Join the community today
Become a Member

SSL Domains Letsencrypt How to troubleshoot Letsencrypt SSL certificate issuance or renewal

Discussion in 'Domains, DNS, Email & SSL Certificates' started by eva2000, Jun 30, 2019.

Thread Status:
Not open for further replies.
  1. eva2000

    eva2000 Administrator Staff Member

    May 24, 2014
    Brisbane, Australia
    Local Time:
    2:11 AM
    Nginx 1.21.x
    MariaDB 10.x
    This guide is for what info is required to troubleshoot a failed Letsencrypt SSL certificate issuance or renewal when creating a Centmin Mod 123.09beta01 or newer version's Nginx vhost via menu option 2, 22, nv commandline or directly via addons/ outlined at When you post a new thread in Domains, DNS, Email & SSL Certificates forum, please provide the below info.

    First try running your intended SSL certificate domain through the online testing tool to check for potential errors with HTTP-01 validation.

    How was the initial letsencrypt ssl certificate obtained ? Which method ?
    • Was the domain nginx vhost alreadying created prior or new domain nginx vhost site setup for first time ?
    • Via menu option 2, 22, /usr/bin/nv ?
    • If you ran menu option 2 or 22, which letsencrypt option did you select from
      Code (Text):
      Setup full Nginx vhost + Wordpress + WP Plugins
      Enter vhost domain name you want to add (without www. prefix):
      Create a self-signed SSL certificate Nginx vhost? [y/n]: n
      Get Letsencrypt SSL certificate Nginx vhost? [y/n]: y
      You have 4 options:
      1. issue staging test cert with HTTP + HTTPS
      2. issue staging test cert with HTTPS default
      3. issue live cert with HTTP + HTTPS
      4. issue live cert with HTTPS default
      Enter option number 1-4: 1
    • Via addons/ ? which specific command ? examples
      Code (Text):
      ./ issue
      Code (Text):
      ./ issue live
      Code (Text):
      ./ issue d
      Code (Text):
      ./ issue lived
    • What was order of steps you did ? Did you run menu option 2 first with letsencrypt ? Then did you run addons/ afterwards ?

    Centmin Mod Self-Signed SSL Fallback

    If you're seeing a Centmin Mod's self-signed ssl certificate instead of letsencrypt ssl certificate, then that's and centminmod's fallback if letsencrypt verification fails to obtain letsencrypt ssl cert, it falls back to centmin mod self-signed ssl certificate on https port 443 side so to preserve the https nginx vhost


    There are various steps you can do to troubleshoot failed letsencrypt issuances, renews, reissues etc.
    • logs all command line or shell menu runs to log files at /root/centminlogs. To troubleshoot, copy the contents of the log run and post contents of log to or and share link in this thread. To find the log list the logs in ascending date order
      Code (Text):
      ls -lahrt /root/centminlogs
    • For direct runs, there should be a 2nd & 3rd & 4th log in format /root/centminlogs/centminmod_${DT}_nginx_addvhost_nv.log and /root/centminlogs/$DT.log and /root/centminlogs/acmesh-issue_*.log or /root/centminlogs/acmesh-reissue_*.log which would need to be included via separate or post.
    • Enable debug mode. In persistent config file at /etc/centminmod/ (create it if doesn't exist) add and enable debug mode which gives much more verbose letsencrypt issuance process information when you re-run or menu options 2, 22 or /usr/bin/nv command lines.
      Code (Text):
    If auto renewals didn't happen, check output for the following commands
    Code (Text):
    grep acme /var/log/cron* | sed -e "s|$(hostname -s)|host|g"

    Code (Text):
    echo y | /usr/local/src/centminmod/addons/ checkdates

    Code (Text):
    "/root/"/ --cron --home "/root/"

    Code (Text):
    echo | openssl s_client -connect

    Without the answers to above questions and logs, there is nothing to help troubleshoot.

    SSLLabs Test

    Also run your HTTPS domain site through SSLLabs tester at SSL Server Test (Powered by Qualys SSL Labs) if it says untrusted SSL cert and prompts to continue the test, continue the test.
Thread Status:
Not open for further replies.