# Issue with renewing certificate **URL:** \ **Category:** Help\ **Created:** [July 10, 2021, 10:59am UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475 "2021-07-10T10:59:26Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![certb0t](https://avatars.discourse-cdn.com/v4/letter/c/7feea3/32.png) [@certb0t](https://community.letsencrypt.org/u/certb0t)\ **Post date:** [July 10, 2021, 10:59am UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/1 "2021-07-10T10:59:26Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [alkarkhi.com](http://alkarkhi.com) I ran this command: certbot renew It produced this output: Failed to renew certificate [alkarkhi.com](http://alkarkhi.com) with error: The manual plugin is not working; there may be problems with your existing configuration. The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.') My web server is (include version): nginx v1.14.2 The operating system my web server runs on is (include version): Debian v10.10 My hosting provider, if applicable, is: [evolution-host.com](http://evolution-host.com) I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 1.17.0 I also switched from Apache to Nginx and I created the certificates when I used Apache. Maybe that's the problem? ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [July 10, 2021, 1:38pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/2 "2021-07-10T13:38:06Z")
> [@certb0t](#): > > Maybe that's the problem? Probably not. Have you been able to renew the cert before using `certbot renew`? Because the error message suggests you initially issued the cert using `--manual`. If you did that, you can't renew automatically, and if you think about it for a minute, the reason is obvious--when you use `--manual`, cert issuance requires manual intervention. If you're running non-interactively (as `renew` does), there's no way to provide that manual intervention. ---
**Author:** ![certb0t](https://avatars.discourse-cdn.com/v4/letter/c/7feea3/32.png) [@certb0t](https://community.letsencrypt.org/u/certb0t)\ **Post date:** [July 10, 2021, 2:01pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/3 "2021-07-10T14:01:35Z")
@danb35 Yes I think I used --manual. How would I change it to automatic ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 10, 2021, 4:58pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/4 "2021-07-10T16:58:55Z")
I see: ```nohighlight Addresses: 2001:41d0:800:2e90:6d72:2ffb:8267:1 51.195.152.242 ``` With different replies: ```nohighlight curl -Iki6 alkarkhi.com HTTP/1.1 403 Forbidden Connection: close Content-Type: text/html Cache-Control: no-cache X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'self' Content-Length: 3444 curl -Iki4 alkarkhi.com HTTP/1.1 301 Moved Permanently Server: nginx Date: Sat, 10 Jul 2021 16:58:15 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Location: https://www.alkarkhi.com/ ``` ---
**Author:** ![certb0t](https://avatars.discourse-cdn.com/v4/letter/c/7feea3/32.png) [@certb0t](https://community.letsencrypt.org/u/certb0t)\ **Post date:** [July 10, 2021, 6:31pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/5 "2021-07-10T18:31:30Z")
Thanks for the heads up. My ISP doesn't give out ipv6 addresses for some reason so its hard to check if its working right. Can you check again? ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [July 10, 2021, 6:33pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/6 "2021-07-10T18:33:53Z")
Hello 🙂 > [@certb0t](#): > > How would I change it to automatic Being sure to heed what @rg305 has wisely pointed out, you might be able to use the following: `sudo certbot --cert-name alkarkhi.com --nginx -d "alkarkhi.com,www.alkarkhi.com"` ---
**Author:** ![certb0t](https://avatars.discourse-cdn.com/v4/letter/c/7feea3/32.png) [@certb0t](https://community.letsencrypt.org/u/certb0t)\ **Post date:** [July 10, 2021, 6:35pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/7 "2021-07-10T18:35:58Z")
@griffin Hello. Whats the difference to: `sudo certbot --cert-name alkarkhi.com --nginx -d "alkarkhi.com,*.alkarkhi.com` ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [July 10, 2021, 6:37pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/8 "2021-07-10T18:37:56Z")
It uses the nginx authenticator, which automatically satisfies [http-01 challenges](https://letsencrypt.org/docs/challenge-types/#http-01-challenge), instead of the manual authenticator, which does not. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 10, 2021, 6:38pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/9 "2021-07-10T18:38:22Z")
> [@certb0t](#): > > Can you check again? No change. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [July 10, 2021, 6:39pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/10 "2021-07-10T18:39:54Z")
I see a huge change, @rg305. > **[Test result for alkarkhi.com: Error](https://letsdebug.net/alkarkhi.com/588622?debug=y)** > > 1 unique issue(s) detected (IssueFromLetsEncrypt) ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 10, 2021, 6:40pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/11 "2021-07-10T18:40:08Z")
> [@certb0t](#): > > sudo certbot --cert-name [alkarkhi.com](http://alkarkhi.com) --nginx -d "[alkarkhi.com](http://alkarkhi.com),\*.alkarkhi.com "\*" and "www" are handled very differently. Certs that contain wildcards must be handled by DNS authentication (ONLY). ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [July 10, 2021, 6:41pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/12 "2021-07-10T18:41:39Z")
@rg305 I think @certb0t's `nginx` configuration has special handling for `.well-known`. If you look in the first Let's Debug blue box, you'll see what I mean. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [July 10, 2021, 6:44pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/13 "2021-07-10T18:44:36Z")
@rg305 If you curl `http://alkarkhi.com/.well-known/acme-challenge/test`, do you get differing responses? ---
**Author:** ![certb0t](https://avatars.discourse-cdn.com/v4/letter/c/7feea3/32.png) [@certb0t](https://community.letsencrypt.org/u/certb0t)\ **Post date:** [July 10, 2021, 6:44pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/14 "2021-07-10T18:44:38Z")
@rg305 So I'll have to manually add new subdomains then if I want automatic? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 10, 2021, 6:45pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/15 "2021-07-10T18:45:01Z")
> [@griffin](#): > > you'll see what I mean I see the forwarding, but if the rest of the site is not serving the same content, then I can only assume they are either not on the same system or won't provide the same content once secure. Recall that step one is having a fully functional web site. This _seems_ to fail that as is. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 10, 2021, 6:46pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/16 "2021-07-10T18:46:05Z")
> [@certb0t](#): > > I'll have to manually add new subdomains then if I want automatic? DNS authentication can be automated - if the DSP is known to work with the ACME client being used. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [July 10, 2021, 6:46pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/17 "2021-07-10T18:46:34Z")
I'm only seeing a SERVFAIL for the A record right now, which is odd since both the A and AAAA records are returned. 🤔 ---
**Author:** ![certb0t](https://avatars.discourse-cdn.com/v4/letter/c/7feea3/32.png) [@certb0t](https://community.letsencrypt.org/u/certb0t)\ **Post date:** [July 10, 2021, 6:47pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/18 "2021-07-10T18:47:07Z")
> DNS authentication can be automated - if the DSP is known to work with the ACME client being used. Does that depend on the CA? ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [July 10, 2021, 6:47pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/19 "2021-07-10T18:47:47Z")
Clean now. > **[Test result for alkarkhi.com: OK](https://letsdebug.net/alkarkhi.com/588630)** > > 0 unique issue(s) detected ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 10, 2021, 6:48pm UTC](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475/20 "2021-07-10T18:48:00Z")
> [@griffin](#): > > If you curl `http://alkarkhi.com/.well-known/acme-challenge/test` , do you get differing responses? No but that doesn't negate the lack of synchronization of the rest of the site. So that even if we "WIN". we will soon see another TOPIC with "Sometimes my site works and sometimes it doesn't after install LE cert." [When it did that even before the cert was obtained] [Next page](https://community.letsencrypt.org/t/issue-with-renewing-certificate/155475.md?page=2)