# Still old certificate after using renwe

**URL:** <https://community.letsencrypt.org/t/still-old-certificate-after-using-renwe/28080>\
**Category:** Help\
**Created:** [February 17, 2017, 10:45am UTC](https://community.letsencrypt.org/t/still-old-certificate-after-using-renwe/28080 "2017-02-17T10:45:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hansrouge](https://avatars.discourse-cdn.com/v4/letter/h/ecae2f/32.png) [@hansrouge](https://community.letsencrypt.org/u/hansrouge)\
**Post date:** [February 17, 2017, 10:45am UTC](https://community.letsencrypt.org/t/still-old-certificate-after-using-renwe/28080/1 "2017-02-17T10:45:27Z")

</div>

Hello,

my certificate has been expired and I tried renewing it, but that doesn’t work for me.  
Using Ubuntu and Apache2.

I used

```auto
sudo letsencrypt renew

```

The output was:

```auto
[...]
The following certs were successfully renewed:
  /etc/letsencrypt/live/mydomain.com/fullchain.pem (success)
[...]
new certificate deployed with reload of apache server; fullchain is /etc/letsencrypt/live/mydomain.com/fullchain.pem
[...]

```

The I restartet my apache using:

```auto
sudo service apache2 restart

```

But I still get an error and the old certificate, which has expired 2 days ago. “The certificate expired on February the 15th 2017…” (sec\_error\_expired\_certificate).

I double checked the pathes to the pem-files in the config files (/etc/letsencrypt/renewel/mydomain.com.conf and apaches/sites-enabled/mydomain.conf). The pathes are correct.  
If I use

```auto
sudo ls -l

```

in the live-directory alle the pem-files have the correct date (February 17th).

Setting up a new certificate still works. Just renewing does not work.

Any suggestions that might fix the problem?

Thank you!  
regards  
hansrouge

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [February 17, 2017, 1:13pm UTC](https://community.letsencrypt.org/t/still-old-certificate-after-using-renwe/28080/2 "2017-02-17T13:13:40Z")

</div>

> [@hansrouge](#):
>
> in the live-directory alle the pem-files have the correct date (February 17th).

If you did a `ls -l`, you also saw that the files in the live directory are symbolic links pointing to certificates in the /archive/ directory. Could you check that dir as well? Especially of course the files the symlinks in live are pointing at 😉

---

<div class="post-metadata">

**Author:** ![hansrouge](https://avatars.discourse-cdn.com/v4/letter/h/ecae2f/32.png) [@hansrouge](https://community.letsencrypt.org/u/hansrouge)\
**Post date:** [February 17, 2017, 2:29pm UTC](https://community.letsencrypt.org/t/still-old-certificate-after-using-renwe/28080/3 "2017-02-17T14:29:22Z")

</div>

Wow, thank you very much! The symbolic links were wrong.

The archive-folders were pretty messed up:  
First: Somehow in archive/ were [mydomain.com](http://mydomain.com) and mydomain.com-0001  
The files in /live/ were linked to the 0001 folder. The date of the \*.pem-files within the -0001 folder were from November.

Second: In the [mydomain.com](http://mydomain.com) folder (not 0001) the \*.pem-files were double: cert1.pem and cert2.pem (etc.). And only the \*2.pem-files were the newly build ones.

I have no idea how or why this got messy like that.  
My solution was simple and fest: Just fix the symbolic links:

```auto
// Remove the old symbolic link
sudo -rm /etc/letsencrypt/live/mydomain.com/privkey.pem
// Create the new sb
sudo ln -s /etc/letsencrypt/archive/mydomain.com/privkey2.pem /etc/letsencrypt/live/mydomain.com/privkey.pem

```

Thank you so much Osiris for your help! That saved me a lot of time 😊

Kind regards  
hansrouge

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [February 17, 2017, 2:33pm UTC](https://community.letsencrypt.org/t/still-old-certificate-after-using-renwe/28080/4 "2017-02-17T14:33:30Z")

</div>

> [@hansrouge](#):
>
> First: Somehow in archive/ were [mydomain.com](http://mydomain.com) and mydomain.com-0001

That sometimes happens if you add another FQDN to an existing certificate without the `--expand` switch.

> [@hansrouge](#):
>
> Second: In the [mydomain.com](http://mydomain.com) folder (not 0001) the \*.pem-files were double: cert1.pem and cert2.pem (etc.). And only the \*2.pem-files were the newly build ones.

That's normal behaviour. `certbot` will leave the existing (old) cert/keys in the archive (hence the name "archive" ;)) and create new keys/certificates with `n+1` where `n` is the number of the current certificate when renewing.

But I'm glad you fixed it! You should check your renewal file in `/etc/letsencrypt/renewal/` to see if the locations at the top point to the correct folder. I see you don't want to use the `-0001` folder, so the renewal file should reflect that. But as you say the newest certificates are currently situated in the folder _without_ the `-0001` part, I recon the renewal file will reflect that as well.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [March 19, 2017, 2:33pm UTC](https://community.letsencrypt.org/t/still-old-certificate-after-using-renwe/28080/5 "2017-03-19T14:33:52Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.