0

I have a Debian 10 instance running which hosts my Node.js/Express API. I have been using a different subdomain during development and added another subdomain as I'm nearing production. The first domain was dev.myapi.com and I added another subdomain dashboard.myapi.com with certbot certonly --cert-name dev.myapi.com -d dev.myapi.com,dashboard.myapi.com. After that, I ran certbot renew --dry-run and I'm getting following error:


Processing /etc/letsencrypt/renewal/dev.myapi.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not due for renewal, but simulating renewal for dry run
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for dashboard.myapi.com
http-01 challenge for dev.myapi.com
Cleaning up challenges
Attempting to renew cert (dev.myapi.com) from /etc/letsencrypt/renewal/dev.myapi.com.conf produced an unexpected error: Missing command line flag or config entry for this setting:
Input the webroot for dashboard.myapi.com:. Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/dev.myapi.com/fullchain.pem (failure)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
** DRY RUN: simulating 'certbot renew' close to cert expiry
**          (The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/dev.myapi.com/fullchain.pem (failure)
** DRY RUN: simulating 'certbot renew' close to cert expiry
**          (The test certificates above have not been saved.)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Running post-hook command: /etc/letsencrypt/renewal-hooks/post/reloadService.sh
1 renew failure(s), 0 parse failure(s)

How to provide the webroot for the new subdomain? The root directory of my project is the same. I.e, I'm running only one project with 2 subdomains pointing to the same.

3 Answers 3

3

If you are creating certificates with certbot, you can run as mentioned:

certbot certonly --cert-name dev.myapi.com -d dev.myapi.com,dashboard.myapi.com

This automatically creates a config file in (Ubuntu 18.04LTS) "/etc/letsencrypt/renewal/dev.myapi.com.conf", that contains the details as specified on the command-line, and via any interactive prompts. In your case, as above, you should be prompted for the auth process; apache, webroot, standalone server etc. and if you select webroot, you should be prompted for the path. But if you aren't, then your config will be missing the webroot-path.

As such you should explicitly call certbot with --webroot AND --webroot-path [full path to DocumentRoot] (in this example "/var/www/html/mySite").

certbot certonly --cert-name dev.myapi.com --webroot --webroot-path "/var/www/html/mySite" -d dev.myapi.com,dashboard.myapi.com

If you don't do this, then the webroot-path field is not entered into the config file, and any attempt to renew will fail with the error you see.

You can manually add the path (in this example "/var/www/html/mySite") to your config file as follows, see the line "webroot_path =" under section [renewalparams]:

root:/etc/letsencrypt/renewal# cat dev.myapi.com.conf
# renew_before_expiry = 30 days
version = 1.9.0
archive_dir = /etc/letsencrypt/archive/dev.myapi.com
cert = /etc/letsencrypt/live/dev.myapi.com/cert.pem
privkey = /etc/letsencrypt/live/dev.myapi.com/privkey.pem
chain = /etc/letsencrypt/live/dev.myapi.com/chain.pem
fullchain = /etc/letsencrypt/live/dev.myapi.com/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = ####
authenticator = webroot
webroot_path = /var/www/html/mySite,
server = https://acme-v02.api.letsencrypt.org/directory

Then test with:

certbot renew --cert-name dev.myapi.com --dry-run
1
1

So here's how I did it:

sudo certbot certonly --cert-name dev.myapi.com \
-a webroot \
-w path/to/my/public/folder \
-d dev.myapi.com,dashboard.myapi.com

More details here.

-1

You give the webroot on the command line when you run certbot.

--webroot -w <document root>

This should have been done the first time you obtained the certificates but if you used a different method to do so, then it would not have been saved.

5
  • I had specified the webroot when I first got the certificate for dev.myapi.com (during the setup process, not as a flag). Oct 1, 2020 at 7:24
  • 1
    When I tried to run certbot certonly with the --webroot flag, it gave me: certbot: error: unrecognized arguments: /path/to/my/project Oct 1, 2020 at 7:35
  • @VaibhavJoshi Oops, I left out an important bit. Try it again as edited. Oct 1, 2020 at 14:00
  • Ugh, I think I've exhausted my limit of 5 certs per 7 days. I'll have to wait. Oct 5, 2020 at 6:03
  • The downvote doesn't make any sense. As you can see above, this is the solution the OP chose. Jul 23, 2021 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .