Really Simple SSL / "Certificate already generated" but it has expired

[SoYoureAWaffleMan]

Hi folks. I have a site that has used WordPress / Really Simple SSL / Let's Encrypt for years, but now I have an issue. I read the sticky re: secondary validation thanks for the info but it doesn't seem to apply.

For the last year or more I have manually updated the Let’s Encrypt cert within 90 days via the Really Simple SSL / Let’s Encrypt wizard. This time, however, when the wizard gets to the Generation stage I see this output:

• Terms & Conditions are accepted.
• Successfully retrieved account
• Certificate already generated. It was renewed if required.

If I copy the resulting CRT, my web host tells me it is ALREADY EXPIRED. That seems to suggest that Let's Encrypt is refusing to generate a new cert for some reason, but I cannot debug any further. Any help on how to proceed would be v much appreciated.

Thanks

My domain is:
movema.co.uk

I ran this command:
Really Simple SSL / Let's Encrypt wizard

It produced this output:
"Certificate already generated"

My web server is (include version):
Apache 2

The operating system my web server runs on is (include version):
Linux / Ubuntu (no version available)

My hosting provider, if applicable, is:
TSO host (not for long)

I can login to a root shell on my machine (yes or no, or I don't know):
no

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
CPanel 118.0.13

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
I haven't used this client directly

[Osiris]

I can't see a recent certificate for that domain name at crt.sh | movema.co.uk.

So it seems your "Really Simple SSL" plugin is confused about the certificate being renewed. That said, I have no clue how that plugin works or if you could e.g. get detailed logs from it to figure this out.

Can you somehow force the Really Simple SSL plugin in renewing?

[SoYoureAWaffleMan]

It's useful to establish that the site / plugin is misbehaving rather than anything at LE. I've already updated the RSSSL plugin & reset everything, but no joy. I think my next steps will be

1. Remove the plugin entirely, reinstall, see what happens
2. Attempt to use the CPanel "web disk manager" to find plugin logs (good idea) / delete related SLL / cache files
3. Enquire about shell access and use certbot to generate keys manually

Perhaps RSSSL people can help.

Thanks for your time.

[Osiris]

@SoYoureAWaffleMan

It's useful to establish that the site / plugin is misbehaving rather than anything at LE.

Well, it's almost never actually LE misbehaving if it's just n=1

But we simply don't know, currently, what's really underneath that "Certificate already generated" output, even though we don't see that certificate in transparancy log aggregators such as crt.sh. It might be anything underneath

In the mean time the Let's Debug tool gives your site also the "everything should be good to go" result (Let's Debug).

@SoYoureAWaffleMan

3. Enquire about shell access and use certbot to generate keys manually

While I also think your steps 1 and 2 are a good thing to try first, maybe you should look at CertSage as an alternative to shell access and Certbot. CertSage doesn't require shell access and is fairly easy to use. And comes with cPanel integration for installing the certificate semi-automatically, although I'm not sure that also works with TSO Host.

[SoYoureAWaffleMan]

That looks v useful, I'll check it out when I get home. Your guidance is v much appreciated, Osiris

[griffin]

@Osiris

I'm not sure that also works with TSO Host

It does.

[SoYoureAWaffleMan]

Success! https://movema.co.uk

In the unlikely case anyone is interested, I...

1. Deleted / reinstalled RSSSL plugin. No change.
2. Renamed ssl dir (next to public_html) -> ssl_bak. No change.
3. Took a tour of the filesystem in web interface & realised the whole site is actually served from an alias via a symlink called "dummy_123456789" and not where I thought it was.
4. Swore at a picture of a martian tripod I have on the wall a couple of times.
5. Renamed ssl in the correct place -> ssl_bak and re-re-installed the RSSSL plugin.
6. Ignored a PHP error on plugin activation, RSSSL requested a new cert & completed successfully.

The whole thing's a mess, but TSO Host are winding up operations, so I'll migrate this site to a dedicated WP host next week. For now, SSL is working and I have CertSage as plan B if needed.

Thanks for doing a ton of free work for randos on the internet, you guys are awesome.