How to remove a domain that's no longer on my server for SSL renewal?

Help
1

Hi everyone,

Recently we’ve run into an issue with renewing certificates for the site we’re hosting on one of our servers, when running the --renew command, we end up with this:

 Domain: bearandwait.com
   Type:   unauthorized
   Detail: Invalid response from
   http://bearandwait.com/.well-known/acme-challenge/8_BzbjCpj6OdCjaILRtX_1EYxfGenKmaPsV0Fy8Ytgg
   [94.126.40.35]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
   2.0//EN\">\n<html><head>\n<title>404 Not
   Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"

and also errors like this:

 Domain: warwickfirstresponders.org
   Type:   connection
   Detail: dns :: DNS problem: NXDOMAIN looking up A for
   warwickfirstresponders.org

Now I’m assuming these happen because in the list of domains given when running certbot, the domains in the errors above don’t appear (because they’re not on our server so I wouldn’t expect them to).

My issue is that I’m unable to renew the certificates for the rest of the sites because of ones like this, how can I go about fully removing all reference to these domains so that certbot doesn’t try to act on them?

Thanks

3 Likes
2

Can you post the output of “sudo certbot certificates”?

Certbot’s way to remove names is a little complicated. Basically, if you did:

sudo certbot --apache -d example.com -d www.example.com -d example.net -d www.example.net

to issue a certificate and save it in /etc/letsencrypt/live/example.com/, and you later want to remove www.example.net, you have to run:

sudo certbot --apache --cert-name example.com -d example.com -d www.example.com -d example.net

In other words, you run the same command, with all of the other options, with "--cert-name [certificate name]" added to specify which certificate you’re replacing.

3 Likes
3

I’ve run the certbot-auto script with the certificates command, this is the output:

Renewal configuration file /etc/letsencrypt/renewal/www.smithcoconsultancy.com-0001.conf produced an unexpected error: expected /etc/letsencrypt/live/www.smithcoconsultancy.com-0001/cert.pem to be a symlink. Skipping.
Invalid OCSP response status for /etc/letsencrypt/live/braceit.net/cert.pem: OCSPResponseStatus.UNAUTHORIZED
Invalid OCSP response status for /etc/letsencrypt/live/cem-toolkit.smithcoconsultancy.com/cert.pem: OCSPResponseStatus.UNAUTHORIZED
Invalid OCSP response status for /etc/letsencrypt/live/smithcoconsultancy.com/cert.pem: OCSPResponseStatus.UNAUTHORIZED

