Renew certificates for multiple domains using Certbot on freebsd-11.1

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: Sourcesinfo.com

I ran this command: certbot renew and also certbot renew --pre-hook “service apache24 stop” --post-hook “service apache24 start”

It produced this output:
certbot renew --pre-hook “service apache24 stop” --post-hook "service apache24 start"
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /usr/local/etc/letsencrypt/renewal/sourcesinfo.com.conf

Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator webroot, Installer None
Running pre-hook command: service apache24 stop
Output from service:
Stopping apache24.
Waiting for PIDS: 2026.

Renewing an existing certificate
Performing the following challenges:
http-01 challenge for sourcesinfo.com
http-01 challenge for ecurealestate.com
http-01 challenge for genesyscare.com
http-01 challenge for uxsources.com
Waiting for verification…
Cleaning up challenges
Attempting to renew cert (sourcesinfo.com) from /usr/local/etc/letsencrypt/renewal/sourcesinfo.com.conf produced an unexpected error: Failed authorization procedure. uxsources.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://uxsources.com/.well-known/acme-challenge/PaT_htu3uXuZq_Cg24oGWo8myLhYSkFsqyIHEU0av08: Connection refused, genesyscare.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://genesyscare.com/.well-known/acme-challenge/JJY9MUrI4SI5xpFJ_3t9mEu2i5UyolIpv7fqqfAKg2o: Connection refused, ecurealestate.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://ecurealestate.com/.well-known/acme-challenge/0Om_CaOI2O1xnzB7GxaggwGsxEy3rmzuPuvVF_t1Axs: Connection refused, sourcesinfo.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://sourcesinfo.com/.well-known/acme-challenge/bMLrZcEW3Y6_DQMddA30WGY8k0sudsR5NFDVeiQq6IU: Connection refused. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/usr/local/etc/letsencrypt/live/sourcesinfo.com/fullchain.pem (failure)

All renewal attempts failed. The following certs could not be renewed:
/usr/local/etc/letsencrypt/live/sourcesinfo.com/fullchain.pem (failure)

Running post-hook command: service apache24 start
Output from service:
Performing sanity check on apache24 configuration:
Starting apache24.

Error output from service:
Syntax OK

1 renew failure(s), 0 parse failure(s)

certbot renew --pre-hook “service apache24 stop” --post-hook "service apache24 start"
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /usr/local/etc/letsencrypt/renewal/sourcesinfo.com.conf

Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator webroot, Installer None
Running pre-hook command: service apache24 stop
Output from service:
Stopping apache24.
Waiting for PIDS: 2026.

Renewing an existing certificate
Performing the following challenges:
http-01 challenge for sourcesinfo.com
http-01 challenge for ecurealestate.com
http-01 challenge for genesyscare.com
http-01 challenge for uxsources.com
Waiting for verification…
Cleaning up challenges
Attempting to renew cert (sourcesinfo.com) from /usr/local/etc/letsencrypt/renewal/sourcesinfo.com.conf produced an unexpected error: Failed authorization procedure. uxsources.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://uxsources.com/.well-known/acme-challenge/PaT_htu3uXuZq_Cg24oGWo8myLhYSkFsqyIHEU0av08: Connection refused, genesyscare.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://genesyscare.com/.well-known/acme-challenge/JJY9MUrI4SI5xpFJ_3t9mEu2i5UyolIpv7fqqfAKg2o: Connection refused, ecurealestate.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://ecurealestate.com/.well-known/acme-challenge/0Om_CaOI2O1xnzB7GxaggwGsxEy3rmzuPuvVF_t1Axs: Connection refused, sourcesinfo.com (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://sourcesinfo.com/.well-known/acme-challenge/bMLrZcEW3Y6_DQMddA30WGY8k0sudsR5NFDVeiQq6IU: Connection refused. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/usr/local/etc/letsencrypt/live/sourcesinfo.com/fullchain.pem (failure)

All renewal attempts failed. The following certs could not be renewed:
/usr/local/etc/letsencrypt/live/sourcesinfo.com/fullchain.pem (failure)

Running post-hook command: service apache24 start
Output from service:
Performing sanity check on apache24 configuration:
Starting apache24.

Error output from service:
Syntax OK

1 renew failure(s), 0 parse failure(s)

My web server is (include version):apache24

The operating system my web server runs on is (include version):freebsd-11.1- -RELEASE-p4

My hosting provider, if applicable, is: self hosting

I can login to a root shell on my machine (yes or no, or I don’t know):yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):no

2

Hi @ag56,

There may be other problems but here are two things that should help:

① The --pre-hook "service apache24 stop" --post-hook "service apache24 start" is only appropriate when you used --standalone. For --webroot, it will make the renewal fail, because the existing web server must be running during the renewal for --webroot. (By contrast, for --standalone there must not be an existing web server listening on port 80 during the renewal.)

② You have a broken redirect in your web server configuration that is, for example, redirecting http://sourcesinfo.com/.well-known/ to https://sourcesinfo.com.well-known/ (note that a slash is missing in the middle). This is a common problem and is usually caused by redirecting http://example.com/ to https://example.com (without the trailing slash); it can usually be fixed by finding the redirect directive and adding the trailing slash at the end.

If you try the renewal again after fixing that, you can let us know if you get a different error message or if everything works out OK.

3

Hi schoen,

Thank you for the quick reply.
Were would I find the broken redirect? Not in httpd.conf?
I use the sites-avaible and sites-enable
Thanks

4

You can try something like

egrep -r '(Redirect|Rewrite)' /etc/apache2

(or whatever directory your Apache configuration is located in) to look for directives that could cause it.

5

Hi schoen,

Please disregard my previous reply.
You were very helpful, I found the file and all is good now
Much appreciate.

6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.