# Unable to install the certificate

**URL:** <https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960>\
**Category:** Help\
**Created:** [October 27, 2019, 8:55pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960 "2019-10-27T20:55:18Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Soltanius](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@Soltanius](https://community.letsencrypt.org/u/Soltanius)\
**Post date:** [October 27, 2019, 8:55pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/1 "2019-10-27T20:55:18Z")

</div>

my domain is:  
[soltanius.de](http://soltanius.de)

I ran this command:  
certbot --apache -m myEmail -d [soltanius.de](http://soltanius.de)

It produced this output:  
Saving debug log to /var/log/letsencrypt/letsencrypt.log  
Plugins selected: Authenticator apache, Installer apache  
Obtaining a new certificate  
Performing the following challenges:  
http-01 challenge for [soltanius.de](http://soltanius.de)  
Waiting for verification…  
Cleaning up challenges  
Could not reverse map the HTTPS VirtualHost to the original

IMPORTANT NOTES:

- Unable to install the certificate
- Congratulations! Your certificate and chain have been saved at:  
/etc/letsencrypt/live/soltanius.de/fullchain.pem  
Your key file has been saved at:  
/etc/letsencrypt/live/soltanius.de/privkey.pem  
Your cert will expire on 2020-01-25. To obtain a new or tweaked  
version of this certificate in the future, simply run certbot again  
with the “certonly” option. To non-interactively renew _all_ of  
your certificates, run “certbot renew”

My web server is (include version):  
Apache/2.4.29 (Ubuntu)

The operating system my web server runs on is (include version):  
Ubuntu 18.04.3 LTS

My hosting provider, if applicable, is:  
Strato AG

I can login to a root shell on my machine (yes or no, or I don’t know):  
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): /

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot):  
certbot 0.23.0

First, my english is not the best, but i make an effort. 🙂  
I tried to make a SSL certificate for my Website but I got this output and my Website isn´t secured. (tested with Chrome on Windows 10)

My certificate for my cloud (nextcloud) works.  
Domain: [cloud.soltanius.de](http://cloud.soltanius.de)

What can I do?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 27, 2019, 9:02pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/2 "2019-10-27T21:02:13Z")

</div>

Hi @Soltanius

> [@Soltanius](#):
>
> my domain is:  
> [soltanius.de](http://soltanius.de)

checking your domain you have created 4 certificates - [https://check-your-website.server-daten.de/?q=soltanius.de#ct-logs](https://check-your-website.server-daten.de/?q=soltanius.de#ct-logs)

| Issuer | not before | not after | Domain names | LE-Duplicate | next LE |
| --- | --- | --- | --- | --- | --- |
| Let's Encrypt Authority X3 | 2019-10-27 | 2020-01-25 | [soltanius.de](http://soltanius.de) - 1 entries | duplicate nr. 4 | |
| Let's Encrypt Authority X3 | 2019-10-27 | 2020-01-25 | [soltanius.de](http://soltanius.de) - 1 entries | duplicate nr. 3 | |
| Let's Encrypt Authority X3 | 2019-10-27 | 2020-01-25 | [soltanius.de](http://soltanius.de) - 1 entries | duplicate nr. 2 | |
| Let's Encrypt Authority X3 | 2019-10-27 | 2020-01-25 | [soltanius.de](http://soltanius.de) - 1 entries | duplicate nr. 1 | |
| Let's Encrypt Authority X3 | 2019-09-20 | 2019-12-19 | [ts3bot.soltanius.de](http://ts3bot.soltanius.de) - 1 entries | | |

So that part has worked. Don't create a new certificate, there is a rate limit.

But used is the wrong certificate:

```nohighlight
CN=cloud.soltanius.de
	17.09.2019
	16.12.2019
expires in 50 days	cloud.soltanius.de - 1 entry

```

If you can't install it:

First step: Update your Certbot, 0.23 is very old.

Then: Looks like your configuration is buggy, Certbot doesn't understand it.

What says

```nohighlight
apachectl -S

```

---

<div class="post-metadata">

**Author:** ![Soltanius](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@Soltanius](https://community.letsencrypt.org/u/Soltanius)\
**Post date:** [October 27, 2019, 9:12pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/3 "2019-10-27T21:12:14Z")

