Hello.
When updating certificates An error appears (if I understood it correctly, then before updating, you must delete the mail.test.com.ua directory of the same name from the folder: /etc/letsencrypt/live/, or did I misunderstand ?:
certbot certonly --standalone --force-renewal --preferred-chain "ISRG Root X1"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c'
to cancel): mail.test.com.ua
Attempting to parse the version 1.26.0 renewal configuration file found at /etc/letsencrypt/renewal/mail.test.com.ua-0001.conf with version 1.11.0 of Certbot. This might not work.
Requesting a certificate for mail.test.com.ua
live directory exists for mail.test.com.ua
Directory output:
[root@mail ~]# ls -alR /etc/letsencrypt/{archive,live,renewal}
/etc/letsencrypt/archive:
total 16
drwx------. 4 root root 4096 May 7 09:38 .
drwxr-xr-x. 9 root root 4096 May 8 07:25 ..
drwxr-xr-x 2 root root 4096 Feb 5 13:23 mail.test.com.ua-0001
drwxr-xr-x. 2 root root 4096 Apr 17 2022 mail.test.com.ua-0002
/etc/letsencrypt/archive/mail.test.com.ua-0001:
total 24
drwxr-xr-x 2 root root 4096 Feb 5 13:23 .
drwx------. 4 root root 4096 May 7 09:38 ..
-rw-r--r-- 1 root root 1952 Feb 5 13:23 cert1.pem
-rw-r--r-- 1 root root 1826 Feb 5 13:23 chain1.pem
-rw-r--r-- 1 root root 3778 Feb 5 13:23 fullchain1.pem
-rw------- 1 root root 1704 Feb 5 13:23 privkey1.pem
--force-renewal I use because I already have certificates, but their term has expired, this is not true?
Conclusion:
[root@mail ~]# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewal configuration file /etc/letsencrypt/renewal/mail.test.com.ua-0001.conf produced an unexpected error: expected /etc/letsencrypt/live/mail.test.com.ua-0001/cert.pem to be a symlink. Skipping.
Renewal configuration file /etc/letsencrypt/renewal/mail.test.com.ua.conf produced an unexpected error: renewal config file {} is missing a required file reference. Skipping.
"You should never had to manually delete anything with the /etc/letsencrypt/ folder"
I was given the equipment and I only faced this issue, now it is necessary to extend the certificate, and then calmly study)
No, absolutely not. Please read the documentation of any command before actually using it, so you understand what it actually does.
--force-renewal is NOT necessary for regular renewals (i.e.: the certificate is due for renewal because it's within 30 days of expiry or has already expired). Only in VERY STRICT situations this option could be necessary.
Note that the --force-renewal option does NOT magically make any error which might prevent renewal disappear.
Do you propose to completely clean the /live/ and /archive/ folders?
[Osiris] I wrote that this team is incorrect in my case, how can I write correctly?
certbot certonly --standalone --force-renewal --preferred-chain "ISRG Root X1"
I renamed the configuration file: "/etc/letsencrypt/renewal/mail.test.com.ua.conf" , before that it was called: mail.test.com.ua1.conf and after that the output of the command was successful.
[root@mail ~]# certbot certonly --standalone --dry-run --preferred-chain "ISRG Root X1"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Account registered.
Please enter the domain name(s) you would like on your certificate (comma and/or
space separated) (Enter 'c' to cancel): mail.test.com.ua.conf
An RSA certificate named mail.test.com.ua.conf already exists. Do you want to
update its key type to ECDSA?
(U)pdate key type/(K)eep existing key type: u
Simulating renewal of an existing certificate for mail.seebet.com.ua and 3 more domains
The dry run was successful.
If I understand correctly, now I can run the same command, without the prefix --dry-run ?
here in this form: certbot certonly --standalone --preferred-chain "ISRG Root X1" ?
Although I see in the certificate renewal instructions that a key can be used: --force-renewal
There was a 5 minute window earlier today when the staging RVAs were broken (independent of the current performance issues). --dry-run hits staging in certbot.