Unable to renew cert

hmm…
Let’s try RUN instead:

sudo certbot run --apache --webroot -w /var/www/wordpress -d sankofakids.org -d www.sankofakids.org --dry-run

If that fails, try:

sudo certbot certonly --webroot -w /var/www/wordpress -d sankofakids.org -d www.sankofakids.org --dry-run
1 Like

first one failed

--dry-run currently only works with the 'certonly' or 'renew' subcommands ('run')

2nd one

xxxxxxxxxxxxxxxxxxxx

IMPORTANT NOTES:
 - The dry run was successful.
1 Like

OK now we have something!

Try removing the --dry-run from that one.

1 Like

:smiley:
``
IMPORTANT NOTES:

  • Congratulations! Your certificate and chain have been saved at:
    /etc/letsencrypt/live/sankofakids.org/fullchain.pem
    Your key file has been saved at:
    /etc/letsencrypt/live/sankofakids.org/privkey.pem
2 Likes

Restart Apache and let’s check the site (via both names).

1 Like

yay, both do come up, but not with the padlock.

says ‘not secure’

1 Like

You have MIXED content.
You can’t have links to HTTP content within an HTTPS page.
See: https://www.whynopadlock.com/results/3c1c3eca-0a63-4dea-8656-18858cd395f8

2 Likes

The default of certbot is run if no command (non-dashed parameter) is specified. Do not use renew in place of run as renew applies to all certificates, not just the one in question.

In other words, the original command from @rg305 was fine, sort of. It probably should look like this:

sudo certbot -a webroot -w /var/www/wordpress -i apache -d sankofakids.org -d www.sankofakids.org --dry-run

2 Likes

There are two things left to address:

  • mixed content
  • ensuring the renewal automation “works”

But I need to get back to my “not long enough weekend”, so best of luck to you

3 Likes

Of course this worked. :grin: Webroot is authenticator only.

1 Like

Absomelutely true that.

1 Like

Enjoy Rudy! :partying_face:

1 Like

Thank you so much. You have been a blessing. I will check to see if I can edit the jpeg files

1 Like

Mixed content issue resolved. I went to wordpress and looked for the images url. The urls had http so I changed them to https, Later when I got the chance to check the url, the padlock was showing with the site visible.

Now how to ensure that the renewal automation works?

1 Like

Hey @rg305, one problem with this command that you suggested earlier in the thread is that --apache and --webroot are contradictory. But also you should use --cert-name instead of -d for certbot renew when you want to specify a single certificate.

If you wanted to use the webroot authenticator and apache installer, it's -a webroot -i apache (--apache means -a apache -i apache, while --webroot means -a webroot -i webroot, so you can see the contradiction there).

(I'm glad you and @griffin were able to solve all of @appsellent's problems!)

3 Likes

@schoen

You mean like the command I suggested? :slightly_smiling_face:

I wanted to pitch something to you Seth in this regard:

I have been thinking about creating a "lightning guide" of sorts for certbot (and the certification process in general) for this community that could serve as a fast reference point both for newbies and regulars alike. I've found that even seasoned members (myself included) sometimes make snafus due to the frankly confusing way that the certbot documentation (and functionality) is laid out. The purpose of this guide is to be semantic (intention-based). What I mean is that it explains the certbot process and parameters by how they fit into the certification process rather than simply base functionality. For example, run vs. renew is frequently confused. Also I would outline "best practices", such as using -a apache and -i apache rather than --apache to make the process explicit. Additionally, emphasis would be given to --dry-run and --disable-renew-updates that can be used for "baby steps" to minimize changes during the diagnostic process, particularly when guiding newbies on this forum. A detailed and explicit statement of which options/parameters apply to which commands (verbs? non-dashed parameters? there should be a term) would also be included. I forsee this as the "daily mechanic's reference" whereas the official documentation would be the "authoritative compendium". What are your thoughts?

2 Likes

@griffin I think that would be very useful! Maybe we can start a new thread to talk a little further about what belongs on it.

1 Like

It is? As far as I can tell, like nobody uses run explicitely at all, because it's the default :stuck_out_tongue:

1 Like

@Osiris

Take a look on this topic. Or hundreds of others in the past 2 months. :wink: The fact that run is the default is something I had to point out in this very topic. I personally feel like that default should be removed to prevent that very confusion. :thinking: I am greatly looking forward to your thoughts on this guide though as I feel that your great frequency of contributions and breadth of situations addressed will be critical in flushing out and refining the details. I’m really hoping this guide will help scope things too.

1 Like

@schoen

Excellent! I’ll do an initial writeup and get it going. I’m looking forward to some great constructive process and feedback (and learning some things and unlearning some other things). :grinning:

2 Likes