# Missing webroot path renewing an existing certificate

**URL:** <https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569>\
**Category:** Help\
**Created:** [December 13, 2021, 3:21am UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569 "2021-12-13T03:21:13Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 3:21am UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/1 "2021-12-13T03:21:13Z")

</div>

Hi,

I ran this command:

### certbot certificates

Found the following certs:  
Certificate Name: [casaroca.org](http://casaroca.org)  
Serial Number: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
Key Type: RSA  
Domains: [casaroca.org](http://casaroca.org) [www.casaroca.org](http://www.casaroca.org)  
Expiry Date: 2021-12-12 17:45:21+00:00 (INVALID: EXPIRED)  
Certificate Path: /etc/letsencrypt/live/casaroca.org/fullchain.pem  
Private Key Path: /etc/letsencrypt/live/casaroca.org/privkey.pem

### certbot renew

Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

Processing /etc/letsencrypt/renewal/casaroca.org.conf

* * *

Renewing an existing certificate for [casaroca.org](http://casaroca.org) and [www.casaroca.org](http://www.casaroca.org)  
Failed to renew certificate [casaroca.org](http://casaroca.org) with error: Missing command line flag or config entry for this setting:  
Input the webroot for [casaroca.org](http://casaroca.org):

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [December 13, 2021, 3:55am UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/2 "2021-12-13T03:55:47Z")

</div>

Welcome to the community @jchavezpe

You did not provide many details but it looks like the `webroot_path` might be missing from your renewal config file here:

```nohighlight
/etc/letsencrypt/renewal/casaroca.org.conf

```

Someone [earlier today had a similar problem](https://community.letsencrypt.org/t/certbot-renew-fullchain-pem-failure/167536/3). If that solution does not help you please post again but with the answers to the other questions in the form you were shown so we can give better advice.

Also show the contents of your renewal conf file. Thanks

===========================

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

My version of certbot is (from `certbot --version`):

---

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 3:59am UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/3 "2021-12-13T03:59:52Z")

</div>

Thanks Mike,

Server GCP  
root@instance-1:~# lsb\_release -a  
No LSB modules are available.  
Distributor ID: Debian  
Description: Debian GNU/Linux 10 (buster)  
Release: 10  
Codename: buster

I don't know what can be happening from the ssh console  
root@instance-1:~# /etc/letsencrypt/renewal/casaroca.org.conf  
-bash: /etc/letsencrypt/renewal/casaroca.org.conf: Permission denied

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [December 13, 2021, 4:24am UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/4 "2021-12-13T04:24:16Z")

</div>

> [@jchavezpe](#):
>
> I don't know what can be happening from the ssh console  
> root@instance-1:~# /etc/letsencrypt/renewal/casaroca.org.conf

Try:

```nohighlight
cat /etc/letsencrypt/renewal/casaroca.org.conf

```

Ideally use 3 backticks before for nice format like this

```  
output  
```

---

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 4:25am UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/5 "2021-12-13T04:25:41Z")

</div>

root@instance-1:~# cat /etc/letsencrypt/renewal/casaroca.org.conf

# renew\_before\_expiry = 30 days

version = 1.19.0  
archive\_dir = /etc/letsencrypt/archive/casaroca.org  
cert = /etc/letsencrypt/live/casaroca.org/cert.pem  
privkey = /etc/letsencrypt/live/casaroca.org/privkey.pem  
chain = /etc/letsencrypt/live/casaroca.org/chain.pem  
fullchain = /etc/letsencrypt/live/casaroca.org/fullchain.pem

# Options used in the renewal process

[renewalparams]  
account = 336d9efba695cd78826556d6dac6ef51  
authenticator = webroot  
server = [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)  
root@instance-1:~#

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [December 13, 2021, 4:27am UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/6 "2021-12-13T04:27:59Z")

</div>

> [@MikeMcQ](#):
>
> certbot --version

And what is this version?

As you can see in your renewal conf file it is missing the webroot path similar to the other thread I referenced. I am logging out for the night but please show your certbot version and someone can help you if you cannot see how to repair your renewal conf.

---

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 4:31am UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/7 "2021-12-13T04:31:18Z")

</div>

root@instance-1:~# certbot --version  
certbot 1.22.0

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 13, 2021, 7:31am UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/8 "2021-12-13T07:31:35Z")

</div>

> [@jchavezpe](#):
>
> authenticator = webroot

It says "webroot", but no webroot is given.  
Which may indicate a bug in the version of `certbot` use when the cert was issued.  
Since the renewal.conf file is already suffering from that effect, it needs to be corrected.  
Try finding the issuing command in the `history`, with:  
`history | grep -i certbot | grep -i webroot`

---

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 1:18pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/9 "2021-12-13T13:18:34Z")

</div>

root@instance-1:~# history | grep -i certbot | grep -i webroot  
501 history | grep -i certbot | grep -i webroot

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 13, 2021, 1:24pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/10 "2021-12-13T13:24:07Z")