</div>

Is there an extra command to update certbot?  
I use apt-get upgrade and apt-get install once per week…

apachectl -S:  
VirtualHost configuration:  
81.169.170.18:443 [cloud.soltanius.de](http://cloud.soltanius.de) (/etc/apache2/sites-enabled/nextcloud-le-ssl.conf:2)  
81.169.170.18:80 is a NameVirtualHost  
default server [cloud.soltanius.de](http://cloud.soltanius.de) (/etc/apache2/sites-enabled/nextcloud.conf:1)  
port 80 namevhost [cloud.soltanius.de](http://cloud.soltanius.de) (/etc/apache2/sites-enabled/nextcloud.conf:1)  
alias [www.cloud.soltanius.de](http://www.cloud.soltanius.de)  
port 80 namevhost [soltanius.de](http://soltanius.de) (/etc/apache2/sites-enabled/soltanius.conf:1)  
port 80 namevhost [www.soltanius.de](http://www.soltanius.de) (/etc/apache2/sites-enabled/soltanius.conf:17)  
port 80 namevhost [soltanius.de](http://soltanius.de) (/etc/apache2/sites-enabled/soltanius.conf:33)  
port 80 namevhost [steckbriefe.soltanius.de](http://steckbriefe.soltanius.de) (/etc/apache2/sites-enabled/steckbriefe.conf:1)  
port 80 namevhost [www.steckbriefe.soltanius.de](http://www.steckbriefe.soltanius.de) (/etc/apache2/sites-enabled/steckbriefe.conf:17)  
\*:80 [h2849908.stratoserver.net](http://h2849908.stratoserver.net) (/etc/apache2/sites-enabled/000-default.conf:1)  
ServerRoot: “/etc/apache2”  
Main DocumentRoot: “/var/www/html”  
Main ErrorLog: “/var/log/apache2/error.log”  
Mutex rewrite-map: using\_defaults  
Mutex ssl-stapling-refresh: using\_defaults  
Mutex ssl-stapling: using\_defaults  
Mutex ssl-cache: using\_defaults  
Mutex default: dir="/var/run/apache2/" mechanism=default  
Mutex mpm-accept: using\_defaults  
Mutex watchdog-callback: using\_defaults  
PidFile: “/var/run/apache2/apache2.pid”  
Define: DUMP\_VHOSTS  
Define: DUMP\_RUN\_CFG  
User: name=“www-data” id=33  
Group: name=“www-data” id=33

[steckbriefe.soltanius.de](http://steckbriefe.soltanius.de) is another Website, wich I used as a test for my skill in HTML/CSS

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 27, 2019, 9:16pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/4 "2019-10-27T21:16:19Z")

</div>

There

> [@Soltanius](#):
>
> port 80 namevhost [soltanius.de](http://soltanius.de) (/etc/apache2/sites-enabled/soltanius.conf:1)  
> port 80 namevhost [www.soltanius.de](http://www.soltanius.de) (/etc/apache2/sites-enabled/soltanius.conf:17)  
> port 80 namevhost [soltanius.de](http://soltanius.de) (/etc/apache2/sites-enabled/soltanius.conf:33)

you see the problem. Two vHosts with the same port + domain name. So Certbot doesn't know what's the correct vHost.

Should non-www + www have the same content? If yes, merge these three in one port 80 vHost.

With

```nohighlight
ServerName soltanius.de
ServerAlias www.soltanius.de

```

so you have one vHost with both domain names. Remove the other vHosts, then restart your Apache, then again apachectl -S to see, if the output is correct.

---

<div class="post-metadata">

**Author:** ![Soltanius](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@Soltanius](https://community.letsencrypt.org/u/Soltanius)\
**Post date:** [October 27, 2019, 9:27pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/5 "2019-10-27T21:27:11Z")

</div>

So… Now:  
VirtualHost configuration:  
81.169.170.18:443 [cloud.soltanius.de](http://cloud.soltanius.de) (/etc/apache2/sites-enabled/nextcloud-le-ssl.conf:2)  
81.169.170.18:80 is a NameVirtualHost  
default server [cloud.soltanius.de](http://cloud.soltanius.de) (/etc/apache2/sites-enabled/nextcloud.conf:1)  
port 80 namevhost [cloud.soltanius.de](http://cloud.soltanius.de) (/etc/apache2/sites-enabled/nextcloud.conf:1)  
alias [www.cloud.soltanius.de](http://www.cloud.soltanius.de)  
port 80 namevhost [soltanius.de](http://soltanius.de) (/etc/apache2/sites-enabled/soltanius.conf:1)  
alias [www.soltanius.de](http://www.soltanius.de)  
port 80 namevhost [steckbriefe.soltanius.de](http://steckbriefe.soltanius.de) (/etc/apache2/sites-enabled/steckbriefe.conf:1)  
alias [www.steckbrief.soltanius.de](http://www.steckbrief.soltanius.de)  
\*:80 [h2849908.stratoserver.net](http://h2849908.stratoserver.net) (/etc/apache2/sites-enabled/000-default.conf:1)  
ServerRoot: “/etc/apache2”  
Main DocumentRoot: “/var/www/html”  
Main ErrorLog: “/var/log/apache2/error.log”  
Mutex ssl-stapling: using\_defaults  
Mutex ssl-cache: using\_defaults  
Mutex default: dir="/var/run/apache2/" mechanism=default  
Mutex mpm-accept: using\_defaults  
Mutex watchdog-callback: using\_defaults  
Mutex rewrite-map: using\_defaults  
Mutex ssl-stapling-refresh: using\_defaults  
PidFile: “/var/run/apache2/apache2.pid”  
Define: DUMP\_VHOSTS  
Define: DUMP\_RUN\_CFG  
User: name=“www-data” id=33  
Group: name=“www-data” id=33

I´ve done the same for my other Sub-Domain.

