Issues with recent renewal

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: douganconsulting.com

I ran this command:

certbot certonly --manual --expand --preferred-challenges dns-01 -d .douganconsulting.com,douganconsulting.com,.douganfamily.org,.intelligenttechnology.ca,.teresadougan.com,*.vancouvershamrockcsc.org

It produced this output:

After making the normal DNS changes, all seemed to work. This is not a new setup - I've been running it for several years.

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

N/A

I can login to a root shell on my machine (yes or no, or I don't know):

Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot 2.11.0

I ran the manual process yesterday as normal, and it seemed to work well. My post-certbot script ran and copied the certs to my other servers, and I restarted their services as needed.

That said, two functions are no longer working - my Unifi server and my mail server (the Web server on the same box shows the new certs correctly). The mail server now shows a self-cert rather than the LE one (though nothing has changed on the host), while my Unifi server (used to manage my Ubiquiti Unifi switches and APs) no longer responds.

The only thing that seems different is that the certs now show "Issued by: E5", rather than "R3" as previously. Is this change in any way significant?

2 Likes

My best guess is that since you are not renewing the cert [doing certonly and --expand], certbot is simply issuing a new cert; As such, the new default for certs is no longer RSA.
Your systems are likely not instantly compatible with the new cert type [ECDSA].

You could research how to get them to use such ECDSA certs [a good long-term solution].
OR
You could reissue the cert and request it as type RSA [simple short-term solution].

4 Likes

Thank you - I will check that now.

Des

4 Likes

rg305 - thank you for your help. That was indeed the issue.

5 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.