Retrieve / Reissue a Let's Encrypt certificate

mehargags

Everytime I search their is too much information to actually follow and understand correctly.

How do I retrieve or reissue a certificate
that is still younger than 60 days. Like if I clean install my test server, I need to re-install the test server. Now I can copy the cert + chain but the on my test server I intend to check my Let's Encrypt scripts and procedures if they work fine, so I really want to "negotiate" and get certificates (re)issued.

ajgarett

AFAIK, if you don't have the 'lineage' (the past certs), or if they're corrupted somehow, LE will just create a new cert for you.

It's entirely possible to end up with multiple certs issued for the same domain concurrently.

mehargags

so you mean if I have a certificate for a domain, format and clean install my server removing all "lineage" and issue a request on cleanly installed server for that same domain, it will simply issue it again automatically ?

rm_

mehargags said: it will simply issue it again automatically ?

Yes. But they may temporarily ban a domain if you do this too often. IIRC the limit is 10 such resets per week or so.

mehargags

@rm_ said:
Yes. But they may temporarily ban a domain if you do this too often. IIRC the limit is 10 such resets per week or so.

Thanks for the heads up !!

andiklive

since its talk abour LE, anyone know how can implement use lets encrypt on 2 vps.

i mean if i have domain.com and load balancing on vps A and vps B, so i just need copy cert on vps A to vps B or request it on every vps then.

thanks

perennate

andiklive said: i mean if i have domain.com and load balancing on vps A and vps B, so i just need copy cert on vps A to vps B or request it on every vps then.

You can certainly copy the certificate, SSL certificates are not tied to particular IP addresses. But you will need to figure out how to pass the ACME challenge to obtain the certificate from Let's Encrypt; the HTTP method might not be the best option since you would need to have both machines respond to the challenge (although if you do a bit of setup in your application, or just have a bash script to rsync the file and make some adjustments to whatever script you are using that responds to the challenge, then it should be fine). There's other methods like DNS that you could try instead.

It is better to open new topic though.

andiklive

@perennate said:
You can certainly copy the certificate, SSL certificates are not tied to particular IP addresses. But you will need to figure out how to pass the ACME challenge to obtain the certificate from Let's Encrypt; the HTTP method might not be the best option since you would need to have both machines respond to the challenge. There's other methods like DNS that you could try instead.

thanks i'll try your suggestion, i'll open new topic if have problem.

mehargags

@rm_ said:

IIRC the limit is 10 such resets per week or so.

The Limit now is probably 5

I read here https://letsencrypt.org/docs/rate-limits/

> We also have a Duplicate Certificate limit of 5 certificates per week. A certificate is considered a duplicate of an earlier certificate if they contain the exact same set of hostnames, ignoring capitalization and ordering of hostnames. For instance, if you requested a certificate for the names [www.example.com, example.com], you could request four more certificates for [www.example.com, example.com] during the week.

eva2000

mehargags said: How do I retrieve or reissue a certificate that is still younger than 60 days.

Depends on letsencrypt client you use. For instance with acme.sh client https://github.com/Neilpang/acme.sh you can use --force command to reissue while younger than renewal time

that's what i am doing for my Centmin Mod LEMP stack's letsencrypt integration via acmetool.sh https://community.centminmod.com/threads/official-acmetool-sh-testing-thread-for-centmin-mod-123-09beta01.8290/

when you select option to reissue it's just acme.sh --force being called

acmetool.sh menu mode option 6

--------------------------------------------------------
        SSL Management            
--------------------------------------------------------
1).  acemtool.sh install
2).  acmetool.sh update
3).  acmetool.sh setup
4).  Issue SSL Management
5).  Renew SSL Management
6).  Reissue SSL Management
7).  Renew All Staging /Test Certs
8).  Renew ALL Live Certs
9).  Renew All Live Certs HTTPS Default
10). Exit
--------------------------------------------------------
Enter option [ 1 - 10 ] 6
--------------------------------------------------------

reissue management (AWS S3 options not yet done)

--------------------------------------------------------
        SSL Reissue Management              
--------------------------------------------------------
1).  Reissue SSL Cert Staging/Test
2).  Reissue SSL Cert Staging/Test HTTPS Default
3).  Reissue SSL Cert Live
4).  Reissue SSL Cert Live HTTPS Default
5).  Custom Webroot Reissue SSL Cert Staging/Test
6).  Custom Webroot Reissue SSL Cert Staging/Test HTTPS Default
7).  Custom Webroot Reissue SSL Cert Live
8).  Custom Webroot Reissue SSL Cert Live HTTPS Default
9).  S3 Reissue SSL Cert
10). S3 Reissue SSL Cert
11). S3 Reissue SSL Cert
12). S3 Reissue SSL Cert
13). Exit
--------------------------------------------------------
Enter option [ 1 - 13 ] 

but yes as folks stated already, you can just issue again for same common name cert anyway if the letsencrypt client instance doesn't have a previous ssl cert stored for that common name domain

eva2000

@andiklive said:
since its talk abour LE, anyone know how can implement use lets encrypt on 2 vps.

i mean if i have domain.com and load balancing on vps A and vps B, so i just need copy cert on vps A to vps B or request it on every vps then.

thanks

for me acmetool.sh addon for my Centmin Mod LEMP stack, i plan to add AWS S3 support and just use s3cmd tool to ensure all servers in a cluster get the issued letsencrypt SSL certificates. Haven't coded that part yet for acmetool.sh though still beta testing the rest of the routines.

rm_

mehargags said: For instance, if you requested a certificate for the names [www.example.com, example.com], you could request four more certificates for [www.example.com, example.com] during the week.

Oh, so if you need to workaround that, you can just request a cert for [www.example.com, example.com, test.example.com] and it'll work fine.