# Impossible renew? **URL:** \ **Category:** Help\ **Created:** [September 10, 2017, 2:26pm UTC](https://community.letsencrypt.org/t/impossible-renew/41909 "2017-09-10T14:26:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ppKrauss](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@ppKrauss](https://community.letsencrypt.org/u/ppKrauss)\ **Post date:** [September 10, 2017, 2:26pm UTC](https://community.letsencrypt.org/t/impossible-renew/41909/1 "2017-09-10T14:26:02Z")
When run `certbot renew --dry-run` all is fine (!). But command `certbot renew`: ```auto Saving debug log to /var/log/letsencrypt/letsencrypt.log ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/etcetc.conf ------------------------------------------------------------------------------- Cert not yet due for renewal The following certs are not due for renewal yet: /etc/letsencrypt/live/etcetc/fullchain.pem (skipped) No renewals were attempted. ``` * * * ## The dry-run `certbot renew --dry-run` produces: ```auto Saving debug log to /var/log/letsencrypt/letsencrypt.log ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/etcetc.conf ------------------------------------------------------------------------------- Cert not due for renewal, but simulating renewal for dry run Renewing an existing certificate Performing the following challenges: tls-sni-01 challenge for etcetc .... .... Waiting for verification... Cleaning up challenges ------------------------------------------------------------------------------- new certificate deployed with reload of nginx server; fullchain is /etc/letsencrypt/live/etcetc/fullchain.pem ------------------------------------------------------------------------------- ** DRY RUN: simulating 'certbot renew' close to cert expiry ** (The test certificates below have not been saved.) Congratulations, all renewals succeeded. The following certs have been renewed: /etc/letsencrypt/live/etcetc/fullchain.pem (success) ** DRY RUN: simulating 'certbot renew' close to cert expiry ** (The test certificates above have not been saved.) ``` ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [September 10, 2017, 2:47pm UTC](https://community.letsencrypt.org/t/impossible-renew/41909/2 "2017-09-10T14:47:16Z")
Hi @ppKrauss, There is no problem at all, your certificate is still valid (certbot by default considers it needs to be renewed if at least left 30 days to the expiring date) so `certbot renew` command is not renewing it. `certbot renew --dry-run` command is just simulating the renew, no matters whether the cert is near to the expire date or not. You can check the validity of your cert with these command: `openssl x509 -in /etc/letsencrypt/live/etcetc/cert.pem -noout -dates` or using certbot: `certbot certificates` Cheers, sahsanu ---
**Author:** ![ppKrauss](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@ppKrauss](https://community.letsencrypt.org/u/ppKrauss)\ **Post date:** [September 10, 2017, 3:04pm UTC](https://community.letsencrypt.org/t/impossible-renew/41909/3 "2017-09-10T15:04:08Z")
Thanks @sahsanu! Well, there are some problems: 1. Need for it: **can I enforce _renew_?** 2. **Contradiction** : an e-mail say that I need to renew (!). See dump below. * * * e-mail. ```auto Let's Encrypt Expiry Bot Unsubscribe 8:17 AM (3 hours ago) to me Hello, Your certificate (or certificates) for the names listed below will expire in 9 days (on 20 Sep 17 10:59 +0000). Please **make sure to renew** your certificate before then, or visitors to your website will encounter errors. ``` ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [September 10, 2017, 3:10pm UTC](https://community.letsencrypt.org/t/impossible-renew/41909/4 "2017-09-10T15:10:56Z")
> [@ppKrauss](#): > > Need for it: can I enforce renew? You can use `certbot renew --force-renewal` but if your domain is valid there is no need to force the renewal. > [@ppKrauss](#): > > Contradiction: an e-mail say that I need to renew (!). Well, I suppose you have issued certs for your domain and the email expiration notice if for one of the certs you are not using anymore, if you provide your domain name we can check the certificates you have issued. Cheers, sahsanu ---
**Author:** ![ppKrauss](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@ppKrauss](https://community.letsencrypt.org/u/ppKrauss)\ **Post date:** [September 10, 2017, 4:29pm UTC](https://community.letsencrypt.org/t/impossible-renew/41909/5 "2017-09-10T16:29:41Z")
Thanks @sahsanu, the `certbot renew --force-renewal` worked fine. It is for **caution** , and to stop contradictoring emails. ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [September 10, 2017, 4:36pm UTC](https://community.letsencrypt.org/t/impossible-renew/41909/6 "2017-09-10T16:36:18Z")
No matters if you renewed your cert, if yoy issued one that is going to expire (so you received the email) you will receive more emails for that cert even if you current cert is renewed because the certs are different. If you don’t want to share your domain name you can check the certificates issued for your domain in this page [https://crt.sh](https://crt.sh) ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 10, 2017, 4:36pm UTC](https://community.letsencrypt.org/t/impossible-renew/41909/7 "2017-10-10T16:36:26Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.