Hello @schoen
I waited now few days as you recommended, can you tell me what commands to run to fix issue now?
Thanks again!
So I donât know what your domain is, so I couldnât check whether you are at risk of running into any rate limit by doing this, but the command I thought you could try is
./certbot-auto renew --force-renewal
This will try to renew all of your certificates (regardless of how close to expiry they are), and you can see whether or not it works.
Edit: if it does work, the form that goes in your crontab should leave out the --force-renewal 
Hello @schoen
I have send you mp with my domain so, you can check, I just run your command and it seems certificate went thought but also got a warning which is in bold, can you take a look and let me know if this is ok:
root@user:/usr/local/letsencrypt# cd /usr/local/letsencrypt && ./certbot-auto renew --force-renewal
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Processing /etc/letsencrypt/renewal/mysite.com-0001.conf
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for mysite.com
tls-sni-01 challenge for www.mysite.com
Waiting for verificationâŚ
Cleaning up challenges
new certificate deployed with reload of apache server; fullchain is
/etc/letsencrypt/live/mysite.com-0001/fullchain.pem
Processing /etc/letsencrypt/renewal/mysite.com.conf
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for www.mysite.com
tls-sni-01 challenge for mail.mysite.com
Encountered vhost ambiguity but unable to ask for user guidance in non-interactive mode. Currently Certbot needs each vhost to be in its own conf file, and may need vhosts to be explicitly labelled with ServerName or ServerAlias directives.
*Falling back to default vhost :443âŚ
Waiting for verificationâŚ
Cleaning up challenges
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/mysite.com/fullchain.pem
Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/mysite.com-0001/fullchain.pem (success)
/etc/letsencrypt/live/mysite.com/fullchain.pem (success)
It looks like the mail.mysite.com Apache configuration is confusing Certbot. Can you post that Apache configuration file?
Sure, can you tell me path of file so, I can post it please
Forget my previous post, I founded path, I am posting output bellow:
ubuntu@user:~$ cat /etc/apache2/apache2.conf
This is the main Apache server configuration file. It contains the
configuration directives that give the server its instructions.
See Apache HTTP Server Version 2.4 Documentation - Apache HTTP Server Version 2.4 for detailed information about
the directives and /usr/share/doc/apache2/README.Debian about Debian specific
hints.
Summary of how the Apache 2 configuration works in Debian:
The Apache 2 web server configuration in Debian is quite different to
upstream's suggested way to configure the web server. This is because Debian's
default Apache2 installation attempts to make adding and removing modules,
virtual hosts, and extra configuration directives as flexible as possible, in
order to make automating the changes and administering the server as easy as
possible.
It is split into several files forming the configuration hierarchy outlined
below, all located in the /etc/apache2/ directory:
/etc/apache2/
|-- apache2.conf
| `-- ports.conf
|-- mods-enabled
| |-- *.load
| `-- *.conf
|-- conf-enabled
| `-- *.conf
`-- sites-enabled
`-- *.conf
* apache2.conf is the main configuration file (this file). It puts the pieces
together by including all remaining configuration files when starting up the
web server.
* ports.conf is always included from the main configuration file. It is
supposed to determine listening ports for incoming connections which can be
customized anytime.
* Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/
directories contain particular configuration snippets which manage modules,
global configuration fragments, or virtual host configurations,
respectively.
They are activated by symlinking available configuration files from their
respective *-available/ counterparts. These should be managed by using our
helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See
their respective man pages for detailed information.
* The binary is called apache2. Due to the use of environment variables, in
the default configuration, apache2 needs to be started/stopped with
/etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not
work with the default configuration.
Global configuration
ServerRoot: The top of the directory tree under which the server's
configuration, error, and log files are kept.
NOTE! If you intend to place this on an NFS (or otherwise network)
mounted filesystem then please read the Mutex documentation (available
at URL:http://httpd.apache.org/docs/2.4/mod/core.html#mutex);
you will save yourself a lot of trouble.
Do NOT add a slash at the end of the directory path.
#ServerRoot "/etc/apache2"
The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
Mutex file:${APACHE_LOCK_DIR} default
PidFile: The file in which the server should record its process
identification number when it starts.
This needs to be set in /etc/apache2/envvars
PidFile ${APACHE_PID_FILE}
Timeout: The number of seconds before receives and sends time out.
Timeout 300
KeepAlive: Whether or not to allow persistent connections (more than
one request per connection). Set to "Off" to deactivate.
KeepAlive On
MaxKeepAliveRequests: The maximum number of requests to allow
during a persistent connection. Set to 0 to allow an unlimited amount.
We recommend you leave this number high, for maximum performance.
MaxKeepAliveRequests 100
KeepAliveTimeout: Number of seconds to wait for the next request from the
same client on the same connection.
KeepAliveTimeout 5
These need to be set in /etc/apache2/envvars
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}
HostnameLookups: Log the names of clients or just their IP addresses
e.g., www.apache.org (on) or 204.62.129.132 (off).
