Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 0.31.0
--
So my problem is that if I run certbot certonly gemeinde-trierweiler.de he gives me a positive output that my certficate has been successfully renewed, but if I visit the site, there's still the old certificate. Maybe I'm doing something really wrong. Certbot saves the certficate in a specific path, yet I don't know anymore what to do else. Thank you for your help
But it's not used, so Certbot doesn't understand your configuration. And your configuration (see your redirects) looks inconsistent.
What says
apachectl -S
certbot certificates
A port 80 vHost with both domain names is required, so Certbot can use that as template to create the port 443 vHost.
PS: It's wrong to create a new certificate if the certificate already exists. There is a rate limit. So don't create a new certificate if you have already one created.
Got the same return now: Congratulations! Your certificate and chain have been saved at: [...]
Your key file has been saved at [...]
Your cert will expire on 2021-01-18. [...]
Yeah, I thought so. I mean I've seen the .pem file aswell on the linux server itself but I just can't figure out how to install it or how to tell my webserver to use this certificate ...
I agree. I was hoping that the command I gave Joshua would set the live symlink to that certificate instead of the newer one that does not include gemeinde-trierweiler.de.
Because --keep-until-expiring is not the default for certonly or run. It should be though (and require --force-renewal to override). This is the reason why we get so many rate-limited visitors! Almost no one knows about --force-renewal, which is why renew is a safe command.
--keep-until-expiring, --keep, --reinstall
If the requested certificate matches an existing certificate, always keep the existing one until it is due for renewal (for the 'run' subcommand this means reinstall the existing certificate). (default: Ask)
To make matters worse:
If a certificate is requested with run or certonly specifying a certificate name that already exists, Certbot updates the existing certificate. Otherwise a new certificate is created and assigned the specified name.
I think that's just partially true, as your quote already says (what I should have known): the user gets a question about what to do. So strictly speaking it's the users "fault", probably due to too little knowledge about what to do.
Eh, no, that's not worse: using --cert-name obviously overwrites the previous certificate if a new certificate is issued. That's the point of that paragraph.