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: braceit.net-0001
    Domains: braceit.net braceit.uk cem-toolkit.smithcoconsultancy.com digital-hearing-solutions.co.uk gphearing.co.uk hearing-aid.co.uk hearingaidrepair.co.uk jacksonglass.co.uk mywealthdoctor.co.uk net-visibility-web-marketing.co.uk net-visibility-web-marketing.com net-visibility.co.uk netvisibility.co.uk netvisibility.com netvisibility.eu netvisibility.info netvisibility.net netvisibility.org netvisibility.us netvisibilitywebmarketing.co.uk netvisibilitywebmarketing.com netvisibilitywebmarketing.net nhs-digital-hear-aids.co.uk nhs-digital-hearing-aids.co.uk nhs-hearing-aids.co.uk nhs-hearing.co.uk smithcoconsultancy.com warwickshirehearts.org www.braceit.net www.braceit.uk www.digital-hearing-solutions.co.uk www.digital-hearing-solutions.com www.elite-hearing-solutions.co.uk www.elite-hearing-solutions.com www.elitehearingsolutions.co.uk www.elitehearingsolutions.com www.gphearing.co.uk www.hearing-aid-check.co.uk www.hearing-aid-test.co.uk www.hearing-aid.co.uk www.hearingaidrepair.co.uk www.jacksonglass.co.uk www.mywealthdoctor.co.uk www.n-h-s.org.uk www.national-hearing-sales.co.uk www.national-hearing-sales.com www.national-hearing-services.co.uk www.national-hearing-services.com www.national-hearing-solutions.co.uk www.national-hearing-solutions.com www.national-hearing-supplies.co.uk www.national-marketing.co.uk www.nationalhearingsales.co.uk www.nationalhearingservices.co.uk www.nationalhearingsolutions.co.uk www.nationalhearingsolutions.com www.nationalhearingsupplies.co.uk www.nationwide-hearing-services.co.uk www.nationwidehearingservices.co.uk www.net-visibility-web-marketing.co.uk www.net-visibility-web-marketing.com www.net-visibility.co.uk www.netvisibility.co.uk www.netvisibility.com www.netvisibility.eu www.netvisibility.info www.netvisibility.net www.netvisibility.org www.netvisibility.us www.netvisibilitywebmarketing.co.uk www.netvisibilitywebmarketing.com www.netvisibilitywebmarketing.net www.nhs-digital-hear-aids.co.uk www.nhs-digital-hearing-aids.co.uk www.nhs-hearing-aids.co.uk www.nhs-hearing.co.uk www.smithcoconsultancy.com www.warwickshirehearts.org
    Expiry Date: 2019-09-16 08:37:06+00:00 (VALID: 37 days)
    Certificate Path: /etc/letsencrypt/live/braceit.net-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/braceit.net-0001/privkey.pem
  Certificate Name: braceit.net-0002
    Domains: braceit.net braceit.uk digital-hearing-solutions.co.uk digital-hearing-solutions.com elite-hearing-solutions.co.uk elite-hearing-solutions.com elitehearingsolutions.co.uk elitehearingsolutions.com fcmilnes.co.uk fcmilnes.com gphearing.co.uk hearing-aid-check.co.uk hearing-aid-test.co.uk hearing-aid.co.uk hearingaidrepair.co.uk jacksonglass.co.uk mywealthdoctor.co.uk n-h-s.org.uk national-hearing-sales.co.uk national-hearing-sales.com national-hearing-services.co.uk national-hearing-services.com national-hearing-solutions.co.uk national-hearing-solutions.com national-hearing-supplies.co.uk national-marketing.co.uk nationalhearingsales.co.uk nationalhearingservices.co.uk nationalhearingsolutions.co.uk nationalhearingsolutions.com nationalhearingsupplies.co.uk nationwide-hearing-services.co.uk nationwidehearingservices.co.uk net-visibility-web-marketing.co.uk net-visibility-web-marketing.com net-visibility.co.uk netvisibility.co.uk netvisibility.com netvisibility.eu netvisibility.info netvisibility.net netvisibility.org netvisibility.us netvisibilitywebmarketing.co.uk netvisibilitywebmarketing.com netvisibilitywebmarketing.net nhs-digital-hear-aids.co.uk nhs-digital-hearing-aids.co.uk nhs-hearing-aids.co.uk nhs-hearing.co.uk www.braceit.net www.braceit.uk www.digital-hearing-solutions.co.uk www.digital-hearing-solutions.com www.elite-hearing-solutions.co.uk www.elite-hearing-solutions.com www.elitehearingsolutions.co.uk