# Rate limits problem **URL:** \ **Category:** Help\ **Created:** [October 21, 2018, 11:53am UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386 "2018-10-21T11:53:04Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 11:53am UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/1 "2018-10-21T11:53:04Z")
Hi all, I really need your help. Thanks in advance I had my certificate running fine for 3 months. I thought it was going to renew automatically, but it looks it didn’t as it expired. I made some attempts with command ‘sudo certbot --apache’, ‘sudo certbot --webroot’… but despite of successful results for the command, any try on the web was giving the SEC\_ERROR\_EXPIRED\_CERTIFICATE, serving the old certificate. I tried remaking it from the scratch, revoking and deleting, but when tried to make a new one I ran with the “too many certificates already issued for exact set of domains” result. I’m really lost, my server is down for it and seems it will be for 1 week, that’s a disaster for us. I’m wondering what to do next: - Try to roll back to an insecure version of the site? - Any idea you can give me about rescuing the successfully renewed certificates? - If having the renewed or waiting a week? How to actually set the new one and not getting the expired when browsing? My domain is: [circusofthings.com](http://circusofthings.com) I ran this command: sudo certbor --apache (and --webroot) It produced this output: Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/circusofthings.com-0001/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/circusofthings.com-0001/privkey.pem Your cert will expire on 2019-01-18. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew _all_ of your certificates, run “certbot renew” My web server is (include version): Tomcat 7 The operating system my web server runs on is (include version): Ubuntu 14.04 64 bits My hosting provider, if applicable, is: ovh I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 21, 2018, 12:23pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/2 "2018-10-21T12:23:33Z")
Check your Apache configuration: in which directory is it looking for fullchain.pem? I think you managed to get yourself a new certificate within a new directory (see the `-0001` extension in the “Congratulations!” thingy). In the future, try `certbot renew` to renew your certificate 😉 ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [October 21, 2018, 12:42pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/3 "2018-10-21T12:42:48Z")
Hi @jaimiris > [@jaimiris](#): > > - If having the renewed or waiting a week? How to actually set the new one and not getting the expired when browsing? > > My domain is: [circusofthings.com](http://circusofthings.com) you have created 10 certificates today: [https://transparencyreport.google.com/https/certificates?cert\_search\_auth=&cert\_search\_cert=p:Y2lyY3Vzb2Z0aGluZ3MuY29tOmZhbHNlOmZhbHNlOjpFQUU9&cert\_search=include\_expired:false;include\_subdomains:false;domain:circusofthings.com&lu=cert\_search\_cert](https://transparencyreport.google.com/https/certificates?cert_search_auth=&cert_search_cert=p:Y2lyY3Vzb2Z0aGluZ3MuY29tOmZhbHNlOmZhbHNlOjpFQUU9&cert_search=include_expired:false;include_subdomains:false;domain:circusofthings.com&lu=cert_search_cert) Did you revoke / delete these? If yes, you have to wait one week. Check your configuration with ```nohighlight certbot certificates ``` if there is one of the new certificates. Please don't delete files if you don't have a backup. ---
**Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 2:56pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/4 "2018-10-21T14:56:23Z")
Hi, @Osiris, thanks for replying. Yes, I’m aware that those are new certificates in the new directories… I had the original and \*-0001 and \*-0002 from my different attempts while it was not reflected in the web. But none of them was working. (BTW: Now I wonder if my browser was lying to me with a false cache certificate) But, when you ask about where my Apache is pointing to ‘fullchain.pem’: I don’t know if you mean my tomcat’s server.xml file. I can say it was pointing a completely different \*.pfx file in my keystore param. This is an old self-signed certificate and now I don’t know why it hasn’t been a problem for my let’s encrypt set this last 3 months (¿¿??). Still I have the same problem: why certbot was giving a success result while not updating the certificate to the visitor? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 21, 2018, 3:01pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/5 "2018-10-21T15:01:49Z")
