# Renew problem on AWS instance

**URL:** <https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208>\
**Category:** Help\
**Created:** [September 21, 2020, 4:19pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208 "2020-09-21T16:19:36Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Biko](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@Biko](https://community.letsencrypt.org/u/Biko)\
**Post date:** [September 21, 2020, 4:19pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/1 "2020-09-21T16:19:37Z")

</div>

Hi there!, I have a problem with the renew of my domain

My domain is: [mandarinstream.com](http://mandarinstream.com)

I ran this command: ../certbot-auto certonly --force-renew -d [mandarinstream.com](http://mandarinstream.com)

It produced this output:  
Requesting to rerun ./certbot-auto with root privileges...  
Upgrading certbot-auto 1.6.0 to 1.8.0...  
Replacing certbot-auto...  
Creating virtual environment...  
Installing Python packages...  
Installation succeeded.  
Traceback (most recent call last):  
File "/opt/eff.org/certbot/venv/bin/letsencrypt", line 7, in   
from certbot.main import main  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/certbot/main.py", line 2, in   
from certbot.\_internal import main as internal\_main  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/certbot/\_internal/main.py", line 10, in   
import josepy as jose  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/josepy/ **init**.py", line 44, in   
from josepy.interfaces import JSONDeSerializable  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/josepy/interfaces.py", line 7, in   
from josepy import errors, util  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/josepy/util.py", line 7, in   
import OpenSSL  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/OpenSSL/ **init**.py", line 8, in   
from OpenSSL import crypto, SSL  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/OpenSSL/crypto.py", line 12, in   
from cryptography import x509  
ImportError: No module named cryptography

My web server is (include version): I think was a temp apache in a AWS instance.

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):  
the conf file:

# renew\_before\_expiry = 30 days

version = 1.6.0  
archive\_dir = /etc/letsencrypt/archive/mandarinstream.com  
cert = /etc/letsencrypt/live/mandarinstream.com/cert.pem  
privkey = /etc/letsencrypt/live/mandarinstream.com/privkey.pem  
chain = /etc/letsencrypt/live/mandarinstream.com/chain.pem  
fullchain = /etc/letsencrypt/live/mandarinstream.com/fullchain.pem

# Options used in the renewal process

[renewalparams]  
authenticator = standalone  
account = 0ac7a724c38cf7a62a6508ed5cd5b97e  
server = [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 4:36pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/2 "2020-09-21T16:36:22Z")

</div>

Q1: Why are you using?:

> [@Biko](#):
>
> `--force-renew`

Q2: Is your system up-to-date (specifically Python)?

---

<div class="post-metadata">

**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\
**Post date:** [September 21, 2020, 4:45pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/3 "2020-09-21T16:45:49Z")

</div>

Quick Recon:  
Failed to connect to [mandarinstream.com](http://mandarinstream.com) port 80: Connection refused

PORT STATE SERVICE  
80/tcp closed http  
443/tcp closed https

ImportError: No module named cryptography

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 4:47pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/4 "2020-09-21T16:47:25Z")

</div>

@Rip

> [@Biko](#):
>
> authenticator = standalone

---

<div class="post-metadata">

**Author:** ![Biko](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@Biko](https://community.letsencrypt.org/u/Biko)\
**Post date:** [September 21, 2020, 5:01pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/5 "2020-09-21T17:01:35Z")

</div>

Hi Rip, thanks guys, 80 and 443 are open by far

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 5:02pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/6 "2020-09-21T17:02:27Z")

</div>

Slow Recon...  
Try using this instead (before your cert expires on 2020.10.06) of `--force-renew`:  
`--no-self-upgrade`

[as you problem seems to be in the upgrade from 1.6.0 to 1.8.0]

---

<div class="post-metadata">

**Author:** ![Biko](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@Biko](https://community.letsencrypt.org/u/Biko)\
**Post date:** [September 21, 2020, 5:02pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/7 "2020-09-21T17:02:41Z")

</div>

So... this is bad?,  
should I change it?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 5:03pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/8 "2020-09-21T17:03:06Z")

</div>

Yes, you should almost never need to force anything to happen.

---

<div class="post-metadata">

**Author:** ![Biko](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@Biko](https://community.letsencrypt.org/u/Biko)\
**Post date:** [September 21, 2020, 5:07pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/9 "2020-09-21T17:07:46Z")

</div>

> [@rg305](#):
>
> --no-self-upgrade

thanks men!, no luck anyway.

./certbot-auto certonly --no-self-upgrade  
Error: couldn't get currently installed version for /opt/eff.org/certbot/venv/bin/letsencrypt:  
Traceback (most recent call last):  
File "/opt/eff.org/certbot/venv/bin/letsencrypt", line 7, in   
from certbot.main import main  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/certbot/main.py", line 2, in   
from certbot.\_internal import main as internal\_main  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/certbot/\_internal/main.py", line 10, in   
import josepy as jose  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/josepy/ **init**.py", line 44, in   
from josepy.interfaces import JSONDeSerializable  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/josepy/interfaces.py", line 7, in   
from josepy import errors, util  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/josepy/util.py", line 7, in   
import OpenSSL  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/OpenSSL/ **init**.py", line 8, in   
from OpenSSL import crypto, SSL  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/OpenSSL/crypto.py", line 12, in   
from cryptography import x509  
ImportError: No module named cryptography

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 5:08pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/10 "2020-09-21T17:08:27Z")

</div>

Ouch!

OK, what about?:  
`sudo apt update`  
`sudo apt upgrade`

[I got more sleeves filled with tricks if that don't fix this]

---

<div class="post-metadata">

**Author:** ![Biko](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@Biko](https://community.letsencrypt.org/u/Biko)\
**Post date:** [September 21, 2020, 5:10pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/11 "2020-09-21T17:10:39Z")

</div>

Sorry men, this is a AWS Linux instance, it said this:

"sudo: apt: command not found"

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 5:14pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/12 "2020-09-21T17:14:16Z")

</div>

AWS !  
OK that uses yum.  
`yum update`

OR first  
`yum check-update`

---

<div class="post-metadata">

**Author:** ![Biko](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@Biko](https://community.letsencrypt.org/u/Biko)\
**Post date:** [September 21, 2020, 5:21pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/13 "2020-09-21T17:21:12Z")

</div>

> [@Biko](#):
>
> ./certbot-auto certonly --force-renew -d [mandarinstream.com](http://mandarinstream.com)

this updates the python and more things on the AWS instance but the Certbot still on the 1.6.0

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 5:21pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/14 "2020-09-21T17:21:47Z")

</div>

`--force-renew` ? ? ?  
Didn't we talk about that?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 5:22pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/15 "2020-09-21T17:22:46Z")

</div>

I refer you to my first post:

> [@rg305](#):
>
> Q1: Why are you using?:
> 
> > [@Biko](#):
> >
> > `--force-renew`
> 
> Q2: Is your system up-to-date (specifically Python)?

---

<div class="post-metadata">

**Author:** ![Biko](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@Biko](https://community.letsencrypt.org/u/Biko)\
**Post date:** [September 21, 2020, 5:23pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/16 "2020-09-21T17:23:39Z")

</div>

> [@Biko](#):
>
> [mandarinstream.com](http://mandarinstream.com)

same thing

[root@ip-172-31-37-118 tools]# ./certbot-auto certonly --no-self-upgrade [mandarinstream.com](http://mandarinstream.com)  
Error: couldn't get currently installed version for /opt/eff.org/certbot/venv/bin/letsencrypt:  
Traceback (most recent call last):  
File "/opt/eff.org/certbot/venv/bin/letsencrypt", line 7, in   
from certbot.main import main  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/certbot/main.py", line 2, in   
from certbot.\_internal import main as internal\_main  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/certbot/\_internal/main.py", line 10, in   
import josepy as jose  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/josepy/ **init**.py", line 44, in   
from josepy.interfaces import JSONDeSerializable  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/josepy/interfaces.py", line 7, in   
from josepy import errors, util  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/josepy/util.py", line 7, in   
import OpenSSL  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/OpenSSL/ **init**.py", line 8, in   
from OpenSSL import crypto, SSL  
File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/OpenSSL/crypto.py", line 12, in   
from cryptography import x509  
ImportError: No module named cryptography

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 5:24pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/17 "2020-09-21T17:24:03Z")

</div>

> [@Biko](#):
>
> Certbot still on the 1.6.0

Certbot-auto can easily be "upgraded".  
Just delete it.  
Then download the latest version.

---

<div class="post-metadata">

**Author:** ![Biko](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@Biko](https://community.letsencrypt.org/u/Biko)\
**Post date:** [September 21, 2020, 5:24pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/18 "2020-09-21T17:24:40Z")

</div>

yes men, updated right now

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 21, 2020, 5:25pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/19 "2020-09-21T17:25:20Z")

</div>

> [@rg305](#):
>
> yum check-update

Did that show anything?

---

<div class="post-metadata">

**Author:** ![Biko](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@Biko](https://community.letsencrypt.org/u/Biko)\
**Post date:** [September 21, 2020, 5:26pm UTC](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208/20 "2020-09-21T17:26:04Z")

</div>

> [@rg305](#):
>
> yum check-update

just this:  
[root@ip-172-31-37-118 tools]# yum check-update  
Failed to set locale, defaulting to C  
Loaded plugins: priorities, update-motd, upgrade-helper  
amzn-main | 2.1 kB 00:00:00  
amzn-updates | 3.8 kB 00:00:00  
Security: kernel-4.14.193-113.317.amzn1.x86\_64 is an installed security update  
Security: kernel-4.14.181-108.257.amzn1.x86\_64 is the currently running version

[Next page](https://community.letsencrypt.org/t/renew-problem-on-aws-instance/134208.md?page=2)