Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: please ask
I ran this command: certbot renew
It produced this output: renewal was successful but still shows expired?
My web server is (include version):
The operating system my web server runs on is (include version): ubuntu
My hosting provider, if applicable, is: hosted internally
I can login to a root shell on my machine (yes or no, or I don’t know): yes I have root privilages
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no, ssh
If that says you have an up-to-date certficate, then it was indeed renewed and saved successfully, but not installed to your web server. You may simply need to restart / reload the web server to get it to pick up the renewed certificate. If you used the --apache or --nginx plugins when obtaining the certificate, then this should happen automatically; whereas if you used --webroot it would not, but you can still automate it by using the --deploy-hook option. For example:
(If you just run that once, the option will be remembered for that certificate and you can just use certbot renew next time).
If you previously copied the certificate to a different location for your web server to use, then you'll have to repeat that step too (which can also be automated with --deploy-hook).
If on the other hand certbot certificates shows an expired certificate you have a different problem. In that case check the contents of /etc/letsencrypt/live/yourdomain.example/ - they should be symbolic links to the latest files in /etc/letsencrypt/archive/yourdomain.example/. If they are not then the links will need to be recreated.
I did run that certbot renew command earier again but then I got this message:
root@docrepo5:~# certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/subdomain.stonethree.com.conf
-------------------------------------------------------------------------------
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for subdomain.stonethree.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (subdomain.stonethree.com) from /etc/letsencrypt/renewal/subdomain.stonethree.com.conf produced an unexpected error: urn:acme:error:rateLimited :: There were too many requests of a given type :: Error creating new cert :: too many certificates already issued for exact set of domains: subdomain.stonethree.com: see https://letsencrypt.org/docs/rate-limits/. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/subdomain.stonethree.com/fullchain.pem (failure)
-------------------------------------------------------------------------------
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/subdomain.stonethree.com/fullchain.pem (failure)
-------------------------------------------------------------------------------
1 renew failure(s), 0 parse failure(s)
Must I run your suggested command again and see waht happens?
I also must say we make use if nginx thou, will that be a issue?
root@subdomain:~# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
-------------------------------------------------------------------------------
Found the following certs:
Certificate Name: subdomain.stonethree.com
Domains: subdomain.stonethree.com
Expiry Date: 2018-10-30 12:53:21+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/subdomain.stonethree.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/subdomain.stonethree.com/privkey.pem
-------------------------------------------------------------------------------
But what is strange, I ran the same command yesterday and this was the output:
root@docrepo5:~# certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/subdomain.stonethree.com.conf
-------------------------------------------------------------------------------
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for subdomain.stonethree.com
Waiting for verification...
Cleaning up challenges
-------------------------------------------------------------------------------
new certificate deployed with reload of nginx server; fullchain is
/etc/letsencrypt/live/subdomain.stonethree.com/fullchain.pem
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/subdomain.stonethree.com/fullchain.pem (success)
-------------------------------------------------------------------------------
Yeah, that’s wrong. Looks like you (or someone) renamed some directories under /etc/letsencrypt/live/.
I’d start by renaming them back - presumably:
cd /etc/letsencrypt/live
mv subdomain.stonethree.com subdomain.stonethree.com-0001
mv subdomain.stonethree.com.old subdomain.stonethree.com
Then run certbot certificates again. You should now have two certificates. Carefully check which domain names are included on each. Make sure your nginx configuration is pointed at the correct one. Then try the renewal again.
target /etc/letsencrypt/archive/subdomain.stonethree.com-0001/cert1.pem of symlink /etc/letsencrypt/live/subdomain.stonethree.com/cert.pem does not exist
Renewal configuration file /etc/letsencrypt/renewal/subdomain.stonethree.com.conf is broken. Skipping.
No renewals were attempted.
Additionally, the following renewal configuration files were invalid:
/etc/letsencrypt/renewal/subdomain.stonethree.com.conf (parsefail)
0 renew failure(s), 1 parse failure(s)
After following your steps mentioned in your previous reply.
Hmm, that’s surprising. Could you post the current output of the ls commands after that? And also the content of the file /etc/letsencrypt/renewal/subdomain.stonethree.com.conf
The following certs are not due for renewal yet:
/etc/letsencrypt/live/subdomain.stonethree.com/fullchain.pem expires on 2019-01-29 (skipped)
No renewals were attempted.
root@subdomain:~# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Found the following certs:
Certificate Name: subdomain.stonethree.com
Domains: subdomain.stonethree.com
Expiry Date: 2019-01-29 07:00:52+00:00 (VALID: 88 days)
Certificate Path: /etc/letsencrypt/live/subdomain.stonethree.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/subdomain.stonethree.com/privkey.pem
Figured out it can’t be that difficult.
Thanks again for all your help, I really do appreciate it.
Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator nginx, Installer None
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for label.stonethree.com
Waiting for verification…
Cleaning up challenges
Attempting to renew cert (label.stonethree.com) from /etc/letsencrypt/renewal/label.stonethree.com.conf produced an unexpected error: Failed authorization procedure. label.stonethree.com (tls-sni-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Error getting validation data. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/label.stonethree.com/fullchain.pem (failure)
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/label.stonethree.com/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
IMPORTANT NOTES:
The following errors were reported by the server:
Domain: label.stonethree.com
Type: connection
Detail: Error getting validation data
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you’re using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
It's using the old tls-sni-01 challenge. It may be possible to make it work, but there's not much point as it's deprecated and will be removed soon. The latest version of certbot uses the alternative http-01 challenge by default; maybe you need to upgrade your certbot?
If you're stuck with an older version for some reason, you can force it to use the http-01 challenge by adding the option: --preferred-challenges http-01
If your certbot is too old even for that, you can use --webroot and specify a webroot path with -w.
Just changing the challenge type may be enough to fix the problem, but if it's not, please post the new error you get.
Also btw:
This indicates you probably used certonly when obtaining the cert originally, so it won't automatically reload nginx for you when it renews. If you didn't intend that, you can change it by adding the --installer nginx option.
As usual, you only need to specify these options once, then they will be saved in the renewal configuration file and used automatically next time (assuming you succeed in obtaining a renewed certificate).
Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for label.stonethree.com
Waiting for verification…
Cleaning up challenges
new certificate deployed with reload of nginx server; fullchain is
/etc/letsencrypt/live/label.stonethree.com/fullchain.pem
Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/label.stonethree.com/fullchain.pem (success)
Status:
root@label:/etc/letsencrypt/renewal# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Found the following certs:
Certificate Name: label.stonethree.com
Domains: label.stonethree.com
Expiry Date: 2018-11-15 12:18:41+00:00 (VALID: 4 hour(s))
Certificate Path: /etc/letsencrypt/live/label.stonethree.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/label.stonethree.com/privkey.pem
This now looks a lot like the problem you had with the other VM: the certificate is renewed successfully, but certbot still sees the old version. As before, this is most likely a sign that the symbolic link structure has been disrupted. Previously this turned out to be because the directories had been renamed - can you check if that’s the case here as well?