W3Ask

Let's Encrypt renewal configuration file is broken, symlink skipping

You have just transferred your website to a new server. You copied and pasted your website configuration files into /etc/apache2/sites-available/, you copied and pasted the SSL certificates into /etc/letsencrypt/live/.

Your websites work with the HTTPS protocol but when you try the following line in your SSH connection, to test the renewal of your certificates:

sudo certbot renew --dry-run

You get the following error:

Renewal configuration file /etc/letsencrypt/renewal/domainname.com.conf is broken.

The error was: expected /etc/letsencrypt/live/domainname.com/cert.pem to be a symlink

Skipping.

The renewal configuration file is broken. The symbolic link was ignored. In fact, this symbolic link is missing for your SSL certificates. You could not copy and paste it. It must therefore be recreated.

To do this, we must properly delete the certificate:

sudo rm -rf /etc/letsencrypt/{live,renewal,archive}/{domainname.com,domainname.com.conf}

We recreate the certificate:

sudo certbot certonly --webroot -w /var/www/domainname.com/public_html -d domainname.com -d www.domainname.com

We deactivate the website:

sudo a2dissite domainname.conf

sudo systemctl reload apache2

You have to change the path to the certificate in the respective configuration file to the website in Apache, only if the address is different, with the addition of -0001 for example at the end; for example: /etc/letsencrypt/live/domainname.com/ has become /etc/letsencrypt/live/domainname-0001.com/. Otherwise if the path is the same, it is not necessary.

We check that the access path to the SSL certificate is correct:

sudo nano /etc/apache2/sites-available/domainname.conf

        SSLCertificateFile /etc/letsencrypt/live/domainname.com/cert.pem

        SSLCertificateKeyFile /etc/letsencrypt/live/domainname.com/privkey.pem

        SSLCertificateChainFile /etc/letsencrypt/live/domainname.com/chain.pem

So we change the above addresses, if the certificates were placed elsewhere.

We reactivate the site:

sudo a2ensite domainname.com.conf

sudo systemctl reload apache2

We verify that the start date and expiration date of the certificate have been updated in the web browser by clicking on the padlock next to the web address, then on certificate.

Example of website configuration file for Let's Encrypt
https://w3ask.com/website-configuration-file-encrypt/

Here is an example of example.com.conf file for Let's Encrypt configuration with Apache virtual hosts. The following configuration file can ...

Renewal notice problem with Letsencrypt auto renew
https://w3ask.com/renewal-notice-problem-letsencrypt-auto-renew/

You may get a 403 forbidden access issue while renewing automatically your SSL certificate generated by Letsencrypt. It comes from the fact ...

Let’s Encrypt Apache configuration
https://w3ask.com/encrypt-apache-configuration/

You have to configure default-ssl.conf, example.com.conf in /etc/apache2/sites-available/. Check the existence of options-ssl-apache.conf ...

How to install a file editor in Debian
https://w3ask.com/install-file-editor-debian/

How to set up an application to edit the files directly in the Debian server, via the SSH administration interface? One of the most intuitive ...

Where is the location of Sendmail log files?
https://w3ask.com/location-sendmail-log-files/

It may be useful to check the contents of the Sendmail application log files to find out what might be a problem during a malfunction. So where ...

Let's Encrypt renewal configuration file is broken, symlink skipping

Related posts: