Renewal failure - cannot bind to port

QuenToki · January 15, 2021, 3:32pm

Hello everyone, I would like to renew my SSL certificate I am a beginner in the domain my certificate has expired so I would like to make it work again however I am a tutorial and when I do this command I have this error

My domain is: https://ohward.com/

I ran this command: certbot renew -n -q

It produced this output:

Attempting to renew cert (ohward.com-0001) from /etc/letsencrypt/renewal/ohward.com-0001.conf produced an unexpected error: Proble m binding to port 80: Could not bind to IPv4 or IPv6.. Skipping. Attempting to renew cert (ohward.com) from /etc/letsencrypt/renewal/ohward.com.conf produced an unexpected error: Problem binding to port 80: Could not bind to IPv4 or IPv6.. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/ohward.com-0001/fullchain.pem (failure) /etc/letsencrypt/live/ohward.com/fullchain.pem (failure)

My web server is (include version): NGNIX

rg305 · January 15, 2021, 3:38pm

Hi and welcome to the LE community forum

Please show the renewal configuration files.
/etc/letsencrypt/renewal/ohward.com-0001.conf
/etc/letsencrypt/renewal/ohward.com.conf

rg305 · January 15, 2021, 3:47pm

This may also need some cleaning up.
Please show the output of:
certbot certificates

QuenToki · January 15, 2021, 3:54pm

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/ohward.com-0001.conf with version 0.31.0 of Certbot. This might not work.
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/ohward.com.conf with version 0.31.0 of Certbot. This might not work.
OCSP check failed for /etc/letsencrypt/live/ohward.com-0001/cert.pem (are we offline?)
OCSP check failed for /etc/letsencrypt/live/ohward.com/cert.pem (are we offline?)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: ohward.com-0001
    Domains: ohward.com www.ohward.com
    Expiry Date: 2021-01-13 19:31:46+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/ohward.com-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/ohward.com-0001/privkey.pem
  Certificate Name: ohward.com
    Domains: ohward.com
    Expiry Date: 2021-01-13 18:59:16+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/ohward.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/ohward.com/privkey.pem

rg305 · January 15, 2021, 3:56pm

These configs show that you ran certbot in --standalone mode.
In order to do that now, you would need to stop nginx first.

As for the certs, they are both expired.
But the first has two names - where the second only has one.
You should probably just delete them both and reissue one with both names.

QuenToki · January 15, 2021, 3:57pm

Thank you rg305 !! here is the 2 config files :

# renew_before_expiry = 30 days
version = 1.9.0
archive_dir = /etc/letsencrypt/archive/ohward.com-0001
cert = /etc/letsencrypt/live/ohward.com-0001/cert.pem
privkey = /etc/letsencrypt/live/ohward.com-0001/privkey.pem
chain = /etc/letsencrypt/live/ohward.com-0001/chain.pem
fullchain = /etc/letsencrypt/live/ohward.com-0001/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = standalone
account = 166ca9ede148c3b9dbea2d94ba0f320e
server = https://acme-v02.api.letsencrypt.org/directory

# renew_before_expiry = 30 days
version = 1.9.0
archive_dir = /etc/letsencrypt/archive/ohward.com
cert = /etc/letsencrypt/live/ohward.com/cert.pem
privkey = /etc/letsencrypt/live/ohward.com/privkey.pem
chain = /etc/letsencrypt/live/ohward.com/chain.pem
fullchain = /etc/letsencrypt/live/ohward.com/fullchain.pem


# Options used in the renewal process
[renewalparams]
authenticator = standalone
account = 166ca9ede148c3b9dbea2d94ba0f320e
server = https://acme-v02.api.letsencrypt.org/directory

QuenToki · January 15, 2021, 3:59pm

what is --santdalone mode ?

rg305 · January 15, 2021, 3:59pm

That is where certbot acts as the web server to satisfy the HTTP challenge.
You must have done that to get the certs you have now.