</div>

Try:  
`grep -ERi 'servername|serveralias|root' /etc/apache2/sites-enabled/`

---

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 1:31pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/11 "2021-12-13T13:31:21Z")

</div>

```nohighlight
root@instance-1:~# grep -ERi 'servername|serveralias|root' /etc/apache2/sites-enabled/`
/etc/apache2/sites-enabled/000-default-le-ssl.conf: # The ServerName directive sets the request scheme, hostname and port that
/etc/apache2/sites-enabled/000-default-le-ssl.conf: # redirection URLs. In the context of virtual hosts, the ServerName
/etc/apache2/sites-enabled/000-default-le-ssl.conf: #ServerName www.example.com
/etc/apache2/sites-enabled/000-default-le-ssl.conf: DocumentRoot /var/www/html
/etc/apache2/sites-enabled/000-default-le-ssl.conf:ServerName casaroca.site
/etc/apache2/sites-enabled/000-default-le-ssl.conf:ServerAlias www.casaroca.site
/etc/apache2/sites-enabled/000-default.conf: # The ServerName directive sets the request scheme, hostname and port that
/etc/apache2/sites-enabled/000-default.conf: # redirection URLs. In the context of virtual hosts, the ServerName
/etc/apache2/sites-enabled/000-default.conf: #ServerName www.example.com
/etc/apache2/sites-enabled/000-default.conf: DocumentRoot /var/www/html

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 13, 2021, 1:33pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/12 "2021-12-13T13:33:26Z")

</div>

Please show the output of:  
`certbot certificates`

---

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 1:35pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/13 "2021-12-13T13:35:10Z")

</div>

> [@jchavezpe](#):
>
> ### certbot certificates

```nohighlight
root@instance-1:~# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: casaroca.org
    Serial Number: 406e9083ab4ebd0 **9238651aac** 99cf87
    Key Type: RSA
    Domains: casaroca.org www.casaroca.org
    Expiry Date: 2021-12-12 17:45:21+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/casaroca.org/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/casaroca.org/privkey.pem
  Certificate Name: casaroca.site
    Serial Number: 48f2f843498293fea3854ea0a23844469ea
    Key Type: RSA
    Domains: casaroca.site www.casaroca.site
    Expiry Date: 2021-09-21 03:33:49+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/casaroca.site/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/casaroca.site/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 13, 2021, 1:40pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/14 "2021-12-13T13:40:41Z")

</div>

One last piece...  
Please show the output of:  
`sudo apachectl -t -D DUMP_VHOSTS`

---

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 1:41pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/15 "2021-12-13T13:41:23Z")

</div>

```nohighlight
root@instance-1:~# sudo apachectl -t -D DUMP_VHOSTS
VirtualHost configuration:
*:443 casaroca.site (/etc/apache2/sites-enabled/000-default-le-ssl.conf:2)
*:80 casaroca.site (/etc/apache2/sites-enabled/000-default.conf:1)
AH00180: WARNING: MaxRequestWorkers of 544 exceeds ServerLimit value of 256 servers, decreasing MaxRequestWorkers
 to 256. To increase, please see the ServerLimit directive.

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 13, 2021, 1:44pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/16 "2021-12-13T13:44:22Z")

</div>

I don't see a vhost that covers the ".org" name ? ? ?  
Does `casaroca.site` and `casaroca.org` serve the same content/site/folder ?

---

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 1:45pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/17 "2021-12-13T13:45:19Z")

</div>

same content,

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 13, 2021, 1:47pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/18 "2021-12-13T13:47:32Z")

</div>

OK, let's see which cert (path) is being used:  
`grep privkey /etc/apache2/sites-enabled/000-default-le-ssl.conf`

---

<div class="post-metadata">

**Author:** ![jchavezpe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jchavezpe/32/56668_2.png) [@jchavezpe](https://community.letsencrypt.org/u/jchavezpe)\
**Post date:** [December 13, 2021, 1:48pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/19 "2021-12-13T13:48:16Z")

</div>

root@instance-1:~# grep privkey /etc/apache2/sites-enabled/000-default-le-ssl.conf  
SSLCertificateKeyFile /etc/letsencrypt/live/casaroca.site/privkey.pem

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 13, 2021, 1:53pm UTC](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569/21 "2021-12-13T13:53:25Z")

</div>

**THIS IS A ONE TIME FIX - DO NOT DO THIS TO RENEW**

Ok, do all three **without** restarting Apache/LiteSpeed:

```nohighlight
1:
certbot delete --cert-name casaroca.org

2:
certbot delete --cert-name casaroca.site

3:
certbot certonly \
 --cert-name casaroca.site \
 --webroot -w /var/www/html \
 -d "casaroca.org,www.casaroca.org,casaroca.site,www.casaroca.site" \
 --force-renewal

```

[Next page](https://community.letsencrypt.org/t/missing-webroot-path-renewing-an-existing-certificate/167569.md?page=2)