> [@jaimiris](#): > > Still I have the same problem: why certbot was giving a success result while not updating the certificate to the visitor? Depends on how you got to install the certificate in the first place. Now you're talking about Tomcat instead of Apache (the use of the `apache` plugin suggested the use of Apache, so I assumed Apache was indeed the TLS endpoint of your website). Did you install the certificate manually? Or did you use `certbot` for that? If you'd use the `apache` plugin, `certbot` would reload Apache automatically and thus "installing" the certificate at the same time. If you have used the `webroot` previously _without_ an installer plugin, such as `apache`, certbot would have gotten you the certificate, but you would have to install it manually. And when installing it manually, `certbot` wouldn't know how to "reinstall" the renewed certificate. So it really depends on how you installed the certificate in the first place. Also, now your site is answering plain HTTP on port 443 instead of HTTPS... ---
**Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 3:01pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/6 "2018-10-21T15:01:52Z")
Hi @JuergenAuer, thanks for your time. Yes ☹ I revoked and deleted everything as the new certificates weren't working. And, as you point, > certbot certificates corroborate it. I have saved the certificate shown in the web error. Would it be enough as a backup? And why having a correct certificate still is showing the out of date to the visitor? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 21, 2018, 3:03pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/7 "2018-10-21T15:03:13Z")
> [@jaimiris](#): > > I revoked and deleted everything as the new certificates weren’t working. The certificates and corresponding private keys were _fine_. The fact they weren't installed properly is the fact they "weren't working". > [@jaimiris](#): > > I have saved the certificate shown in the web error. Would it be enough as a backup? A certificate without its private key is useless. > [@jaimiris](#): > > > And why having a correct certificate still is showing the out of date to the visitor? Because "issuing" and "installing" are two different things. You can get a thousand or even millions of perfectly working certificates, if your software doesn't get it, the visitor doesn't get it. ---
**Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 3:11pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/8 "2018-10-21T15:11:50Z")
@Osiris > Also, now your site is answering plain HTTP on port 443 instead of HTTPS… Yes, i did it manually. I roll back to none https site to keep the business going (i don't have a better idea...) > So it really depends on how you installed the certificate in the first place. I really can't recover this information. Should I start it again from the beginning next week? > Or did you use `certbot` for that? Yes, I used Certbot ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 21, 2018, 3:17pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/9 "2018-10-21T15:17:34Z")
> [@jaimiris](#): > > Yes, I used Certbot To _get_ the certificate or to _install_ the certificate too? ---
**Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 3:27pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/10 "2018-10-21T15:27:03Z")
@Osiris > To _get_ the certificate or to _install_ the certificate too? Not 100% sure of my memory, but I'm sure I used it to "install" too On the other hand, I see in my `/etc/letsencrypt/archive/circusofthings.com-0001/` directory that I still have this files: `cert1.pem chain1.pem fullchain1.pem privkey1.pem` May it help to set it again? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 21, 2018, 3:28pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/11 "2018-10-21T15:28:36Z")
> [@jaimiris](#): > > May it help to set it again? Could be. It could also be your current expired certificate. You can check with `openssl x509 -noout -text **Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 3:34pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/12 "2018-10-21T15:34:52Z") Maybe I am lucky: > Validity > Not Before: Oct 20 16:29:34 2018 GMT > Not After : Jan 18 16:29:34 2019 GMT Any suggestion on what to do with it? I have a bunch of directories with pem files... not to clean ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [October 21, 2018, 3:39pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/13 "2018-10-21T15:39:38Z")
