Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: vectrex.be
I ran this command:
(first, I deleted the old certificate, with: sudo certbot delete, then I did:
sudo certbot certonly --manual --agree-tos --preferred-challenges dns -d vectrex.be -d *.vectrex.be
It produced this output:
IMPORTANT NOTES:
Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/vectrex.be/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/vectrex.be/privkey.pem
Your cert will expire on 2023-01-02. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew all of your certificates, run
"certbot renew"
If you like Certbot, please consider supporting our work by:
First, there is no reason to delete the old certificate. In fact, this can cause problems because your server is (normally) using it. And, any failure to get a new cert will then have your server failing.
You are successfully getting certs with that command. You got 5 of them today and that is your limit for a whole week. So, please do not delete them any more.
Your server is not using the new cert. Instead it is using an older cert with these two domain names and two others
when I do:
sudo apachectl -t -D DUMP_VHOSTS,
I get an error:
AH00526: Syntax error on line 48 of /etc/apache2/sites-enabled/keith-ssl.conf:
SSLCertificateFile: file '/etc/letsencrypt/live/keith.be-0001/fullchain.pem' does not exist or is empty
Action '-t -D DUMP_VHOSTS' failed.
The Apache error log may have more information.
..
This is strange, since the keith.be - site works as expected..
It will until you restart Apache. Then Apache will fail. It looks like you have deleted even more cert files that Apache is actively using. What does this show:
It looks like you now have individual certs for each domain name. But, before you used some certs with multiple names. I like that you now have individual certs but it requires changes to Apache config. Since your Apache config is faulty we will need to review it piece by piece.
Can you show result of this
ls -lR /etc/apache2/{sites-available,sites-enabled}
<IfModule mod_ssl.c>
<VirtualHost *:443>
# A lot more comment here
ServerName bierkalender.be
ServerAlias www.bierkalender.be
DocumentRoot /var/www/bierkalender
<Directory /var/www/bierkalender>
DirectoryIndex index.py
AllowOverride All
Order allow,deny
Allow from all
</Directory>
<Directory /var/www/bierkalender/cgi-bin>
Options ExecCGI
SetHandler cgi-script
</Directory>
<Directory /var/www/bierkalender>
Options +ExecCGI
AddHandler cgi-script .py
</Directory>
# A lot more comment here
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# A lot more comment here
RewriteEngine on
# A lot more comment here
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/bierkalender.be-0001/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/bierkalender.be-0001/privkey.pem
</VirtualHost>
</IfModule>
You need to remove the "-0001" from the path in those two file names (like below) and then enable that site in Apache (use a2ensite or whatever method you use). If you have any questions ask first.
We need these two lines to use the path name shown in the certbot certificates command you used earlier.
done, but the site bierkalender.be still gives a certificate error in the browser (but ok, I didn't get an error when I restarted apache this time, so that's progress)
Please don't restart Apache yet (any more). We should get your config fixed. Then test the config. Then we'll restart Apache.
Your bierkalender.be site is using the cert for keith - that's why it does not work. You should probably a2dissite bierkalender until we get all your config fixed.
Next one is biuk. I don't see a cert for it but what is contents of this:
<IfModule mod_ssl.c>
<VirtualHost *:443>
# Comment here
ServerName keith.be
ServerAlias www.keith.be
WSGIScriptAlias / /var/www/keith/application/join.wsgi
<Directory /var/www/keith/application>
options FollowSymLinks
AllowOverride None
Require all granted
</Directory>
# Comment here
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# Comment here
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.
# RewriteCond %{SERVER_NAME} =keith.be [OR]
# RewriteCond %{SERVER_NAME} =www.keith.be
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/keith.be/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/keith.be/privkey.pem
</VirtualHost>
</IfModule>