See: User Guide — Certbot 1.11.0.dev0 documentation (eff.org)

QuenToki · January 15, 2021, 4:01pm

I see ! haha can you give me the steps to do to solve this problem ? step by step
I'm a beginner so I have to understand ^^

rg305 · January 15, 2021, 4:03pm

That depends.
If you want to repeat what you did before:

systemctl stop nginx
certbot renew
systemctl start nginx

If you want to "better" it a bit, then try:

certbot renew --nginx

QuenToki · January 15, 2021, 4:10pm

i did it but nothing new append to my website ^^ I still don't have a ssl who work

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/ohward.com-0001.conf with version 0.31.0 of Certbot. This might not work.
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/ohward.com.conf with version 0.31.0 of Certbot. This might not work.
OCSP check failed for /etc/letsencrypt/live/ohward.com-0001/cert.pem (are we offline?)
OCSP check failed for /etc/letsencrypt/live/ohward.com/cert.pem (are we offline?)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: ohward.com-0001
    Domains: ohward.com www.ohward.com
    Expiry Date: 2021-01-13 19:31:46+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/ohward.com-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/ohward.com-0001/privkey.pem
  Certificate Name: ohward.com
    Domains: ohward.com
    Expiry Date: 2021-01-13 18:59:16+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/ohward.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/ohward.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
root@ip-172-31-22-65:/etc/apache2# ^C
root@ip-172-31-22-65:/etc/apache2# systemctl stop nginx
root@ip-172-31-22-65:/etc/apache2# certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/ohward.com-0001.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/ohward.com-0001.conf with version 0.31.0 of Certbot. This might not work.
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator standalone, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for ohward.com
http-01 challenge for www.ohward.com
Waiting for verification...
Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/ohward.com-0001/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/ohward.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/ohward.com.conf with version 0.31.0 of Certbot. This might not work.
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator standalone, Installer None
Renewing an existing certificate

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/ohward.com/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded. The following certs have been renewed:
  /etc/letsencrypt/live/ohward.com-0001/fullchain.pem (success)
  /etc/letsencrypt/live/ohward.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

rg305 · January 15, 2021, 4:11pm

Show again:
certbot certificates

QuenToki · January 15, 2021, 4:12pm

Found the following certs:
  Certificate Name: ohward.com-0001
    Domains: ohward.com www.ohward.com
    Expiry Date: 2021-04-15 15:05:39+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/ohward.com-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/ohward.com-0001/privkey.pem
  Certificate Name: ohward.com
    Domains: ohward.com
    Expiry Date: 2021-04-15 15:05:42+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/ohward.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/ohward.com/privkey.pem

rg305 · January 15, 2021, 4:13pm

There you go.
Both certs have been renewed.

You may need to restart nginx to use them.

QuenToki · January 15, 2021, 4:14pm

But if you go to my website nothing happens ^^
I restarted it but nothing happens

rg305 · January 15, 2021, 4:16pm

HTTP is served by NGINX.
HTTPS is being served by EXPRESS.

curl -Iki http://ohward.com
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Fri, 15 Jan 2021 16:15:10 GMT
Content-Type: text/html
Content-Length: 10918
Last-Modified: Fri, 10 Jul 2020 15:19:40 GMT
Connection: keep-alive
ETag: "5f08870c-2aa6"
Accept-Ranges: bytes

curl -Iki https://ohward.com
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Content-Type: text/html; charset=UTF-8
Content-Length: 1090
ETag: W/"442-gXyFsrNjgezfUO/8XClPKwDBwPI"
Date: Fri, 15 Jan 2021 16:15:34 GMT
Connection: keep-alive

rg305 · January 15, 2021, 4:16pm

Can you restart EXPRESS?

QuenToki · January 15, 2021, 4:17pm

what is that ^^ ! explain me how

rg305 · January 15, 2021, 4:17pm

I don't know.
It is your server.
I'm only showing you what it is showing me.

rg305 · January 15, 2021, 4:18pm

Can you find your original instructions (from a few months ago) ?
Can you reboot the entire server?

Topic		Replies	Views
Renew cert with a GitLab instance produce error Help	8	3234	August 15, 2019
UBUNTU - certbot cant renew cant bind to port 80 Help	2	724	February 4, 2022
Can't renew my certificate! FAILURE Help	2	8790	November 10, 2016
Renew My certificate Help	6	3768	July 28, 2019
Renew command fails Help	16	657	October 15, 2020

Renewal failure - cannot bind to port

Related topics