> [@jaimiris](#): > > Any suggestion on what to do with it? Looks like you didn't delete all files. Check [https://httpd.apache.org/docs/2.4/ssl/ssl\_howto.html](https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html) search something like ```nohighlight Listen 443 ServerName www.yourdomain.com SSLEngine on SSLCertificateFile "/path/to/www.example.com.cert" SSLCertificateKeyFile "/path/to/www.example.com.key" ``` and change the two rows ```nohighlight SSLCertificateFile "/path/to/www.example.com.cert" SSLCertificateKeyFile "/path/to/www.example.com.key" ``` with your own files. ---
**Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 3:45pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/14 "2018-10-21T15:45:22Z")
Not sure where you mean, which file? did you notice I’m using a Tomcat server? ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [October 21, 2018, 3:50pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/16 "2018-10-21T15:50:58Z")
> [@jaimiris](#): > > Not sure where you mean, which file? Sorry, I saw your certbot command with --apache. Tomcat requires additional steps. But you should be able to use this certificate. > [@jaimiris](#): > > Validity > Not Before: Oct 20 16:29:34 2018 GMT > Not After : Jan 18 16:29:34 2019 GMT ---
**Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 3:53pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/17 "2018-10-21T15:53:38Z")
You are right it was confusing with my reference to Apache above. I was trying to show you my server.xml… but for some reason I can’t. Anyway, I’ll will try to reset it as before and point to this files like you suggested but in Tomcat. I’ll tell you when I’m done ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 21, 2018, 4:06pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/18 "2018-10-21T16:06:38Z")
> [@jaimiris](#): > > did you notice I’m using a Tomcat server? `certbot` can't install certificates on Tomcat. So all this time, you must have installed it manually, about 90 days ago. ---
**Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 5:20pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/19 "2018-10-21T17:20:19Z")
Yes @Osiris, it is. I assumed it was made by certbot, but I did manually. I don’t have success yet, but I think I’m closer. I removed my old entry from my keystore: `keytool -delete -alias cotcert -keypass ***-storepass*** ` I added it again signed with the up to date cert we find before: `keytool -import -alias cotcert -keypass ***-file /etc/letsencrypt/archive/circusofthings.com-0001/cert1.pem -storepass*** ` Now it is supossed to be right in my .keystore at my root directory. In fact I check and date is fine and emiter is Let’s Encrypt. I copy that to my /user/share/tomcat7 as my server.xml was pointing to /user/share/tomcat7/cot.pfx I think cot.pfx is the same concept as .keystore… but no idea on how to convert it… I think after it it should work ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [October 21, 2018, 6:07pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/20 "2018-10-21T18:07:00Z")
Hi @jaimiris, If you want to create a pfx file from your renewed cert, use below commands: **1.-** First, backup your existing pfx file `cp -p /user/share/tomcat7/cot.pfx /user/share/tomcat7/cot.pfx.backup` **2.-** Combine the `fullchain.pem` and `privkey.pem` files into a pfx bundle. `openssl pkcs12 -export -in /etc/letsencrypt/archive/circusofthings.com-0001/fullchain.pem -inkey /etc/letsencrypt/archive/circusofthings.com-0001/privkey.pem -out /user/share/tomcat7/cot.pfx -password pass:HERETHEPASSWORD` I assume you have configured your server.xml to use the pfx file and the keystore is configured as `keystoreType="PKCS12"`, also, the above `HERETHEPASSWORD` should be the same password you have configured in your server.xml conf file `keystorePass="HERETHEPASSWORD"` Of course, you must reload/restart tomcat to refresh the cert in use. Good luck, sahsanu ---
**Author:** ![jaimiris](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jaimiris/32/28122_2.png) [@jaimiris](https://community.letsencrypt.org/u/jaimiris)\ **Post date:** [October 21, 2018, 6:16pm UTC](https://community.letsencrypt.org/t/rate-limits-problem/75386/21 "2018-10-21T18:16:16Z")
@sahsanu, my friend, I have another question: where is the button here to invite you some beers?! That was it… you made my day. Thank you @ JuergenAuer and @Osiris are also invited [Next page](https://community.letsencrypt.org/t/rate-limits-problem/75386.md?page=2)