Error finalizing order :: too many certificates already issued - Help - Let's Encrypt Community Support
Error finalizing order :: too many certificates already issued
ermandeepsidhu March 7, 2019, 11:24am #1
My domain is: core.fidelissd.com
I ran this command: letsencrypt certonly --standalone --renew-by-default -d core.fidelissd.com
There were too many requests of a given type :: Error finalizing order :: too many certificates already issued for exact set of domains: core.fidelissd.com: see https://letsencrypt.org/docs/rate-limits/
My web server is (include version):Apache/2.4.25 (Ubuntu)
The operating system my web server runs on is (include version):Ubuntu
ermandeepsidhu March 7, 2019, 11:25am #2
Even when I am checking the limit using the debug URL it still says I’ve not exhaused the limit, link to check limit exhaustion below
https://tools.letsdebug.net/cert-search?m=domain&q=core.fidelissd.com&d=168
JuergenAuer March 7, 2019, 11:37am #3
Hi @ermandeepsidhu
ermandeepsidhu:
there are a lot of certificates created:
https://crt.sh/?q=core.fidelissd.com
Two yesterday, one 2019-03-01, two 2019-02-28 etc.
ermandeepsidhu March 7, 2019, 12:14pm #4
Thank you for your prompt response Juergen, but I only ran the command to issue two other certificates yesterday partner.fidelissd.com and cdn.fidelissd.com using the command below
letsencrypt certonly --standalone --renew-by-default -d partner.fidelissd.com
letsencrypt certonly --standalone --renew-by-default -d cdn.fidelissd.com
letsencrypt certonly --standalone --renew-by-default -d core.fidelissd.com (Failed on this one)
Additionally, where can I see the generated certificates on the server if at all they exist? I don’t mind using them if they are valid.
JuergenAuer March 7, 2019, 2:18pm #5
First update your client. “Letsencrypt” is very old, too old. You may use tls-sni-01 - validation, this is deprecated, support ends 2019-03-~~.
Additionally, where can I see the generated certificates on the server if at all they exist?
to check the certificates.
ermandeepsidhu March 8, 2019, 8:18am #6
Thanks again, that was helpful, I’ve downloaded the PEM file from the link you shared, but the private key .pem doesn’t match now, where should I look to download that?
JuergenAuer March 8, 2019, 8:23am #7
but the private key .pem doesn’t match now, where should I look to download that?
The private key is private, nothing to share.
So if you don’t have the private key (if you have deleted it), you have to wait.
ermandeepsidhu March 8, 2019, 8:35am #8
I am assuming the private key file is generated every time? If not can I use one of my old cert renewal private key files? The question is, when the certbot was auto renewing these certs, where was it placing the private key files? Can I please know the location of the generated files? “certbot certificates” only displays me the list of certificates in /live directory.
_az March 8, 2019, 8:36am #9
Are you completely sure you can’t issue a new certificate right now? There’s only 4 certificates issued for that domain in the current 7 day window, according to CT logs.
If not can I use one of my old cert renewal private key files?
Yeah, they’re in /etc/letsencrypt/keys/, but it might be tough to identify the right one.
ermandeepsidhu March 8, 2019, 8:36am #10
Seems like it, still getting the rate limit error (logs below)
root@core:/etc/letsencrypt/live/core.fidelissd.com# certbot certonly --standalone -d core.fidelissd.com
(ref: /etc/letsencrypt/renewal/core.fidelissd.com.conf)
There were too many requests of a given type :: Error creating new order :: too many certificates already issued for exact set of domains: core.fidelissd.com: see https://letsencrypt.org/docs/rate-limits/
JuergenAuer March 8, 2019, 8:37am #11
Keep the existing certificate for now
You have a valid certificate. So use that.
mnordhoff March 8, 2019, 8:37am #12
“certbot certificates” only displays me the list of certificates in /live directory.
Each certificate’s private key is in privkey.pem in the same live directory, if that’s what you’re asking.
ermandeepsidhu March 8, 2019, 8:38am #13
I downloaded the pem file from the link you shared and uploaded it to the directory, that’s why it’s saying certificate is valid, but apche won’t start as the privatekey.pem file doesn’t match up.
ermandeepsidhu March 8, 2019, 8:40am #14
Failing apache log
[Fri Mar 08 00:14:52.858418 2019] [ssl:emerg] [pid 26053:tid 140634018043776] AH02565: Certificate and private key core.fidelissd.com:443:0 from /etc/letsencrypt/live/core.fidelissd.com/cert.pem and /etc/letsencrypt/live/core.fidelissd.com/privkey.pem do not match
_az March 8, 2019, 9:01am #15
You can track down the correct private key, if it exists, like this:
find /etc/letsencrypt/keys -type f | xargs -I % sh -c 'openssl rsa -in % -noout -modulus | grep -q $(openssl x509 -in /etc/letsencrypt/live/core.fidelissd.com/cert.pem -noout -modulus) && echo %'
ermandeepsidhu March 8, 2019, 9:54am #16
Gives no output at all.
