I need a new certificate for a domain with a new host, how do I generate a new certificate for a domain instead of renewing the certificate with an old host?

Help
1

I need a new certificate for a domain with a new host, how do I generate a new certificate for a domain instead of renewing the certificate with an old host?

I am using the command:

sudo certbot certonly --manual

Which gives me the option:

What would you like to do?

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1: Keep the existing certificate for now

2: Renew & replace the cert (limit ~5 per 7 days)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

Renewing an existing certificate

Unfortunately this certificate will not work. I need to create a completely new certificate with a new hosting provider. How do I start from scratch?

2

Hi @Giansonn,

Have you followed the instructions available at https://certbot.eff.org/instructions for your webserver and OS? Are you attempting to generate the certificate for the new host on the new host itself?

1 Like
3

Yes I have. I ran

sudo certbot delete

That deleted all files related to the domain. However when I tried to get a new certificate the old certificate was renewed again and that has the wrong domain addresses since it was registered with a different host.

4

Also I am using letencrypt in manual mode so the webserver and OS dont really matter. I am just doing the acme-challengeā€¦

5

Hi @Giansonn

looks you are doing something wrong. Using the wrong machine or a configuration with a missing configuration.

Please answer the following questions:

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I donā€™t know):

Iā€™m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if youā€™re using Certbot):

1 Like
6

It seems like in this case the certbot delete probably deleted only one of several duplicative certificates, and so another one is still present. A good way to check this is to run certbot certificates.

If my guess is right, certbot delete should be run one or more additional times to remove other unwanted certificates.

1 Like
7

Unfortunately too many certificates have been issued so I will have to try this again in a weeks time. I will let you know what happens then but I now know that there are no certificates on file since I checked using the certbot certificates command. I used the certbot delete last time however I cannot be sure if I really deleted everything since I did not checkā€¦

8

Could you show us the current output of this command?

ls -lR /etc/letsencrypt

9

total 16
-rw-r--r-- 1 root wheel 64 6 Aug 16:48 .updated-options-ssl-apache-conf-digest.txt
drwxr-xr-x 3 root wheel 96 28 Jun 22:45 accounts
drwx------ 2 root wheel 64 6 Aug 18:00 archive
drwxr-xr-x 15 root wheel 480 6 Aug 18:00 csr
drwx------ 15 root wheel 480 6 Aug 18:00 keys
drwx------ 3 root wheel 96 6 Aug 18:00 live
-rw-r--r-- 1 root wheel 1619 6 Aug 16:48 options-ssl-apache.conf
drwxr-xr-x 2 root wheel 64 6 Aug 18:00 renewal
drwxr-xr-x 5 root wheel 160 28 Jun 22:45 renewal-hooks

/etc/letsencrypt/accounts:
total 0
drwxr-xr-x 3 root wheel 96 28 Jun 22:45 acme-v02.api.letsencrypt.org

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org:
total 0
drwx------ 3 root wheel 96 28 Jun 22:45 directory

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory:
total 0
drwx------ 5 root wheel 160 28 Jun 22:45 8c181efa2e9771ceef000f3cd8d41355

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/8c181efa2e9771ceef000f3cd8d41355:
total 24
-rw-r--r-- 1 root wheel 88 28 Jun 22:45 meta.json
-r-------- 1 root wheel 1632 28 Jun 22:45 private_key.json
-rw-r--r-- 1 root wheel 78 28 Jun 22:45 regr.json

/etc/letsencrypt/archive:

/etc/letsencrypt/csr:
total 104
-rw-r--r-- 1 root wheel 956 28 Jun 22:46 0000_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 28 Jun 23:35 0001_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 15 Jul 22:45 0002_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 15 Jul 23:01 0003_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 16 Jul 09:51 0004_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 16 Jul 09:55 0005_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 6 Aug 15:30 0006_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 6 Aug 16:12 0007_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 6 Aug 16:42 0008_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 6 Aug 16:45 0009_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 6 Aug 16:48 0010_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 6 Aug 16:49 0011_csr-certbot.pem
-rw-r--r-- 1 root wheel 956 6 Aug 18:00 0012_csr-certbot.pem

/etc/letsencrypt/keys:
total 104
-rw------- 1 root wheel 1708 28 Jun 22:46 0000_key-certbot.pem
-rw------- 1 root wheel 1704 28 Jun 23:35 0001_key-certbot.pem
-rw------- 1 root wheel 1704 15 Jul 22:45 0002_key-certbot.pem
-rw------- 1 root wheel 1704 15 Jul 23:01 0003_key-certbot.pem
-rw------- 1 root wheel 1708 16 Jul 09:51 0004_key-certbot.pem
-rw------- 1 root wheel 1704 16 Jul 09:55 0005_key-certbot.pem
-rw------- 1 root wheel 1704 6 Aug 15:30 0006_key-certbot.pem
-rw------- 1 root wheel 1704 6 Aug 16:12 0007_key-certbot.pem
-rw------- 1 root wheel 1704 6 Aug 16:42 0008_key-certbot.pem
-rw------- 1 root wheel 1704 6 Aug 16:45 0009_key-certbot.pem
-rw------- 1 root wheel 1704 6 Aug 16:48 0010_key-certbot.pem
-rw------- 1 root wheel 1704 6 Aug 16:49 0011_key-certbot.pem
-rw------- 1 root wheel 1704 6 Aug 18:00 0012_key-certbot.pem