www.elitehearingsolutions.com www.fcmilnes.co.uk www.fcmilnes.com www.gphearing.co.uk www.hearing-aid-check.co.uk www.hearing-aid-test.co.uk www.hearing-aid.co.uk www.hearingaidrepair.co.uk www.jacksonglass.co.uk www.mywealthdoctor.co.uk www.n-h-s.org.uk www.national-hearing-sales.co.uk www.national-hearing-sales.com www.national-hearing-services.co.uk www.national-hearing-services.com www.national-hearing-solutions.co.uk www.national-hearing-solutions.com www.national-hearing-supplies.co.uk www.national-marketing.co.uk www.nationalhearingsales.co.uk www.nationalhearingservices.co.uk www.nationalhearingsolutions.co.uk www.nationalhearingsolutions.com www.nationalhearingsupplies.co.uk www.nationwide-hearing-services.co.uk www.nationwidehearingservices.co.uk www.net-visibility-web-marketing.co.uk www.net-visibility-web-marketing.com www.net-visibility.co.uk www.netvisibility.co.uk www.netvisibility.com www.netvisibility.eu www.netvisibility.info www.netvisibility.net www.netvisibility.org www.netvisibility.us www.netvisibilitywebmarketing.co.uk www.netvisibilitywebmarketing.com www.netvisibilitywebmarketing.net www.nhs-digital-hear-aids.co.uk www.nhs-digital-hearing-aids.co.uk www.nhs-hearing-aids.co.uk www.nhs-hearing.co.uk
    Expiry Date: 2019-11-07 09:31:18+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/braceit.net-0002/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/braceit.net-0002/privkey.pem
  Certificate Name: braceit.net
    Domains: braceit.eu braceit.net braceit.uk cem-toolkit.smithcoconsultancy.com digital-hearing-solutions.co.uk gphearing.co.uk hearing-aid.co.uk hearingaidrepair.co.uk mywealthdoctor.co.uk net-visibility-web-marketing.co.uk net-visibility-web-marketing.com net-visibility.co.uk netvisibility.co.uk netvisibility.com netvisibility.eu netvisibility.info netvisibility.mobi netvisibility.net netvisibility.org netvisibility.us netvisibilitywebmarketing.co.uk netvisibilitywebmarketing.com netvisibilitywebmarketing.net nhs-digital-hear-aids.co.uk nhs-digital-hearing-aids.co.uk nhs-hearing-aids.co.uk nhs-hearing.co.uk smithcoconsultancy.co.uk smithcoconsultancy.com warwickfirstresponders.org warwickfirstresponders.org.uk warwickshirehearts.org www.braceit.eu www.braceit.net www.braceit.uk www.digital-hearing-solutions.co.uk www.digital-hearing-solutions.com www.elite-hearing-solutions.co.uk www.elite-hearing-solutions.com www.elitehearingsolutions.co.uk www.elitehearingsolutions.com www.gphearing.co.uk www.hearing-aid-check.co.uk www.hearing-aid-test.co.uk www.hearing-aid.co.uk www.hearingaidrepair.co.uk www.mywealthdoctor.co.uk www.n-h-s.org.uk www.national-hearing-sales.co.uk www.national-hearing-sales.com www.national-hearing-services.co.uk www.national-hearing-services.com www.national-hearing-solutions.co.uk www.national-hearing-solutions.com www.national-hearing-supplies.co.uk www.national-marketing.co.uk www.nationalhearingsales.co.uk www.nationalhearingservices.co.uk www.nationalhearingsolutions.co.uk www.nationalhearingsolutions.com www.nationalhearingsupplies.co.uk www.nationwide-hearing-services.co.uk www.nationwidehearingservices.co.uk www.net-visibility-web-marketing.co.uk www.net-visibility-web-marketing.com www.net-visibility.co.uk www.netvisibility.co.uk www.netvisibility.com www.netvisibility.eu www.netvisibility.info www.netvisibility.mobi www.netvisibility.net www.netvisibility.org www.netvisibility.us www.netvisibilitywebmarketing.co.uk www.netvisibilitywebmarketing.com www.netvisibilitywebmarketing.net www.nhs-digital-hear-aids.co.uk www.nhs-digital-hearing-aids.co.uk www.nhs-hearing-aids.co.uk www.nhs-hearing.co.uk www.smithcoconsultancy.co.uk www.smithcoconsultancy.com www.warwickfirstresponders.org www.warwickfirstresponders.org.uk www.warwickshirehearts.org
    Expiry Date: 2019-03-29 01:21:53+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/braceit.net/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/braceit.net/privkey.pem
