Let's Encrypt Expiry Bot

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: merchiston-curling.club

I ran this command: N/A

It produced this output: N/A

My web server is (include version):
Server version: Apache/2.4.52 (Ubuntu)
Server built: 2024-03-18T13:41:27

The operating system my web server runs on is (include version):
Linux Mint 21.3 x86_64

My hosting provider, if applicable, is: Self Hosted

I can login to a root shell on my machine (yes or no, or I don't know): Y

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): N

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 3.1.0

Hi, just a general query.

Let's Encrypt Expiry Bot informs me my certs will expire soon. (<19 days).
I guess they have been automatically renewing since I set this up a few years ago. I've never needed to intervene in any way since set up.
I have missed the renewal date for my domain: merchiston-curling.club and now there is no way to renew on my domain dashboard (Abion).

My question: If I manage to still retain the domain will certbot still automatically renew the certs?

Thanks for any answers.

Mike Veitch.

It should. Anyhow it's easy enough to check (or to get a new one).

Be careful if you have other domains on that certificate, automatic renewal succeeds for all included names or none at all, you might need a new certificate if that's the case.

Also note that the expiry bot is retiring in a few months (June)

1 Like

Certbot will keep trying to renew, until you tell it not to.

2 Likes

Hi Giuseppe, that's good to know. I do have 5 other web sites I set up around the same time. I'm not sure if they all get renewed on the same request.
Is there a certbot cmd I can use to check this?

Also, with the expiry bot going out of use. Is that the same as the renewal bot? Do I need to manually renew my certs in a few months?

This home hosting malarky is fun for a bit but getting a bit of a pain too.

Cheers, Mike.

Yes, you can see all the certs handled by Certbot with the certbot certificates command. Please see User Guide — Certbot 3.1.0 documentation for the Certbot user manual.

No. Please understand how ACME works, with the server side (Let's Encrypt) and the client side (an ACME client such as Certbot). You got the expiry email from Let's Encrypt and Certbot does the renewing. Those are totally independent entities. See e.g. How It Works - Let's Encrypt.

2 Likes

OK. Thank you. I'll check that out.

Cheers, Mike.

Looks like your domain name registration expired Jan30

https://www.godaddy.com/whois/results.aspx?itc=dlp_domain_whois&domain=merchiston-curling.club

There are no active DNS A (or AAAA) records so no one can find your website.

You will need to fix that first.

3 Likes

Yep, that's my worry. Contacted Abion 3 times since 1st Feb but zero response. Can't renew or even purchase new. If I can get it up and running again soon was hoping the cert renewal would just kick in. I'll try and chivvy them along again.
Thanks for your efforts and responses.
Mike.

1 Like

Sorry, skimmed that first post way too fast. Nevermind :slight_smile:

The most recent cert for that domain just had it and its www subdomain. So, once it is restored and you have A (and/or AAAA) records back in place for the base name and www the cert renewal should occur promptly.

You should, of course, check your registration for those other domains but they are not on this same cert so not affected by this problem.

2 Likes

Hi, I get this response using the cmd suggested:

Found the following certs:
Certificate Name: freesite1.co.uk
Serial Number: 39c167f2c84b88cf6902af38e514c8bd092
Key Type: ECDSA
Domains: freesite1.co.uk freesite2.co.uk www.freesite1.co.uk www.freesite2.co.uk
Expiry Date: 2025-04-02 05:47:03+00:00 (VALID: 51 days)
Certificate Path: /etc/letsencrypt/live/freesite1.co.uk/fullchain.pem
Private Key Path: /etc/letsencrypt/live/freesite1.co.uk/privkey.pem
Certificate Name: merchiston-curling.club
Serial Number: 301328da61263e6ed3f4151b5a58d66db71
Key Type: ECDSA
Domains: merchiston-curling.club www.merchiston-curling.club
Expiry Date: 2025-03-01 06:46:24+00:00 (VALID: 19 days)
Certificate Path: /etc/letsencrypt/live/merchiston-curling.club/fullchain.pem
Private Key Path: /etc/letsencrypt/live/merchiston-curling.club/privkey.pem
Certificate Name: psrc.club
Serial Number: 3b6d14d542f986cb1009c20fb5efda642b2
Key Type: RSA
Domains: psrc.club robinsons-squash.club siae-curling.club www.psrc.club www.robinsons-squash.club www.siae-curling.club
Expiry Date: 2025-05-05 07:56:02+00:00 (VALID: 84 days)
Certificate Path: /etc/letsencrypt/live/psrc.club/fullchain.pem
Private Key Path: /etc/letsencrypt/live/psrc.club/privkey.pem


If I don't get the merchiston-curling.club domain back is there a certbot cmd to remove this domain from the request?

It was suggested earlier that it was an all or nothing request so if that domain fails I guess I will have trouble with my other requested certs.

Just hedging my bets but again thanks for all the info.

Cheers, Mike.

Yes:

sudo certbot delete --cert-name  merchiston-curling.club

If you delete it here it won't renew anymore. You will get one more notice from the Expiry bot 7 days before expiration but no further emails from LE after that for this cert.

Each cert is an all or nothing but each "Certificate Name" in that list is a separate cert. They fail or succeed on their own domain names only.

4 Likes

@mikeveitch
Please see the section about safely removing certificates from Certbot:

https://eff-certbot.readthedocs.io/en/stable/using.html#safely-deleting-certificates

If not done properly, your webserver might not want to (re)start.

5 Likes

Thanks for all the help. I'll give it a week or so and if I get no response from abion I'll try and transfer the domain to names.co.uk and alter the cert both request bearing in mind the safety concerns.
Cheers, Mike.

4 posts were split to a new topic: How manage expired or missing certificates

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.