SSL Certs No Longer Working

Discussion in 'Installation/Configuration' started by Jeremy007, Jul 2, 2021.

  1. Jeremy007

    Jeremy007 Member

    Hello HTF Friends,

    Setup : Multi-server
    OS : Ubuntu 18.0.4
    Server type : Nginx/1.18.0
    Databse : mySql

    After having update to 3.2.4, issuing certs to websites no longer works. Every time i try to renew a cert i get the below error - 01.07.2021-22:43 - WARNING - R=0 ; C=0 ; /root/ --issue -d -d -w /usr/local/ispconfig/interface/acme --always-force-new-domain-key --keylength 4096; R=$? ; if [[ $R -eq 0 || $R -eq 2 ]] ; then /root/ --install-cert -d -d --key-file '/var/www/clients/client29/web189/ssl/' --fullchain-file '/var/www/clients/client29/web189/ssl/' --reloadcmd 'systemctl force-reload nginx.service' --log '/var/log/ispconfig/acme.log'; C=$? ; fi ; if [[ $C -eq 0 ]] ; then exit $R ; else exit $C ; fi

    Code: - 01.07.2021-22:43 - WARNING - Let's Encrypt SSL Cert for: could not be issued.
    It seems that it's trying to renew the certs via but my current certs are in the /etc/letsencrypt/live/ format from certbot. If i manually renew with certbot, it works but via the control panel checkbox it fails. I had to reinstall cerbot because my certbot-auto which was installed is missing or no longer supported.

    Anyone have any ideas why auto-renewal is failing?
  2. ahrasis

    ahrasis Well-Known Member HowtoForge Supporter

    You should only have and using or certbot but never use both on the same server. What is your original Let's Encrypt client? Stick to that, reinstall it if necessary and remove the other LE client folder and script totally.
  3. till

    till Super Moderator Staff Member ISPConfig Developer

    As @ahrasis mentioned, never install certbot and together. To fix your issue, remove installation by removing the folder /root/ SSL certs that you created with will fail to renew though and you will have to reissue them using certbot then.
  4. Jeremy007

    Jeremy007 Member

    Actually, i never installed or knew about the, so i'm not sure where it even came from. After upgrading to 3.2.4, all of my servers started using the to issue certs including the control panel.
  5. Jeremy007

    Jeremy007 Member

    Strange this is "/root/" doesn't even exist on my servers so i don't understand why it defaults to
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    ISPConfig downloads and installs when certbot is not installed. maybe you or someone esel tried to issue a LE cert while you reinstalled certbot.

    That's quite strange, I did not see this behaviour on any system. Maybe something is wrong with your certbot installs so that ispconfig could not find certbot anymore?

    Please post the result of these two commands:

    which certbot /root/.local/share/letsencrypt/bin/letsencrypt /opt/ letsencrypt
    which /usr/local/ispconfig/server/scripts/ /root/
    that ISPConfig uses to find installed certbot and
    Last edited: Jul 2, 2021
  7. Jeremy007

    Jeremy007 Member

    My error. Looks like they do exist, just was using the wrong command. So i would just have to delete the acme folders right?
    Although i read through the forums that it's not recommended. If i wanted to use the instead of Certbot, i would need to delete the letsencrypt folders and reissue all the certs?
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes, if you have not issued any certs yet using if you have issued certs, then these will expire sooner or later and not renewed.

    Its not recommended to switch from to certbot or from certbot to as there is no path to migrate certs and websites wills tart to fail if you do so.

    Yes. Plus clean up all SSL folders of the websites and remove the links to the letsencrypt SSL certs.
  9. Jeremy007

    Jeremy007 Member

    Thank you @ahrasis and @till
    Removing the acme folder definitely solved the issue. No single idea how this got installed. I'll have to remove it on all my servers.
    ahrasis and till like this.

Share This Page