# Let's Encrypt Newbie with renew failure **URL:** \ **Category:** Help\ **Created:** [October 9, 2020, 9:34pm UTC](https://community.letsencrypt.org/t/lets-encrypt-newbie-with-renew-failure/135682 "2020-10-09T21:34:14Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![fredm](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredm/32/44236_2.png) [@fredm](https://community.letsencrypt.org/u/fredm)\ **Post date:** [October 9, 2020, 9:34pm UTC](https://community.letsencrypt.org/t/lets-encrypt-newbie-with-renew-failure/135682/1 "2020-10-09T21:34:14Z")
**My domain is:** [maps.camavision.com](http://maps.camavision.com) **I ran this command:** sudo certbot-auto renew **It produced this output:** Cert not yet due for renewal All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/maps.camavision.com/fullchain.pem (failure) * * * The following certs are not due for renewal yet: /etc/letsencrypt/live/camavision.com/fullchain.pem expires on 2020-12-09 (skipped) /etc/letsencrypt/live/map2.camavision.com/fullchain.pem expires on 2020-12-07 (skipped) /etc/letsencrypt/live/map3.camavision.com/fullchain.pem expires on 2021-01-06 (skipped) /etc/letsencrypt/live/payroll.camavision.com/fullchain.pem expires on 2020-12-16 (skipped) /etc/letsencrypt/live/testmaps.camavision.com/fullchain.pem expires on 2020-12-09 (skipped) All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/maps.camavision.com/fullchain.pem (failure) * * * 1 renew failure(s), 0 parse failure(s) IMPORTANT NOTES: - The following errors were reported by the server: **My web server is (include version):** Apache/2.4.41 (Unix) OpenSSL/1.1.1d mod\_fcgid/2.3.9 **The operating system my web server runs on is (include version):** Slackware 14.2+ **My hosting provider, if applicable, is:** None. **I can login to a root shell on my machine (yes or no, or I don't know):** Yes. **I'm using a control panel to manage my site (no, or provide the name and version of the control panel):** No. **The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):** certbot 1.7.0 **Question:** This cert was renewed in the past, however, the IP address may have changed since then. I have little network experience, however I have access to the server. This cert expires in 29 days. I would appreciate your help. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [October 9, 2020, 10:07pm UTC](https://community.letsencrypt.org/t/lets-encrypt-newbie-with-renew-failure/135682/2 "2020-10-09T22:07:12Z")
There appear to be 2 different servers involved here. Server 1 (`199.188.65.182`) hosts these domains: - [map2.camavision.com](http://map2.camavision.com) - [map3.camavision.com](http://map3.camavision.com) - [payroll.camavision.com](http://payroll.camavision.com) - [testmaps.camavision.com](http://testmaps.camavision.com) Server 2 (`72.50.244.62`) hosts these domains: - [camavision.com](http://camavision.com) - [maps.camavision.com](http://maps.camavision.com) Now, it appears that you are running this Certbot renewal on Server 1. If you wanted to issue or renew a certificate for [maps.camavision.com](http://maps.camavision.com), you would have to do so on Server 2. What good is a certificate if it's on the wrong server? ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [October 10, 2020, 7:12am UTC](https://community.letsencrypt.org/t/lets-encrypt-newbie-with-renew-failure/135682/3 "2020-10-10T07:12:07Z")
Definitely a great idea to make sure that the domain name points at the server you want it to, and that you try to get your certificate where it will be used. πŸ™‚ If you need to reissue an old certificate with Certbot to remove domains that are no longer hosted on your server, be careful because the model of how to do this has ended up confusing many people. (In particular, you need to specify `--cert-name` to modify coverage for an existing certificate, and you need to specify all of the names that _should_ be included in the new certificate with `-d`.) If you need to _delete_ an old certificate, Certbot also has a command for thatβ€”`certbot delete`β€”but again you should be careful that your web server application isn't still configured to use the certificate that you're planning to delete. If you delete a certificate that's still referred to be a web server configuration, your configuration may become invalid. If you're unsure or confused about how to make the changes that you decide you need to make, please feel free to double-check here on the forum before making a change you're not confident about! ---
**Author:** ![fredm](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredm/32/44236_2.png) [@fredm](https://community.letsencrypt.org/u/fredm)\ **Post date:** [October 12, 2020, 3:02pm UTC](https://community.letsencrypt.org/t/lets-encrypt-newbie-with-renew-failure/135682/4 "2020-10-12T15:02:52Z")
Dear \_az: How were you able to come up with the IP addresses? I would like to verify this information myself in the future. ---
**Author:** ![fredm](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fredm/32/44236_2.png) [@fredm](https://community.letsencrypt.org/u/fredm)\ **Post date:** [October 12, 2020, 4:06pm UTC](https://community.letsencrypt.org/t/lets-encrypt-newbie-with-renew-failure/135682/5 "2020-10-12T16:06:02Z")
Dear schoen: Thank you _very_ kindly for your response. I believe I need to move the cert for [maps.camavision.com](http://maps.camavision.com) to server2 (e.g. 72.50.244.62) Would you recommend the following command on the server1? Should I issue this command first or after the new certificate is created? sudo certbot-auto delete --cert-name [maps.camavision.com](http://maps.camavision.com) Then, would I also need to issue the following on server2 to create the new certificate on server2? sudo certbot-auto certonly --webroot -w /pub/maps/html/ -d [maps.camavision.com](http://maps.camavision.com) Thanks again for your reply. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [October 12, 2020, 7:03pm UTC](https://community.letsencrypt.org/t/lets-encrypt-newbie-with-renew-failure/135682/6 "2020-10-12T19:03:55Z")
Those both look good. > [@fredm](#): > > Should I issue this command first or after the new certificate is created? I would say after the new certificate is created, although the certificates don't conflict or interfere with each other. The most important thing in deleting the certificate on the original server is to first make sure that it's not referenced in your web server configuration. Note that the `certonly` command will not install the certificate in your web server configuration on the second server, so if you use this method, you'll also need to edit the configuration for that server to refer to the certificate after it's obtained. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [October 13, 2020, 1:25am UTC](https://community.letsencrypt.org/t/lets-encrypt-newbie-with-renew-failure/135682/7 "2020-10-13T01:25:26Z")
> [@fredm](#): > > sudo certbot-auto delete --cert-name [maps.camavision.com](http://maps.camavision.com) > [@fredm](#): > > sudo certbot-auto certonly --webroot -w /pub/maps/html/ -d [maps.camavision.com](http://maps.camavision.com) Let me be the one to say that we don't see many newbies with your level of preparation. Way to go. πŸ™‚ I'd give you some likes if I weren't out of them right now. So have this instead: 🌟 > [@\_az](#): > > What good is a certificate if it's on the wrong server? A coaster with a liability attached? > [@schoen](#): > > Note that the `certonly` command will not install the certificate in your web server configuration on the second server, so if you use this method, you'll also need to edit the configuration for that server to refer to the certificate after it's obtained. Also remember to reload/restart your webserver after you acquire a new certificate! You can use `--deploy-hook "some code or a script here"` to automate this. * * * I don't have much else to add here. Standing between Alex (\_az) and Seth (schoen) sorta makes me feel like a hill in a mountain valley, but I do have one small thing to recommend. You might consider adding `--keep-until-expiring` to keep from accidentally issuing unneeded certificates. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 12, 2020, 1:25am UTC](https://community.letsencrypt.org/t/lets-encrypt-newbie-with-renew-failure/135682/8 "2020-11-12T01:25:29Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.