Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: dev.kingsy.co.uk
I ran this command: certbot certonly --webroot
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c'
to cancel): dev.kingsy.co.uk
Cert not yet due for renewal
You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/dev.kingsy.co.uk.conf)
What would you like to do?
1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Renewing an existing certificate
IMPORTANT NOTES:
-
Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/dev.kingsy.co.uk/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/dev.kingsy.co.uk/privkey.pem
Your cert will expire on 2021-04-14. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew all of your certificates, run
"certbot renew" -
If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Obviously this is a renew, the first time it executed it was just fine too.
My web server is (include version):
Nginx
The operating system my web server runs on is (include version): OpenBSD
I can login to a root shell on my machine (yes or no, or I don't know): yes
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 1.5.0
If I view my cert it looks good
Certificate Name: dev.kingsy.co.uk
Serial Number: 45204f3cfeb496a8af45a1c14617dcf3b6f
Domains: dev.kingsy.co.uk
Expiry Date: 2021-04-14 13:16:14+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/dev.kingsy.co.uk/fullchain.pem
Private Key Path: /etc/letsencrypt/live/dev.kingsy.co.uk/privkey.pem
And the nginx config
server {
listen 80;
listen [::]:80;
server_name dev.kingsy.co.uk;
# enforce https
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name dev.kingsy.co.uk;
root /var/www/sites/dev.kingsy.co.uk;
#root /var/www/sites/holding;
error_log /var/log/nginx/dev_nginx_error.log;
access_log /var/log/nginx/dev_nginx_access.log;
index index.php
ssl_certificate /etc/letsencrypt/live/dev.kingsy.co.uk/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/dev.kingsy.co.uk/privkey.pem;
client_max_body_size 20M;
location / {
try_files $uri $uri/ /index.php?$args;
auth_basic "Administrator’s Area";
auth_basic_user_file /etc/nginx/.htpasswd;
}
location ~ \.php$ {
try_files $fastcgi_script_name =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
index index.php index.htm index.html;
# Prevent PHP scripts from being executed inside the uploads folder.
location ~* /app/uploads/.*.php$ {
deny all;
}
location ~ /\.git {
deny all;
}
}
However if you visit
Just type any old username / password so you get forbidden, you can see the cert is for www.kingsy.co.uk not dev.kingsy.co.uk. (Both are hosted on this machine) but I am so so confused as to WHY its serving the wrong cert.
As you can see from the nginx config the path to the dev. cert is correct. Could someone offer any advice?
Thanks