  Certificate Name: cem-toolkit.smithcoconsultancy.com
    Domains: bearandwait.com braceit.eu braceit.net braceit.uk cem-toolkit.smithcoconsultancy.com fcmilnes.co.uk fcmilnes.com hearing-aid.co.uk hearingaidrepair.co.uk mywealthdoctor.co.uk n-h-s.org.uk national-hearing-services.co.uk national-hearing-services.com national-hearing-solutions.co.uk national-hearing-solutions.com national-hearing-supplies.co.uk national-marketing.co.uk nationalhearingsolutions.co.uk nationalhearingsolutions.com nationalhearingsupplies.co.uk nationwidehearingservices.co.uk net-visibility-web-marketing.co.uk net-visibility-web-marketing.com net-visibility.co.uk netvisibility.co.uk netvisibility.com netvisibility.eu netvisibility.info netvisibility.mobi netvisibility.net netvisibility.org netvisibility.us netvisibilitywebmarketing.co.uk netvisibilitywebmarketing.com netvisibilitywebmarketing.net nhs-digital-hear-aids.co.uk nhs-digital-hearing-aids.co.uk nhs-hearing-aids.co.uk nhs-hearing.co.uk smithcoconsultancy.com warwickfirstresponders.org warwickfirstresponders.org.uk warwickshirehearts.org www.bearandwait.com www.braceit.eu www.braceit.net www.braceit.uk www.digital-hearing-solutions.co.uk www.digital-hearing-solutions.com www.elite-hearing-solutions.co.uk www.elite-hearing-solutions.com www.elitehearingsolutions.co.uk www.elitehearingsolutions.com www.fcmilnes.co.uk www.fcmilnes.com www.gphearing.co.uk www.hearing-aid-check.co.uk www.hearing-aid-test.co.uk www.hearing-aid.co.uk www.hearingaidrepair.co.uk www.mywealthdoctor.co.uk www.n-h-s.org.uk www.national-hearing-sales.co.uk www.national-hearing-sales.com www.national-hearing-services.co.uk www.national-hearing-services.com www.national-hearing-solutions.co.uk www.national-hearing-solutions.com www.national-hearing-supplies.co.uk www.national-marketing.co.uk www.nationalhearingsales.co.uk www.nationalhearingservices.co.uk www.nationalhearingsolutions.co.uk www.nationalhearingsolutions.com www.nationalhearingsupplies.co.uk www.nationwide-hearing-services.co.uk www.nationwidehearingservices.co.uk www.net-visibility-web-marketing.co.uk www.net-visibility-web-marketing.com www.net-visibility.co.uk www.netvisibility.co.uk www.netvisibility.com www.netvisibility.eu www.netvisibility.info www.netvisibility.mobi www.netvisibility.net www.netvisibility.org www.netvisibility.us www.netvisibilitywebmarketing.co.uk www.netvisibilitywebmarketing.com www.netvisibilitywebmarketing.net www.nhs-digital-hear-aids.co.uk www.nhs-digital-hearing-aids.co.uk www.nhs-hearing-aids.co.uk www.nhs-hearing.co.uk www.smithcoconsultancy.com www.warwickfirstresponders.org www.warwickfirstresponders.org.uk www.warwickshirehearts.org
    Expiry Date: 2019-08-09 00:19:20+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/cem-toolkit.smithcoconsultancy.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/cem-toolkit.smithcoconsultancy.com/privkey.pem
  Certificate Name: smithcoconsultancy.com
    Domains: bearandwait.com braceit.net braceit.uk cem-toolkit.smithcoconsultancy.com hearing-aid.co.uk mywealthdoctor.co.uk netvisibility.co.uk smithcoconsultancy.com warwickfirstresponders.org warwickfirstresponders.org.uk warwickshirehearts.org www.bearandwait.com www.braceit.net www.braceit.uk www.hearing-aid.co.uk www.mywealthdoctor.co.uk www.netvisibility.co.uk www.smithcoconsultancy.com www.warwickfirstresponders.org www.warwickfirstresponders.org.uk www.warwickshirehearts.org
    Expiry Date: 2019-08-09 00:19:34+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/smithcoconsultancy.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/smithcoconsultancy.com/privkey.pem
  Certificate Name: www.smithcoconsultancy.com
