30, 2019, 8:26am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678 "2019-01-30T08:26:43Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![santosh](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@santosh](https://community.letsencrypt.org/u/santosh)\ **Post date:** [January 30, 2019, 8:26am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/1 "2019-01-30T08:26:43Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [jobs.klimb.io](http://jobs.klimb.io) I ran this command: sudo certbot renew --dry-run It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * ## Processing /etc/letsencrypt/renewal/jobs.klimb.io.conf Cert not due for renewal, but simulating renewal for dry run Plugins selected: Authenticator apache, Installer apache Renewing an existing certificate Performing the following challenges: http-01 challenge for [jobs.klimb.io](http://jobs.klimb.io) Waiting for verification… Cleaning up challenges * * * ## new certificate deployed with reload of apache server; fullchain is /etc/letsencrypt/live/jobs.klimb.io/fullchain.pem * * * \*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry \*\* (The test certificates below have not been saved.) ## Congratulations, all renewals succeeded. The following certs have been renewed: /etc/letsencrypt/live/jobs.klimb.io/fullchain.pem (success) \*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry \*\* (The test certificates above have not been saved.) My web server is (include version): Apache2 The operating system my web server runs on is (include version): ubuntu 14.0 My hosting provider, if applicable, is: AWS I can login to a root shell on my machine (yes or no, or I don’t know): Yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): certbot 0.22.2 i checked this file cat jobs.klimb.io.conf # renew\_before\_expiry = 30 days version = 0.22.2 archive\_dir = /etc/letsencrypt/archive/jobs.klimb.io cert = /etc/letsencrypt/live/jobs.klimb.io/cert.pem privkey = /etc/letsencrypt/live/jobs.klimb.io/privkey.pem chain = /etc/letsencrypt/live/jobs.klimb.io/chain.pem fullchain = /etc/letsencrypt/live/jobs.klimb.io/fullchain.pem # Options used in the renewal process [renewalparams] authenticator = apache account = #################### (actual id not given for security) installer = apache and pref\_challs = http-01 is not available in jobs.klimb.io.conf . please need your help. Awaiting your reply ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 30, 2019, 8:28am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/2 "2019-01-30T08:28:41Z")
> [@santosh](#): > > http-01 challenge for [jobs.klimb.io](http://jobs.klimb.io) Looks good. > [@santosh](#): > > certbot 0.22.2 You should upgrade using these instructions: [https://certbot.eff.org/lets-encrypt/ubuntutrusty-apache](https://certbot.eff.org/lets-encrypt/ubuntutrusty-apache) That should be the only thing you need to do. ---
**Author:** ![santosh](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@santosh](https://community.letsencrypt.org/u/santosh)\ **Post date:** [January 30, 2019, 8:30am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/3 "2019-01-30T08:30:12Z")
Is it mandatory to upgrade certbot. if, after upgrading it, will it automatically config https-01? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 30, 2019, 8:32am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/4 "2019-01-30T08:32:32Z")
According to your dry run, Certbot is already not using TLS-SNI-01. So if you did nothing right now, everything would keep working. If you don’t want to upgrade, nobody is forcing you, but it’s a good idea. ---
**Author:** ![santosh](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@santosh](https://community.letsencrypt.org/u/santosh)\ **Post date:** [January 30, 2019, 8:37am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/5 "2019-01-30T08:37:03Z")
Thank you for your immediate response. appreciated. but yesterday again a received an email i.e Your Let’s Encrypt client used ACME TLS-SNI-01 domain validation to issue a certificate in the past 60 days. Below is a list of names and IP addresses validated (max of one per account): [jobs.klimb.io](http://jobs.klimb.io/) (xxx.xx.xxx.xxx) on 2018-12-26. no idea why even i got this email, worrying… ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [January 30, 2019, 8:41am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/6 "2019-01-30T08:41:48Z")
I know the email is a bit spooky, but there is a plausible explanation for having received it and not having to take action: > [@Action required: Let's Encrypt certificate renewals but certbot shows OK](https://community.letsencrypt.org/t/action-required-lets-encrypt-certificate-renewals-but-certbot-shows-ok/84302/8): > > S… If you want to be especially cautious - upgrade Certbot. ---
**Author:** ![santosh](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@santosh](https://community.letsencrypt.org/u/santosh)\ **Post date:** [January 30, 2019, 8:46am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/7 "2019-01-30T08:46:16Z")
Many thanks dear @_az🤗 ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 31, 2019, 1:10am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/8 "2019-01-31T01:10:29Z")
According to the email: A client form that IP used TLS-SNI-01. According to the `--dry-run`: Your client is able to use HTTP-01. So… I believe both are true; and can be true when: The client prefers to use TLS-SNI-01; But can also use HTTP-01 (as fallback). [like its’ already set to use: `--preferred_challenges https,http,dns`] ---
**Author:** ![santosh](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@santosh](https://community.letsencrypt.org/u/santosh)\ **Post date:** [January 31, 2019, 6:04am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/9 "2019-01-31T06:04:39Z")
Appreciated @rg305, Many Thanks. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 2, 2019, 6:04am UTC](https://community.letsencrypt.org/t/got-email-action-required-lets-encrypt-certificate-renewals/84678/10 "2019-03-02T06:04:47Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.