I cannot renew my SSL certificate

[appsoftsa]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: appsoftsa.online

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version): windows server 2012 r2

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

I cannot renew my SSL certificate
I am getting error code 805 or 806
Upon renewal by TSPlus

[rg305]

Hi @appsoftsa, and welcome to the LE community forum

Have you checked any of the CertificateManager help channels?
The popup is covering the error message

Have you tried reinstalling it?

Are you opposed to using another ACME client?

[Bruce5051]

@appsoftsa,

Testing and debugging are best done using the Staging Environment as the Rate Limits are much higher.

And to assist with debugging there is a great place to start is Let's Debug.

Here is a list of issued certificates https://crt.sh/?q=appsoftsa.online

Presently I see

[MikeMcQ]

@appsoftsa

windows server 2012 r2

Does that even support certificatemanager?

[appsoftsa]

The certificate is issued by TSPlus
This is as simple as we just click the renew button
But this time I receive this message and the renewal does not occur
I do not have sufficient experience in these matters
How can I register a certificate and include it through TSPlus?

[appsoftsa]

I have been using this Windows for years and have never faced a renewal problem previously, only now

[appsoftsa]

[MikeMcQ]

I am not familiar with that ACME Client. I don't understand why it would give an error. The error saying it failed overlaps a window that shows a fresh cert being issued. Confusing.

And, your own display from crt.sh shows you get a cert nearly every day. Which is poor practice by the way and means something is wrongly configured in your certificate manager. You should only be renewing your certs every 60 days or so.

Your HTTPS service on port 443 (website?) is using a self-signed cert for "localhost". Since you are getting certs daily maybe just configure your webserver to use them. I don't know how you do that on your system.

I see a component named "Certes" mentioned in your logs. There were some required updates to that recently but I could not find the threads in this forum about that.

I think you need to ask about this on a CertificateManager support forum. That's all I can offer.

[appsoftsa]

I have a virtual server
I purchased a domain and directed to the server's IP
The server has a TSPlus system
When the certificate renewal process fails in the normal way
I downloaded the certificate from the Dot Net website that contains the domain that I purchased
And download it instead of renewing the certificate

[appsoftsa]

[MikeMcQ]

I'm not sure what problem you are trying to fix.

You clearly are able to get a cert for that domain name as shown by crt.sh.

You will not be able to use a different server (IP address) to get a cert with that same name using the HTTP Challenge (which you are). When you request a cert for a domain name the Let's Encrypt Server validates the cert request. It issues an HTTP request to the IP address in the public DNS for that domain name. The LE Server needs to be given the proper challenge token for the request to succeed.

So, let's say you request a cert from ServerIP2 (TSPlus?). If the A record in your DNS points to Server1IP (your dot net system?) that system won't know how to reply properly to the LE Server. That has always been true.

I am not really sure what you are asking but TSPlus also has a support channel. That is the best place to seek advice on how to configure it. We often help people with common problems but there are hundreds of ways to get certs and we cannot be expert in all of them.

[appsoftsa]

I can't find a quick response from TSPlus

But I discovered that the files I attached above are not the files that TSPlus created after importing the certificate
When importing the certificate, no files are created inside the cert folder, as happens when creating the certificate via TSPlus.
I do not know if the file I imported will work after a while or not, and I cannot review the certificate
All I did was add it and a message appeared that the operation was completed successfully
So far, the certificate problem has not been resolved on the site
Do I have to wait and how long does it take to see results?
Or should it work directly?

[rg305]

Please show the date of this file:

[appsoftsa]

I converted the two files to create the file .pfx
By SSL Converter - Convert SSL Certificates to different formats

[orangepizza]

this kinda feels like it fails at downloading certificate after signing from march: i guess it try to verfity new certificate but againest DST root and reject it?

[appsoftsa]

Is there anything that can be done to solve the problem?

[orangepizza]

well I don't think you can fix source code for it but grab another client like https://certifytheweb.com/ and install certficiate from there manually (or with hook script) for now?

[appsoftsa]

What you mean is
Download the file from the link and run it on the device
And then try to import the certificate
Or create the certificate using TSPlus
correct

[orangepizza]

get certificate out-of-band and import it to TSplus