    Domains: braceit.net braceit.uk cem-toolkit.smithcoconsultancy.com digital-hearing-solutions.co.uk gphearing.co.uk hearing-aid-check.co.uk hearing-aid-test.co.uk hearing-aid.co.uk hearingaidrepair.co.uk jacksonglass.co.uk mywealthdoctor.co.uk n-h-s.org.uk national-hearing-sales.co.uk national-hearing-sales.com national-hearing-services.co.uk national-hearing-services.com national-hearing-solutions.co.uk national-hearing-solutions.com national-hearing-supplies.co.uk national-marketing.co.uk nationalhearingsales.co.uk nationalhearingservices.co.uk nationalhearingsolutions.co.uk nationalhearingsolutions.com nationalhearingsupplies.co.uk nationwide-hearing-services.co.uk nationwidehearingservices.co.uk net-visibility-web-marketing.co.uk net-visibility-web-marketing.com net-visibility.co.uk netvisibility.co.uk netvisibility.com netvisibility.eu netvisibility.info netvisibility.net netvisibility.org netvisibility.us netvisibilitywebmarketing.co.uk netvisibilitywebmarketing.com netvisibilitywebmarketing.net nhs-digital-hear-aids.co.uk nhs-digital-hearing-aids.co.uk nhs-hearing-aids.co.uk nhs-hearing.co.uk smithcoconsultancy.com warwickshirehearts.org www.braceit.net www.braceit.uk www.digital-hearing-solutions.co.uk www.digital-hearing-solutions.com www.elite-hearing-solutions.co.uk www.elite-hearing-solutions.com www.elitehearingsolutions.co.uk www.elitehearingsolutions.com www.fcmilnes.co.uk www.fcmilnes.com www.gphearing.co.uk www.hearing-aid-check.co.uk www.hearing-aid-test.co.uk www.hearing-aid.co.uk www.hearingaidrepair.co.uk www.jacksonglass.co.uk www.mywealthdoctor.co.uk www.n-h-s.org.uk www.national-hearing-sales.co.uk www.national-hearing-sales.com www.national-hearing-services.co.uk www.national-hearing-services.com www.national-hearing-solutions.co.uk www.national-hearing-solutions.com www.national-hearing-supplies.co.uk www.national-marketing.co.uk www.nationalhearingsales.co.uk www.nationalhearingservices.co.uk www.nationalhearingsolutions.co.uk www.nationalhearingsolutions.com www.nationalhearingsupplies.co.uk www.nationwide-hearing-services.co.uk www.nationwidehearingservices.co.uk www.net-visibility-web-marketing.co.uk www.net-visibility-web-marketing.com www.net-visibility.co.uk www.netvisibility.co.uk www.netvisibility.com www.netvisibility.eu www.netvisibility.info www.netvisibility.net www.netvisibility.org www.netvisibility.us www.netvisibilitywebmarketing.co.uk www.netvisibilitywebmarketing.com www.netvisibilitywebmarketing.net www.nhs-digital-hear-aids.co.uk www.nhs-digital-hearing-aids.co.uk www.nhs-hearing-aids.co.uk www.nhs-hearing.co.uk www.smithcoconsultancy.com www.warwickshirehearts.org
    Expiry Date: 2019-09-16 08:13:18+00:00 (VALID: 37 days)
    Certificate Path: /etc/letsencrypt/live/www.smithcoconsultancy.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/www.smithcoconsultancy.com/privkey.pem

The following renewal configurations were invalid:
  /etc/letsencrypt/renewal/www.smithcoconsultancy.com-0001.conf

I can see that the old domains I want to remove are still in these lists.

From what I gather I’d have to run:

--apache --cert-name cem-toolkit.smithcoconsultancy -d [every domain other than bearandwait and warwickfirstresponders]

Am I correct in thinking this?

1 Like
4

Hi @DF1997

first, make a backup.

Then use

certbot delete certificatename

to delete the certificate.

Then certbot doesn't try to renew that certificate.

Check

https://certbot.eff.org/docs/using.html

2 Likes
5

Assuming you used --apache before, and with "--cert-name cem-toolkit.smithcoconsultancy.com" (you left out the ".com"), yes.

However... you have six different, mostly overlapping certificates. Cleaning that up would simplify things -- update your server configurations, delete 5 of them, and update one of them (if necessary).

Deleting a certificate completely and replacing it with a new certificate that excludes a few names are totally different things, though.

2 Likes
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.