In typing this question I found this:
His issue is mine to a T, and all things he tried more or less I did too. The difference was his was solved because he had nginx running. In my case I have no such reverse proxy server. So I just cannot get Apache to see the new certs I got using certbot (that was a whole other issue, certbot auto renew didn't work gave errors and so I did a certbot cert only apache and pointed appach ssl-certs in etc/httpd/extra to there.
Tried everything else like he did. Moved the folder the /etc/httpd/extra/ssl-certs and ssl-certs-proxy were pointing to to /tmp, and had those files point to the new .pem location:
SSLCertificateFile /etc/letsencrypt/live/www.apo.nmsu.edu/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/www.apo.nmsu.edu/privkey.pem SSLCertificateChainFile /etc/letsencrypt/live/www.apo.nmsu.edu/chain.pem Include /etc/letsencrypt/options-ssl-apache.conf cert.pem -> ../../archive/www.apo.nmsu.edu/cert2.pem chain.pem -> ../../archive/www.apo.nmsu.edu/chain2.pem fullchain.pem -> ../../archive/www.apo.nmsu.edu/fullchain2.pem privkey.pem -> ../../archive/www.apo.nmsu.edu/privkey2.pem
Alas nothing, no change, websites still report the expired ticket. Which was in another folder /live/apo.nmsu.edu-0004 which I moved to tmp. So not sure how apache is still picking all that up.
Did an apachectl stop apachectl start and even a restart and also reset the vm this is all running on.
Same issues. Completely out of ideas, even checked using openssl the new .pem files and they do expire correctly in 90 days (they are from letsencrypt).
[root@web-server extra]# apachectl -v Server version: Apache/2.4.6 (Scientific Linux) Server built: Jul 29 2019 10:53:12