Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
You probably are missing the ISRG Root X1 certificate in the trusted store on your system. Here is a post explaining it and the post following that shows someone who corrected a similar problem on Ubuntu 16.
@joginder89
Without upgrading from certbot v0.28.0 to v1.12(or higher), there is only the manual editing of the chain.pem or fullchain.pem file (whichever one is being used).
[note: the edit will be reverted upon cert renewal/reissuance]
Otherwise, you could try using another ACME client that also supports that parameter - like acme.sh
In order to use the --preferred-chain parameter, you will need to get to certbot v1.12(or higher)
For that, you will have to install the latest certbot from snap
See the full installation instructions at: http://certbot.eff.org/
OR switch to another ACME client...
Not the self-signed one (the one you need).
It is using the default chain:
openssl s_client -connect selfstudys.com:443 -servername selfstudys.com | head
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = selfstudys.com
verify return:1
CONNECTED(00000005)
---
Certificate chain
0 s:CN = selfstudys.com
i:C = US, O = Let's Encrypt, CN = R3
1 s:C = US, O = Let's Encrypt, CN = R3
i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
@rg305 thank you for reply. I am unable to install the latest certbot from snap, same problem here also. I try to run certbot --force-renewal also. This also not success shows certificate has expired or is not yet valid certbot
I try to run also acme.sh -f -r -d www.selfstudys.com -d selfstudys.com
but it gives acme.sh: command not found
@rg305 I install acme.sh. Then run acme.sh -f -r -d www.selfstudys.com -d selfstudys.com but now it give www.selfstudys.com' is not an issued domain, skip.
acme.sh --list gives Main_Domain KeyLength SAN_Domains CA Created Renew
As I have install the certificates using sudo certbot --nginx. If I am able to verify the domain once, I will install the certbot using snap and can later use nginx plugin for auto renew.
@rg305 Sorry, I do not understand your question. I know very little about these. Now I understand these are different client to get cert. I am not sure if I need to change the client to get cert. Current problem is that I am not able to verify my domain using Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org, So I need to find other way for it.
@rg305 I have many domains, so it may be difficult to switch to acme.sh. Can you tell me How to solve it using certbot. Any way except Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org to verify my domain during renew cert.
There is only one other simple way that can be automated.
DNS authentication.
But that depends on your DNS Service Provider - which must support DNS zone updates via API.
I have not set the server time, that's why I was not able to install new certbot and renew the cert.
I solved the problem of not renew cert by following bellow steps:
I solved the problem by running certbot renew --preferred-chain "ISRG Root X1" --force-renewal
note that I need to re-install certbot to latest version.
