On a few of our servers (ubuntu 23.04, apache 2.4.55, mod_md 2.4.19) randon certificates aren't renewing.
{
"name": "***redacted***",
"domains": [
"***redacted***"
],
"contacts": [
"mailto:***redacted***"
],
"transitive": 1,
"ca": {
"account": "ACME-.letsencrypt.org-0000",
"proto": "ACME",
"url": "https://acme-v02.api.letsencrypt.org/directory",
"urls": [
"https://acme-v02.api.letsencrypt.org/directory"
],
"agreement": "accepted"
},
"privkey": {
"type": "RSA",
"bits": 4096
},
"state": 2,
"renew-mode": 1,
"renew-window": "33%",
"warn-window": "10%",
"must-staple": false,
"proto": {
"acme-tls/1": []
},
"stapling": true,
"cert": {
"rsa": {
"valid": {
"from": "Thu, 17 Aug 2023 07:57:18 GMT",
"until": "Wed, 15 Nov 2023 07:57:17 GMT"
},
"serial": "***redacted***",
"sha256-fingerprint": "***redacted***",
"ocsp": {
"status": "good",
"valid": {
"from": "Tue, 17 Oct 2023 04:00:00 GMT",
"until": "Tue, 24 Oct 2023 03:59:58 GMT"
},
"renewal": {
"name": "***redacted***.net",
"finished": true,
"notified": false,
"notified-renewed": false,
"last-run": "Wed, 18 Oct 2023 23:53:27 GMT",
"errors": 0,
"last": {
"status": 0,
"detail": "certificate status is GOOD, status valid Tue, 17 Oct 2023 04:00:00 GMT - Tue, 24 Oct 2023 03:59:58 GMT",
"activity": "status of certid ***redacted***, reading response"
}
}
}
},
"valid": {
"from": "Thu, 17 Aug 2023 07:57:18 GMT",
"until": "Wed, 15 Nov 2023 07:57:17 GMT"
}
},
"renew-at": "Mon, 16 Oct 2023 15:09:18 GMT",
"watched": true,
"renew": true,
"renewal": {
"name": "***redacted***.net",
"finished": true,
"notified": true,
"notified-renewed": true,
"last-run": "Thu, 17 Aug 2023 08:57:12 GMT",
"valid-from": "Thu, 17 Aug 2023 08:57:19 GMT",
"errors": 0,
"last": {
"status": 0,
"valid-from": "Thu, 17 Aug 2023 08:57:19 GMT"
},
"cert": {}
}
},
The files in the md directory for this (redacted) fqdn still have timestamps from when the certificate was last renewed. The server status shows "finished successfully. Ongoing...". The only way I've been able to renew them is to remove the directories for the fqdn in the md directory and start over for those fqdn's. Is there a better way to do it?
On a few of our servers (ubuntu 23.04, apache 2.4.55, mod_md 2.4.19) randon certificates aren't renewing.
example from the acme server status
The files in the md directory for this (redacted) fqdn still have timestamps from when the certificate was last renewed. The server status shows "finished successfully. Ongoing...". The only way I've been able to renew them is to remove the directories for the fqdn in the md directory and start over for those fqdn's. Is there a better way to do it?