/etc/letsencrypt/live/happydogg.com# ls
README  cert.pem  chain.pem  fullchain.pem  privkey.pem

I currently have my certificates in this folder. My Node.js server actually reads the files from this directory.

When I run the expand command, I need to provide a webroot. I don't know what that is.

$ sudo certbot certonly --expand -d happydogg.com -d www.happydogg.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for www.happydogg.com
Input the webroot for www.happydogg.com: (Enter 'c' to cancel): 

How do I continue?

  • Does/can your server handle a request for a page (URL) by sending the corresponding file? If so see certbot.eff.org/docs/using.html#webroot . If not, you can't use http-01 with your server; either stop your server and use 'standalone', or use dns-01 if your system(s) can. What plugin(s)/challenge(s) did you use for the original cert issuance? – dave_thompson_085 Nov 7 '19 at 5:22

It seems that you have already set up the cert with auto renewal which you want to expand (the most probably with sub domain www.). The new cert would be generated and old one will expire (expiration e-mail related to current / old after expand / certificate will come - for example see this answer on other question).

For your question. As you have selected HTTP (not DNS) way to confirm the let's encrypt need to confirm that you are owning (or at least operating) the FQDN you are requesting for the certificate. To see the options for verification you can check - challenge-types.

With HTTP confirmation you can run standalone server (there cannot be any other server operating on default http port 80/tcp) or in case there is running server the webroot is the path where the server looking for the root of data for the mentioned (virtual) host ( based on the web service configuration it can be something like /var/www) ... There would be for certbot writable directory .well-known/acme-challenge where the certbot will write the token used for verification and after successful verification the token is removed (the full path for the token is then http://<YOUR_DOMAIN>/.well-known/acme-challenge/<TOKEN>).

In case you are running http service already on the port and cannot use this feature directly you should set up reverse proxy which would catch the .well-known/acme-challenge path and redirect it to other service. Anyway as you have working solution with cert and need only expand this would not be your case ;-).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.