Renewal fails unexpectedly. Has worked for several years

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:mail.makyd.me.uk

I ran this command:certbot renew --dry-run

It produced this output:Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:

My web server is (include version):Apache/2.4.37 (centos)

The operating system my web server runs on is (include version):Centos 8 4.18.0-348.7.1.el8_5.x86_64

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):certbot 1.22.0

2

Which problems exactly? Please post the entire output.

Things I see already:

  • port 80 is closed, which is required for the http-01 challenge (but I don't know if you're using that challenge due to lack of enough output);
  • on HTTPS, your hostname mail.makyd.me.uk is serving the certificate for just www.makyd.me.uk. Probably a misconfigured Apache.
3 Likes
3

This may give a bit more details
https://letsdebug.net/mail.makyd.me.uk/2084813

2 Likes
4

OK, I will look at the Apache settings. I am baffled, as that has not been changed and neither have the certbot settings since march 2021.

Should I add the output of "cat /var/log/letsencrypt/letsencrypt.log" to this thread?

5

Or just the command line output to begin with. Maybe we'll need the entire log afterwards, maybe not. There's a very good chance it's due to your port 80 being closed.

1 Like
6

ok, I modified apache so that http to port 80 is allowed where before it was rewriting to https on port 443. Now I could renew my cerificates.

I am puzzled though, as the previous configuration was working since 2021.

Whatever, it seems to be ok now. How do I mark this thread as solved?

Thanks for the pointers.

1 Like
7

Are you sure it was just Apache? Because I was getting a time out (just as Let's Encrypt) and that usually means a missing NAT portmap and/or a firewall blocking access to incoming port 80.

Every post has a "checkmark" (:ballot_box_with_check:) in the row of buttons on the bottom right which you can click to mark it as the answer.

1 Like
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.