# Ssl certificate issue

**URL:** <https://community.letsencrypt.org/t/ssl-certificate-issue/209930>\
**Category:** Help\
**Created:** [December 12, 2023, 6:05am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930 "2023-12-12T06:05:42Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![shwethaanandram](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shwethaanandram/32/74891_2.png) [@shwethaanandram](https://community.letsencrypt.org/u/shwethaanandram)\
**Post date:** [December 12, 2023, 6:05am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/1 "2023-12-12T06:05:42Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:dev.api.amepos.io

I ran this command: salt which renews certificate

It produced this output:success

My web server is (include version):nginx

The operating system my web server runs on is (include version):debian

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):certbot

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 12, 2023, 6:26am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/3 "2023-12-12T06:26:10Z")

</div>

What is the _ **issue** _?  
If it is this:  
 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/1/0/1041b86576b4c819d48df6732c13904dbfbf7b80.png)

What shows?:  
`certbot certificates`  
It should show a renewed cert:  
 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/5/9/5920973b44ac9fb879a5dcb1a9fdcf6bc1b1a8c4.png)  
If so, then you only need to restart/reload the web service [so that it can use the latest cert].

---

<div class="post-metadata">

**Author:** ![shwethaanandram](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shwethaanandram/32/74891_2.png) [@shwethaanandram](https://community.letsencrypt.org/u/shwethaanandram)\
**Post date:** [December 12, 2023, 6:43am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/4 "2023-12-12T06:43:19Z")

</div>

yes, i restarted the webserver still website is showing ssl certification is expired

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [December 12, 2023, 7:31am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/5 "2023-12-12T07:31:25Z")

</div>

Please show the `nginx` configuration, with:

# `nginx -T`

---

<div class="post-metadata">

**Author:** ![shwethaanandram](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shwethaanandram/32/74891_2.png) [@shwethaanandram](https://community.letsencrypt.org/u/shwethaanandram)\
**Post date:** [December 12, 2023, 8:48am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/6 "2023-12-12T08:48:04Z")

</div>

nginx -T  
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok  
nginx: configuration file /etc/nginx/nginx.conf test is successful

---

<div class="post-metadata">

**Author:** ![shwethaanandram](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shwethaanandram/32/74891_2.png) [@shwethaanandram](https://community.letsencrypt.org/u/shwethaanandram)\
**Post date:** [December 12, 2023, 8:49am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/7 "2023-12-12T08:49:48Z")

</div>

certbot renew --cert-name "[dev.api.amepos.io](http://dev.api.amepos.io)" --deploy-hook "service nginx reload"  
Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

Processing /etc/letsencrypt/renewal/dev.api.amepos.io.conf

* * *

Cert not yet due for renewal

* * *

The following certificates are not due for renewal yet:  
/etc/letsencrypt/live/dev.api.amepos.io/fullchain.pem expires on 2024-01-28 (skipped)  
No renewals were attempted.  
No hooks were run.

* * *

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [December 12, 2023, 9:08am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/8 "2023-12-12T09:08:06Z")

</div>

> [@shwethaanandram](#):
>
> nginx -T  
> nginx: the configuration file /etc/nginx/nginx.conf syntax is ok  
> nginx: configuration file /etc/nginx/nginx.conf test is successful

Are you sure you used the capital T? Because usually the capital T would output the _entire_ parsed nginx configuration and not just the two syntax check results.

---

<div class="post-metadata">

**Author:** ![shwethaanandram](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shwethaanandram/32/74891_2.png) [@shwethaanandram](https://community.letsencrypt.org/u/shwethaanandram)\
**Post date:** [December 12, 2023, 9:14am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/9 "2023-12-12T09:14:56Z")