The default is off because it'd be overall better for the net if people
had to knowingly turn this feature on, since enabling it means that
each client request will result in AT LEAST one lookup request to the
nameserver.
HostnameLookups Off
ErrorLog: The location of the error log file.
If you do not specify an ErrorLog directive within a
container, error messages relating to that virtual host will be
logged here. If you do define an error logfile for a
container, that host's errors will be logged there and not here.
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel: Control the severity of messages logged to the error_log.
Available values: trace8, ..., trace1, debug, info, notice, warn,
error, crit, alert, emerg.
It is also possible to configure the log level for particular modules, e.g.
"LogLevel info ssl:warn"
LogLevel warn
Include module configuration:
IncludeOptional mods-enabled/.load
IncludeOptional mods-enabled/.conf
Include list of ports to listen on
Include ports.conf
Sets the default security model of the Apache2 HTTPD server. It does
not allow access to the root filesystem outside of /usr/share and /var/www.
The former is used by web applications packaged in Debian,
the latter may be used for local directories served by the web server. If
your system is serving content from a sub-directory in /srv you must allow
access here, or in any related virtual host.
Options FollowSymLinks AllowOverride None Require all denied<Directory /usr/share>
AllowOverride None
Require all granted
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride all
Require all granted
#<Directory /srv/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
#
AccessFileName: The name of the file to look for in each directory
for additional configuration directives. See also the AllowOverride
directive.
AccessFileName .htaccess
The following lines prevent .htaccess and .htpasswd files from being
viewed by Web clients.
<FilesMatch "^.ht">
Require all denied
The following directives define some format nicknames for use with
a CustomLog directive.
These deviate from the Common Log Format definitions in that they use %O
(the actual bytes sent including headers) instead of %b (the size of the
requested file), because the latter makes it impossible to detect partial
requests.
Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.
Use mod_remoteip instead.
LogFormat "%v:%p %h %l %u %t "%r" %>s %O "%{Referer}i" "%{User-Agent}i"" vhost_combined
LogFormat "%h %l %u %t "%r" %>s %O "%{Referer}i" "%{User-Agent}i"" combined
LogFormat "%h %l %u %t "%r" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
Include of directories ignores editors' and dpkg's backup files,
see README.Debian for details.
Include generic snippets of statements
IncludeOptional conf-enabled/*.conf
Include the virtual host configurations:
IncludeOptional sites-enabled/*.conf
Include PhpMyAdmin
Include /etc/phpmyadmin/apache.conf
vim: syntax=apache ts=4 sw=4 sts=4 sr noet
Please confirm if this is correct @schoen , thanks!
That isnât the correct file for mail.mysite.com.
You should run
grep -r mail.mysite.com /etc/apache2
to find it.
1 Like
I get no output from that command, should I remove that subdomain and just do mydomain.com and www.mydomain.com or what you recommend me to do @schoen
Thanks!
Is the mail subdomain actually hosted on that same server?
hello @schoen
I have updated certificate for domains mysite.com and www.mysite.com and removed mail.mysite.com
Now I have done command > ./certbot-auto renew --force-renewal
And it seems to be working this is output I got:
Is this correct now? Please let me know what you think @schoen and Thanks again!
I don't remember the status of your rate limits, but if you had only a failed renewal just now and your previous problem was the certificates per registered domain rate limit, then you can try again right away.
Just did it @schoen please check previous post that I edit 
The renewals did appear to succeed, which is great. The one thing to look at is that you do have two different certificates which are both getting renewed, and itâs possible that you donât need both of them. Also, only one of them is configured with an installer that reloads your web server configuration after a successful renewal.
Did you try using the certificates command to see which certificate youâre really using (or whether youâre really using both of them)?
Yes I think there might be more than one, how I can use certificates command? Can you put me full command? for me to run it? because I tried and I get âcommand not foundâ error thanks!
@schoen how I use the certificates command?
Thanks
Itâs a subcommand of certbot, like ./certbot-auto certificates.
Thanks for the reply @schoen
on that command I got the following output:
So, for what I understand from this output is that I got 2 certificates one mydomain.com and other one mydomain.com-0001 which seems that you are correct and I need to delete the one ending on 0001, correct me if I am wrong and if so, how I can remove it.
Thanks!
Thanks again!
The -0001 one is actually better at the moment because it covers both mydomain.com and www.mydomain.com, while the non-0001 one only covers www.mydomain.com.
The question of which one to delete also relates to which one you are actually using in web server configuration. You should not delete one that your web server is configured to use, unless youâre prepared to also edit your web server configuration to change which certificate it uses.
Then what command I should use to see which one is on server? But, I am pretty sure that the one is been used is the -0001 because website is setup with www so when you enter on website it goes to https://www.mydomain.com
So, how I can be sure? and once I am how I delete other certificate?
Thanks!
I just checked on SSL Server Test (Powered by Qualys SSL Labs) to see which certificate is been used on server and it seems is 0001 because shows www.mydomain.com and mydomain.com this is the output I got:
I am correct? how can I remove other one?
Thanks again @schoen