Lets Encrypt: repair broken certificate with certbot

Question

How can I run certbot to re-issue a specific (or all) certificate(s), if configuration is broken. E.g. if the content of folder letsencrypt/live was deleted accidentally. Using renew I get an error and certbot skips. Is there an option like force-reinstall-if-broken ?

Answer 1

Using certbot certonly with the actual configuration should work.

certbot certonly --config /path/to/config.conf

Being config.conf a Letsencrypt config file like this:

domains = url.com, www.url.com
rsa-key-size = 4096

# the current closed beta (as of 2015-Nov-07) is using this server
server = https://acme-v01.api.letsencrypt.org/directory

email = [email protected]
text = True

# authenticate by placing a file in the webroot (under .well-known/acme-challenge/)
# and then letting LE fetch it
authenticator = webroot
webroot-path = /path/to/webroot

Note that I am using the webroot plugin to generate the cert, so I can avoid any downtime in my server.

When writing a script to create and automatize my certs I had to reissue the certifications many times and this command worked for me without having to delete anything extra.

If you are still in trouble, try to symbolic link in renew to the latest .pem certificate archives of your server:

lrwxrwxrwx 1 root root   38 mar 11 01:02 cert.pem -> ../../archive/[SERVER]/cert8.pem
lrwxrwxrwx 1 root root   39 mar 11 01:02 chain.pem -> ../../archive/[SERVER]/chain8.pem
lrwxrwxrwx 1 root root   43 mar 11 01:02 fullchain.pem -> ../../archive/[SERVER]/fullchain8.pem
lrwxrwxrwx 1 root root   41 mar 11 01:02 privkey.pem -> ../../archive/[SERVER]/privkey8.pem