Win Server 2019 cannot renew - No matches, cert is required but missing


That doesn't look right. What about

dir /a C:\Certbot\live\tledstaff.austincc.edu

webprofusion thank you. I would like to try to fix this. I am using Certbot in Ubuntu and so far, no issues. Windows is always more work. :roll_eyes:

C:\Certbot>dir /a C:\Certbot\live\tledstaff.austincc.edu
Volume in drive C has no label.
Volume Serial Number is 3612-CE9B

Directory of C:\Certbot\live\tledstaff.austincc.edu

05/10/2023 06:02 PM .
05/10/2023 06:02 PM ..
05/10/2023 05:51 PM cert.pem [C:\Certbot\archive\tledstaff.austincc.edu\cert.pem]
02/28/2023 03:48 PM 4,592 certificate.pfx
05/10/2023 06:02 PM chain.pem [C:\Certbot\archive\tledstaff.austincc.edu\chain.pem]
05/10/2023 06:01 PM fullchain.pem [C:\Certbot\archive\tledstaff.austincc.edu\fullchain.pem]
05/10/2023 06:02 PM privkey.pem [C:\Certbot\archive\tledstaff.austincc.edu\privkey.pem]
02/28/2023 12:59 PM 706 README
6 File(s) 5,298 bytes
2 Dir(s) 14,984,916,992 bytes free

Huh. I know Certbot well on linux but I'm not sure how to proceed now.

On linux the /archive folder has a number after each name (like, cert1.pem, privkey1.pem, ...). Each cert set gets a new number so you'll have 4 files with 1, 4 files with 2, and so on. Then, the symlink in /live points to the latest.

I always figured Windows Certbot worked the same but your /archive files don't have a sequence number. So that seems wrong to me but maybe it works differently.

Sorry I don't have any more time today to install Windows Certbot and try more things. Maybe another volunteer can carry forward.

Yes, there was a number but I rename them, so maybe tomorrow, do you know how to fix the symlinks? Thank you.

I can confidently say that assuming you have existing hostname bindings in IIS you could be up and running with Certify The Web in approximately 60 seconds :slight_smile: but it's no problem to continue with whatever you are comfortable using.

Regarding Certbot, I believe if you rename the files in the archive you break certbots method of finding the correct files. Symlinks as you know are more of linux/unix filesystem type thing even though they do grudgingly exist on Windows as well. You need to point your webserver to the symlink entries, never the actual archive files.dir C:\certbot\live /s from an administrative command prompt will show you what the symlink thinks it should be pointing to.

You could try changing the names in the archive folder back to the way they were. And then update the symlink to point to those 4 files like they were originally.

Ok, I got it. I reverted and appears that the renewal is working now. Lessons learned: Do not move or rename the archive files because they get out of sync and also, live only contains symlinks. Thank you so much.

C:\Windows\system32>certbot certonly --force-renew --cert-name tledstaff.austincc.edu --dry-run
Saving debug log to C:\Certbot\log\letsencrypt.log

How would you like to authenticate with the ACME CA?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1
Please enter the domain name(s) you would like on your certificate (comma and/or
space separated) (Enter 'c' to cancel): tledstaff.austincc.edu, tledftp.austincc.edu
Simulating a certificate request for tledstaff.austincc.edu and tledftp.austincc.edu
The dry run was successful.

Excellent. Please avoid using the force renew. That won't override any problems anyway and can create problems for you like getting you rate limited.

The dry run was successful but that doesn't get you a fresh certificate. You need to run that command over without the dry run. Then convert the new cert for IIS. I see that IIS is still using your older cert.