[DO] Certificate expired error

[bhavya-cloudaeye]

Describe the bug

I hosted Meilisearch on digital ocean using the one-click app from the marketplace. I followed the instructions on the ssh console and quickly set up domain name and SSL in minutes. Thanks for that !

However within few days (around a week), some of my app users started running into the certificate expired issue. When I login into my droplet and check for renewal using certbot, I see no certificate pending renewal.

Not sure what causes this issue. PFA the screenshot attached for the same. Please also let me know if I need to provide any information or file contents from my droplet.

Regards,
Bhavya

[curquiza]

Hello @bhavya-cloudaeye
I'm moving the issue to the meilisearch-digitalocean repository :)

[alallema]

Hi @bhavya-cloudaeye,
Sorry, you had trouble with your certificates, normally Cerbot is configured to renew certificates automatically.
Can you give me the logs letsencrypt? They should be in /var/log/letsencrypt/.
Thanks

[bhavya-cloudaeye]

Hi @alallema thank you for the response. PFA the log files attached.
Also my concern is how can certificate expired within few days (around 10 days), when the validity of the cert shows for a longer duration.
And even after manual renewal using certbot commands, the issue still remained.

Regards,
Bhavya

letsencrypt.log
letsencrypt1.log
letsencrypt2.log
letsencrypt3.log
letsencrypt4.log

[alallema]

Hi @bhavya-cloudaeye,
So good news you get a new certificate cf:letsencrypt4.log:

2021-09-25 04:52:12,375:DEBUG:certbot.reporter:Reporting to user: Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/search2.cngecoconnect.in/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/search2.cngecoconnect.in/privkey.pem
Your cert will expire on 2021-12-24. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew"

You can renew your certificate, Letsencrypt renews certificates when there are less than 30 days remaining in its valid life if I'm not wrong.
Normally you need to restart or reload your server so it could use the new certificate.

[bhavyalatha26]

Hi @alallema ,

Thats the issue. The certificate expired error comes even though certificate is never expired.

I started getting this error in a week after my first prod deployment to digital ocean. I still manually renewed the certificate (though it never expired). It dint help.

For now I am serving it via http in production to avoid the error.

Regards,
Bhavya.

[alallema]

Hi @bhavyalatha26,
Sorry, I totally misunderstood.
Can you try this command and tell me what it say:
certbot certificates
Also, Letsencrypt has 2 folders:
/etc/letsencrypt/live/my-site.com (with symlinks)
/etc/letsencrypt/archive/my-site.com (with real certs).
You can check if the live folder gets the link to the good certs.

[bhavyalatha26]

Hi @alallema

Output of certbot certificates :

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: search2.cngecoconnect.in
    Domains: search2.cngecoconnect.in
    Expiry Date: 2022-01-12 06:03:41+00:00 (VALID: 75 days)
    Certificate Path: /etc/letsencrypt/live/search2.cngecoconnect.in/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/search2.cngecoconnect.in/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[alallema]

Hi @bhavyalatha26,
Sorry for the delay I was on holiday, your problem could be linked to this issue and if it's not I must confess that I don't know where the problem comes from.

[alallema]

Hi @bhavyalatha26,
Did you finally find out what the problem was? I would be interested to know if you have found where this could come from.
Thanks

[bhavya-cloudaeye]

Hi @alallema, No actually, I could not figure it out. I am just running on http at the moment. Regards, Bhavya

…

On Mon, Dec 6, 2021 at 5:42 PM Amélie ***@***.***> wrote: Hi @bhavyalatha26 <https://github.com/bhavyalatha26>, Did you finally find out what the problem was? I would be interested to know if you have found where this could come from. Thanks — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#37>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AS7A6ZIX3XU3WRTY5I4NCJ3UPSSEXANCNFSM5GDVFB4A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[waleedbhatti]

@bhavya-cloudaeye were you able to find a solution? Facing the same issue.

[alallema]

Transfer of this issue to the cloud-provider project due to its depreciation