/etc/letsencrypt/live:
total 8
-rw-r--r-- 1 root wheel 740 16 Jul 10:41 README

/etc/letsencrypt/renewal:

/etc/letsencrypt/renewal-hooks:
total 0
drwxr-xr-x 2 root wheel 64 28 Jun 22:45 deploy
drwxr-xr-x 2 root wheel 64 28 Jun 22:45 post
drwxr-xr-x 2 root wheel 64 28 Jun 22:45 pre

/etc/letsencrypt/renewal-hooks/deploy:

/etc/letsencrypt/renewal-hooks/post:

/etc/letsencrypt/renewal-hooks/pre:

This is what comes up. Does this look like everything is deleted? I have not run the certbot revoke command this time but I did before and the certificate still renewed automatically.

10

It does look like everything was deleted successfully. If you run certbot certonly and end up with the ā€œRenewing an existing certificateā€¦ā€ message in this environment (regardless of whether that then produces a rate limit error), I would love to see the associated log from /var/log/letsencrypt!

12

Could you post the contents of the most recent file in /var/log/letsencrypt?

13

I have tried open /var/log/letsencrypt but the folder is empty. Can you please proffer me with some terminal code? Sorry to be so useless

14

There are no hidden files in there when I press cmd + shift + .

15

Are you running these commands on a local or a remote server?

16

from my computer at home. I did not think that with --manual you needed to be connected to a server since you use the ā€˜acme-challengeā€™ to certify that you have control of the website without having shell access. I do not have shell access so I used --manual

17

@bmw @joohoi, do you have any ideas how this could be happening?

18

Is the problem here right now just that we canā€™t find any logfiles? What are we hoping to see there? My reading of this thread is weā€™re still waiting for rate limits to expire now that the other certificates in /etc/letsencrypt have been deleted.

If we do want a logfile though, I suspect @Giansonnā€™s normal user doesnā€™t have permissions to see /var/log/letsencrypt so when they run open /var/log/letsencrypt, their file manager doesnā€™t show any contents of the directory.

You can get a list of files by running sudo ls /var/log/letsencrypt/ and print one of the files to the terminal by running a command like sudo cat /var/log/letsencrypt/letsencrypt.log.

19

Not sure why I wouldnt have permission, I am not saving anything to my webserver since I do not have shell access so everything is on my computer... I would have thought. Anyway sudo ls /var/log/letsencrypt/ brings up the list of logs however sudo ls /var/log/letsencrypt.log.24/ doesnt show me anything. If I try sudo open /var/log/letsencrypt.log.24 I am told I do not have anything that can open the file. (letsencrypt.log.24 appears to be the latest log that I have)

I think the log file is completely empty however. See terminal output:

User's-iMac:~ User$ ls /var/log/letsencrypt/

ls: : Permission denied

User's-iMac:~ User$ sudo ls /var/log/letsencrypt/

Password:

letsencrypt.log letsencrypt.log.17 letsencrypt.log.3

letsencrypt.log.1 letsencrypt.log.18 letsencrypt.log.4

letsencrypt.log.10 letsencrypt.log.19 letsencrypt.log.5

letsencrypt.log.11 letsencrypt.log.2 letsencrypt.log.6

letsencrypt.log.12 letsencrypt.log.20 letsencrypt.log.7

letsencrypt.log.13 letsencrypt.log.21 letsencrypt.log.8

letsencrypt.log.14 letsencrypt.log.22 letsencrypt.log.9

letsencrypt.log.15 letsencrypt.log.23

letsencrypt.log.16 letsencrypt.log.24

User's-iMac:~ User$ sudo cat /var/log/letsencrypt/letsencrypt.log.24

User's-iMac:~ User$ sudo open /var/log/letsencrypt/letsencrypt.log.24

No application knows how to open /var/log/letsencrypt/letsencrypt.log.24.

User's-iMac:~ User$ cat /var/log/letsencrypt/letsencrypt.log.24

cat: /var/log/letsencrypt/letsencrypt.log.24: Permission denied

User's-iMac:~ User$ sudo cat /var/log/letsencrypt/letsencrypt.log.24

User's-iMac:~ User$
21

here is the output of the second oldest log file:

User's-iMac:~ User$ sudo cat /var/log/letsencrypt/letsencrypt.log.23

2019-06-28 22:45:10,434:DEBUG:certbot.main:certbot version: 0.35.1

2019-06-28 22:45:10,435:DEBUG:certbot.main:Arguments: []

2019-06-28 22:45:10,435:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)

2019-06-28 22:45:10,478:DEBUG:certbot.log:Root logging level set at 20

2019-06-28 22:45:10,480:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
22

Unfortunately I cannot post the log before that since it appears to show everything I completed in the acme-challenge. Not a huge risk but not really necessary. I will try next week and see if I am still renewing the same certificate.