---

<div class="post-metadata">

**Author:** ![Soltanius](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@Soltanius](https://community.letsencrypt.org/u/Soltanius)\
**Post date:** [October 27, 2019, 9:32pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/6 "2019-10-27T21:32:34Z")

</div>

I used Port 80, should this be the problem?  
http use this port and https use 443,or I´m wrong?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 27, 2019, 9:37pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/7 "2019-10-27T21:37:02Z")

</div>

That looks good:

> [@Soltanius](#):
>
> port 80 namevhost [soltanius.de](http://soltanius.de) (/etc/apache2/sites-enabled/soltanius.conf:1)  
> alias [www.soltanius.de](http://www.soltanius.de)

Now create **one** certificate with both domain names.

```nohighlight
certbot --apache -d soltanius.de -d www.soltanius.de

```

So the command has the same list of domain names as one vHost.

Should work with the old Certbot, because now your configuration is better.

---

<div class="post-metadata">

**Author:** ![Soltanius](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@Soltanius](https://community.letsencrypt.org/u/Soltanius)\
**Post date:** [October 27, 2019, 9:47pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/8 "2019-10-27T21:47:32Z")

</div>

Thank u very much!  
Now i know how I can do it 🙂

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 27, 2019, 9:55pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/9 "2019-10-27T21:55:57Z")

</div>

Yep, now there is a new certificate with both domain names 👍

---

<div class="post-metadata">

**Author:** ![Soltanius](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@Soltanius](https://community.letsencrypt.org/u/Soltanius)\
**Post date:** [October 27, 2019, 10:03pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/10 "2019-10-27T22:03:44Z")

</div>

I tried the same with my other Domain…  
What mean this output?:  
Saving debug log to /var/log/letsencrypt/letsencrypt.log  
Plugins selected: Authenticator apache, Installer apache  
Obtaining a new certificate  
Performing the following challenges:  
http-01 challenge for [steckbriefe.soltanius.de](http://steckbriefe.soltanius.de)  
http-01 challenge for [www.steckbriefe.soltanius.de](http://www.steckbriefe.soltanius.de)  
Waiting for verification…  
Cleaning up challenges  
Failed authorization procedure. [www.steckbriefe.soltanius.de](http://www.steckbriefe.soltanius.de) (http-01): urn:acme:error:dns :: DNS problem: NXDOMAIN looking up A for [www.steckbriefe.soltanius.de](http://www.steckbriefe.soltanius.de)

IMPORTANT NOTES:

- The following errors were reported by the server:

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [October 27, 2019, 10:16pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/11 "2019-10-27T22:16:40Z")

</div>

> [@Soltanius](#):
>
> The following errors were reported by the server:
> 
> Domain: [www.steckbriefe.soltanius.de](http://www.steckbriefe.soltanius.de)  
> Type: None  
> Detail: DNS problem: NXDOMAIN looking up A for  
> [www.steckbriefe.soltanius.de](http://www.steckbriefe.soltanius.de)

There is a check of your domain, some minutes old - [https://check-your-website.server-daten.de/?q=steckbriefe.soltanius.de](https://check-your-website.server-daten.de/?q=steckbriefe.soltanius.de)

There is no ip address

| Host | T | IP-Address | is auth. | ∑ Queries | ∑ Timeout |
| --- | --- | --- | --- | --- | --- |
| [steckbriefe.soltanius.de](http://steckbriefe.soltanius.de) | A | 81.169.170.18 Berlin/Land Berlin/Germany (DE) - Strato AG Hostname: [h2849908.stratoserver.net](http://h2849908.stratoserver.net) | yes | 1 | 0 |
| | AAAA | | yes | | |
| [www.steckbriefe.soltanius.de](http://www.steckbriefe.soltanius.de) | | Name Error | yes | 1 | 0 |

of the www version. Add one or ignore it (remove the www version in your vHost). It's a subdomain, so a www version isn't required. But you can create one.

---

<div class="post-metadata">

**Author:** ![Soltanius](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@Soltanius](https://community.letsencrypt.org/u/Soltanius)\
**Post date:** [October 27, 2019, 10:27pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/12 "2019-10-27T22:27:35Z")

</div>

Oh… thanks…  
I didn´t know, that I have to make a extra subdomain then…  
I removed the alias in the vHost and now its works too…

This was ist for the next time 😃

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [November 26, 2019, 10:27pm UTC](https://community.letsencrypt.org/t/unable-to-install-the-certificate/104960/13 "2019-11-26T22:27:37Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.