</div>

`nginx -T`

```nohighlight
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	# server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}

#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#	server {
# listen localhost:110;
# protocol pop3;
# proxy on;
#	}
#
#	server {
# listen localhost:143;
# protocol imap;
# proxy on;
#	}
#}

# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip.conf:
load_module modules/ngx_http_geoip_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:
load_module modules/ngx_http_image_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:
load_module modules/ngx_http_xslt_filter_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:
load_module modules/ngx_mail_module.so;

# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:
load_module modules/ngx_stream_module.so;

# configuration file /etc/nginx/modules-enabled/70-mod-stream-geoip.conf:
load_module modules/ngx_stream_geoip_module.so;

# configuration file /etc/nginx/mime.types:

types {
    text/html html htm shtml;
    text/css css;
    text/xml xml;
    image/gif gif;
    image/jpeg jpeg jpg;
    application/javascript js;
    application/atom+xml atom;
    application/rss+xml rss;

    text/mathml mml;
    text/plain txt;
    text/vnd.sun.j2me.app-descriptor jad;
    text/vnd.wap.wml wml;
    text/x-component htc;

    image/png png;
    image/tiff tif tiff;
    image/vnd.wap.wbmp wbmp;
    image/x-icon ico;
    image/x-jng jng;
    image/x-ms-bmp bmp;
    image/svg+xml svg svgz;
    image/webp webp;

    application/font-woff woff;
    application/java-archive jar war ear;
    application/json json;
    application/mac-binhex40 hqx;
    application/msword doc;
    application/pdf pdf;
    application/postscript ps eps ai;
    application/rtf rtf;
    application/vnd.apple.mpegurl m3u8;
    application/vnd.ms-excel xls;
    application/vnd.ms-fontobject eot;
    application/vnd.ms-powerpoint ppt;
    application/vnd.wap.wmlc wmlc;
    application/vnd.google-earth.kml+xml kml;
    application/vnd.google-earth.kmz kmz;
    application/x-7z-compressed 7z;
    application/x-cocoa cco;
    application/x-java-archive-diff jardiff;
    application/x-java-jnlp-file jnlp;
    application/x-makeself run;
    application/x-perl pl pm;
    application/x-pilot prc pdb;
    application/x-rar-compressed rar;
    application/x-redhat-package-manager rpm;
    application/x-sea sea;
    application/x-shockwave-flash swf;
    application/x-stuffit sit;
    application/x-tcl tcl tk;
    application/x-x509-ca-cert der pem crt;
    application/x-xpinstall xpi;
    application/xhtml+xml xhtml;
    application/xspf+xml xspf;
    application/zip zip;

    application/octet-stream bin exe dll;
    application/octet-stream deb;
    application/octet-stream dmg;
    application/octet-stream iso img;
    application/octet-stream msi msp msm;

    application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
    application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;

    audio/midi mid midi kar;
    audio/mpeg mp3;
    audio/ogg ogg;
    audio/x-m4a m4a;
    audio/x-realaudio ra;

    video/3gpp 3gpp 3gp;
    video/mp2t ts;
    video/mp4 mp4;
    video/mpeg mpeg mpg;
    video/quicktime mov;
    video/webm webm;
    video/x-flv flv;
    video/x-m4v m4v;
    video/x-mng mng;
    video/x-ms-asf asx asf;
    video/x-ms-wmv wmv;
    video/x-msvideo avi;
}

# configuration file /etc/nginx/proxy_params:
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

# configuration file /etc/nginx/sites-enabled/dev.api.amepos.io.conf:

server {
    listen 80;
    server_name dev.api.amepos.io;

    # ACME http challenges
    location /.well-known/acme-challenge/ {
      root /var/www/html; # matches name in certbot webroot folder
    }

    # Redirect all others
    location / {
      return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name dev.api.amepos.io;

    ssl_certificate /etc/letsencrypt/live/dev.api.amepos.io/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dev.api.amepos.io/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
    ssl_session_tickets off;

    # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
    # ssl_dhparam /etc/nginx/ssl/dhparam;

    # intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000" always;

    ssl_trusted_certificate /etc/letsencrypt/live/dev.api.amepos.io/chain.pem; 

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    location /static {
        alias /var/www/html/amepos_backend_apis/development/static_root;
    }

    location /media {
        alias /var/www/html/amepos_backend_apis/development/media_root;
    }

    location / {
        include proxy_params;
        proxy_pass http://127.0.0.1:5565;
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }

    access_log /var/log/nginx/dev.api.amepos.io.access;
    error_log /var/log/nginx/dev.api.amepos.io.error;
}

```

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [December 12, 2023, 9:24am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/10 "2023-12-12T09:24:04Z")

</div>

Please run `sudo systemctl reload nginx`

---

<div class="post-metadata">

**Author:** ![shwethaanandram](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shwethaanandram/32/74891_2.png) [@shwethaanandram](https://community.letsencrypt.org/u/shwethaanandram)\
**Post date:** [December 12, 2023, 9:25am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/11 "2023-12-12T09:25:43Z")

</div>

> [@Osiris](#):
>
> sudo systemctl reload nginx

Thank you so much solved the issue

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [December 12, 2023, 11:31am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/12 "2023-12-12T11:31:24Z")

</div>

Interesting. I'm glad the issue has been fixed, but I'm puzzled it was not fixed before when you said:

> [@shwethaanandram](#):
>
> i restarted the webserver

🤷‍♂️

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [January 11, 2024, 11:32am UTC](https://community.letsencrypt.org/t/ssl-certificate-issue/209930/13 "2024-01-11T11:32:01Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.