_az March 8, 2019, 9:56am #17
Which means you don’t have the key at all, so you can forget about using that certificate. You can try with some of the other certificates you’ve issued as well.
ermandeepsidhu March 8, 2019, 10:20am #18
Ok forgetting initiated Thanks for your help!
system closed April 7, 2019, 10:20am #19
Error finalizing order :: too many certificates already issued - Help - Let's Encrypt Community Support
Error finalizing order :: too many certificates already issued
ermandeepsidhu March 7, 2019, 11:24am #1
My domain is: core.fidelissd.com
I ran this command: letsencrypt certonly --standalone --renew-by-default -d core.fidelissd.com
There were too many requests of a given type :: Error finalizing order :: too many certificates already issued for exact set of domains: core.fidelissd.com: see https://letsencrypt.org/docs/rate-limits/
My web server is (include version):Apache/2.4.25 (Ubuntu)
The operating system my web server runs on is (include version):Ubuntu
ermandeepsidhu March 7, 2019, 11:25am #2
Even when I am checking the limit using the debug URL it still says I’ve not exhaused the limit, link to check limit exhaustion below
https://tools.letsdebug.net/cert-search?m=domain&q=core.fidelissd.com&d=168
JuergenAuer March 7, 2019, 11:37am #3
Hi @ermandeepsidhu
ermandeepsidhu:
there are a lot of certificates created:
https://crt.sh/?q=core.fidelissd.com
Two yesterday, one 2019-03-01, two 2019-02-28 etc.
ermandeepsidhu March 7, 2019, 12:14pm #4
Thank you for your prompt response Juergen, but I only ran the command to issue two other certificates yesterday partner.fidelissd.com and cdn.fidelissd.com using the command below
letsencrypt certonly --standalone --renew-by-default -d partner.fidelissd.com
letsencrypt certonly --standalone --renew-by-default -d cdn.fidelissd.com
letsencrypt certonly --standalone --renew-by-default -d core.fidelissd.com (Failed on this one)
Additionally, where can I see the generated certificates on the server if at all they exist? I don’t mind using them if they are valid.
JuergenAuer March 7, 2019, 2:18pm #5
First update your client. “Letsencrypt” is very old, too old. You may use tls-sni-01 - validation, this is deprecated, support ends 2019-03-~~.
Additionally, where can I see the generated certificates on the server if at all they exist?
to check the certificates.
ermandeepsidhu March 8, 2019, 8:18am #6
Thanks again, that was helpful, I’ve downloaded the PEM file from the link you shared, but the private key .pem doesn’t match now, where should I look to download that?
JuergenAuer March 8, 2019, 8:23am #7
but the private key .pem doesn’t match now, where should I look to download that?
The private key is private, nothing to share.
So if you don’t have the private key (if you have deleted it), you have to wait.
ermandeepsidhu March 8, 2019, 8:35am #8
I am assuming the private key file is generated every time? If not can I use one of my old cert renewal private key files? The que
stion is, when the certbot was auto renewing these certs, where was it placing the private key files? Can I please know the location of the generated files? “certbot certificates” only displays me the list of certificates in /live directory.
_az March 8, 2019, 8:36am #9
Are you completely sure you can’t issue a new certificate right now? There’s only 4 certificates issued for that domain in the current 7 day window, according to CT logs.
If not can I use one of my old cert renewal private key files?
Yeah, they’re in /etc/letsencrypt/keys/, but it might be tough to identify the right one.
ermandeepsidhu March 8, 2019, 8:36am #10
Seems like it, still getting the rate limit error (logs below)
root@core:/etc/letsencrypt/live/core.fidelissd.com# certbot certonly --standalone -d core.fidelissd.com
(ref: /etc/letsencrypt/renewal/core.fidelissd.com.conf)
There were too many requests of a given type :: Error creating new order :: too many certificates already issued for exact set of domains: core.fidelissd.com: see https://letsencrypt.org/docs/rate-limits/
JuergenAuer March 8, 2019, 8:37am #11
Keep the existing certificate for now
You have a valid certificate. So use that.
mnordhoff March 8, 2019, 8:37am #12
“certbot certificates” only displays me the list of certificates in /live directory.
Each certificate’s private key is in privkey.pem in the same live directory, if that’s what you’re asking.
ermandeepsidhu March 8, 2019, 8:38am #13
I downloaded the pem file from the link you shared and uploaded it to the directory, that’s why it’s saying certificate is valid, but apche won’t start as the privatekey.pem file doesn’t match up.
ermandeepsidhu March 8, 2019, 8:40am #14
Failing apache log
[Fri Mar 08 00:14:52.858418 2019] [ssl:emerg] [pid 26053:tid 140634018043776] AH02565: Certificate and private key core.fidelissd.com:443:0 from /etc/letsencrypt/live/core.fidelissd.com/cert.pem and /etc/letsencrypt/live/core.fidelissd.com/privkey.pem do not match
_az March 8, 2019, 9:01am #15
You can track down the correct private key, if it exists, like this:
find /etc/letsencrypt/keys -type f | xargs -I % sh -c 'openssl rsa -in % -noout -modulus | grep -q $(openssl x509 -in /etc/letsencrypt/live/core.fidelissd.com/cert.pem -noout -modulus) && echo %'
ermandeepsidhu March 8, 2019, 9:54am #16
Gives no output at all.
_az March 8, 2019, 9:56am #17
Which means you don’t have the key at all, so you can forget about using that certificate. You can try with some of the other certificates you’ve issued as well.
ermandeepsidhu March 8, 2019, 10:20am #18
Ok forgetting initiated Thanks for your help!
system closed April 7, 2019, 10:20am #19