SSL Not Getting Renewed

Help
1

While attempting to renew the Certs I ran sudo letsencrypt renew and got the following error after the few attempts of resolving the error listed below this one.

     Processing /etc/letsencrypt/renewal/mydomain.in.conf

     - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

     Cert is due for renewal, auto-renewing...

     Plugins selected: Authenticator apache, Installer apache

     Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

     Renewing an existing certificate

     Attempting to renew cert (mydomain.in) from /etc/letsencrypt/renewal/mydomain.in.conf produced an unexpected error: urn:ietf:params:acme:error:rateLimited :: There were too many requests of a given type :: Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/rate-limits/. Skipping.

     
    Attempting to renew cert (mydomain.in) from /etc/letsencrypt/renewal/mydomain.in.conf produced an unexpected error: Failed authorization procedure. www.mydomain.asia (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.mydomain.asia/.well-known/acme-challenge/tyH_i2JLEJKJt0MYZ1JHRXMGUSUiAhJMIHRwyube3cA [13.233.113.39]: 404, mydomain.asia (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://mydomain.asia/.well-known/acme-challenge/mzRJdGzJcayyBwgzOCkzV5F4iaC7VoKfWJ5OW_rL-Yg [13.233.113.39]: 404. Skipping.
2

Hi @hitesh

please answer the following questions. That’s the standard template of #help

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

3

I’ve updated this thread.

4

You have a lot of older certificates ( https://check-your-website.server-daten.de/?q=genuus.asia#ct-logs ):

CRT-Id Issuer not before not after Domain names LE-Duplicate next LE
1456001328 CN=Let’s Encrypt Authority X3, O=Let’s Encrypt, C=US 2019-05-08 09:48:11 2019-08-06 09:48:11 uatapcdn.genuus.asia
1 entries duplicate nr. 1
1338908483 CN=Let’s Encrypt Authority X3, O=Let’s Encrypt, C=US 2019-03-24 02:52:45 2019-06-22 01:52:45 jaihind.genuus.asia
1 entries
1300541186 CN=Let’s Encrypt Authority X3, O=Let’s Encrypt, C=US 2019-03-18 15:48:54 2019-06-16 14:48:54 dmpm.genuus.asia
1 entries
1205380902 CN=Let’s Encrypt Authority X3, O=Let’s Encrypt, C=US 2019-02-15 10:03:25 2019-05-16 09:03:25 uatapcdn.genuus.asia
1 entries
1191921356 CN=Let’s Encrypt Authority X3, O=Let’s Encrypt, C=US 2019-02-10 17:46:12 2019-05-11 16:46:12 dmpm.genuus.asia, genuus.asia, genuus.in, genuus.io, www.genuus.asia, www.genuus.in, www.genuus.io
7 entries

Oldest is from 2017-10-25 12:45

So the good news: Looks like you have used tls-sni-01 validation, that’s not longer supported. Certbot uses another authenticator, that doesn’t work.

The next good news: Your configuration looks ok:

Domainname Http-Status redirect Sec. G
• http://genuus.asia/
13.233.113.39 301 https://www.genuus.asia/index.php 0.257 E
• http://www.genuus.asia/
13.233.113.39 301 https://www.genuus.asia/index.php 0.257 A
• https://genuus.asia/
13.233.113.39 301 https://www.genuus.asia/ 1.503 N
Certificate error: RemoteCertificateChainErrors
• https://www.genuus.asia/
13.233.113.39 301 https://www.genuus.asia/index.php 1.267 N
Certificate error: RemoteCertificateChainErrors
• https://www.genuus.asia/index.php 200 1.086 N
Certificate error: RemoteCertificateChainErrors
• http://genuus.asia/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
13.233.113.39 404 0.260 A
Not Found
Visible Content: Page not found
• http://www.genuus.asia/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
13.233.113.39 404 0.257 A

Port 80 is open, checking a file in /.well-known/acme-challenge sends the expected result http status 404 - Not Found. No wrong redirect.

So find your DocumentRoot of that port 80 - vHost and use it.

certbot run -a webroot -i apache -w yourDocumentRoot -d www.genuus.asia -d genuus.asia

But one problem: Your certificate has a lot of domain names:

CN=genuus.in
	10.02.2019
	11.05.2019
2 days expired	
dmpm.genuus.asia, genuus.asia, 
genuus.in, genuus.io, www.genuus.asia, 
www.genuus.in, www.genuus.io - 7 entries

Have all domains the same DocumentRoot and the same vHost? If yes, you can add the additional domains with the -d switch. If some domains have another vHost, create an own certificate with that vHost + domains.

2 Likes
5

Great! Thanks for the help.

It solved my problem.

1 Like
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.