Problems with Letsencrypt cert renewal

ℹ️ Support
, ,
1

Hi Guy’s,

I got a problem with me Letsencrypt cert renewal.

I’m on Nextcloud 34.04 as a nextcloudpi installation.

My automatic cert renewal at the ncp panel show me some errors.

I checked the letsencrypt.log and found an error about a symlink expection.

But the mentioned file is a symlink. I’m totaly lost about this error.

Here’s the log. Maybe someone can help me:

2026-10-18 06:47:05,176:DEBUG:certbot._internal.main:certbot version: 2.1.0
2026-10-18 06:47:05,177:DEBUG:certbot._internal.main:Location of certbot entry point: /usr/bin/letsencrypt
2026-10-18 06:47:05,177:DEBUG:certbot._internal.main:Arguments: ['--quiet']
2026-10-18 06:47:05,177:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2026-10-18 06:47:05,238:DEBUG:certbot._internal.log:Root logging level set at 40
2026-10-18 06:47:05,242:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0001.conf
2026-10-18 06:47:05,259:DEBUG:certbot._internal.plugins.selection:Requested authenticator <certbot._internal.cli.cli_utils._Default object at 0x7fb7107e10> and installer <certbot._internal.cli.cli_utils._Default object at 0x7fb7107e10>
2026-10-18 06:47:05,272:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0001/cert2.pem
2026-10-18 06:47:05,278:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 06:47:05,280:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 06:47:05,281:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0002.conf
2026-10-18 06:47:05,289:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0002/cert1.pem
2026-10-18 06:47:05,291:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 06:47:05,293:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 06:47:05,294:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0003.conf
2026-10-18 06:47:05,302:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0003/cert1.pem
2026-10-18 06:47:05,304:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 06:47:05,306:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 06:47:05,307:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0004.conf
2026-10-18 06:47:05,315:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0004/cert1.pem
2026-10-18 06:47:05,317:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 06:47:05,319:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 06:47:05,320:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0005.conf
2026-10-18 06:47:05,328:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0005/cert1.pem
2026-10-18 06:47:05,330:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 06:47:05,332:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 06:47:05,332:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0006.conf
2026-10-18 06:47:05,341:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0006/cert1.pem
2026-10-18 06:47:05,343:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 06:47:05,345:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 06:47:05,346:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de.conf
2026-10-18 06:47:05,347:ERROR:certbot._internal.renewal:Renewal configuration file /etc/letsencrypt/renewal/meinewebseite.de.conf is broken.
2026-10-18 06:47:05,348:ERROR:certbot._internal.renewal:The error was: expected /etc/letsencrypt/live/meinewebseite.de/cert.pem to be a symlink
Skipping.
2026-10-18 06:47:05,352:DEBUG:certbot._internal.renewal:Traceback was:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 75, in _reconstitute
    renewal_candidate = storage.RenewableCert(full_path, config)
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/storage.py", line 506, in __init__
    self._check_symlinks()
  File "/usr/lib/python3/dist-packages/certbot/_internal/storage.py", line 585, in _check_symlinks
    raise errors.CertStorageError(
certbot.errors.CertStorageError: expected /etc/letsencrypt/live/meinewebseite.de/cert.pem to be a symlink

2026-10-18 06:47:05,352:DEBUG:certbot._internal.display.obj:Notifying user: 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2026-10-18 06:47:05,352:DEBUG:certbot._internal.display.obj:Notifying user: The following certificates are not due for renewal yet:
2026-10-18 06:47:05,352:DEBUG:certbot._internal.display.obj:Notifying user:   /etc/letsencrypt/live/meinewebseite.de-0001/fullchain.pem expires on 2027-01-14 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0002/fullchain.pem expires on 2026-12-26 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0003/fullchain.pem expires on 2026-12-26 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0004/fullchain.pem expires on 2026-12-26 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0005/fullchain.pem expires on 2026-12-26 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0006/fullchain.pem expires on 2027-01-09 (skipped)
2026-10-18 06:47:05,352:DEBUG:certbot._internal.display.obj:Notifying user: No renewals were attempted.
2026-10-18 06:47:05,353:DEBUG:certbot._internal.display.obj:Notifying user: 
Additionally, the following renewal configurations were invalid: 
2026-10-18 06:47:05,353:DEBUG:certbot._internal.display.obj:Notifying user:   /etc/letsencrypt/renewal/meinewebseite.de.conf (parsefail)
2026-10-18 06:47:05,353:DEBUG:certbot._internal.display.obj:Notifying user: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2026-10-18 06:47:05,353:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/letsencrypt", line 33, in <module>
    sys.exit(load_entry_point('certbot==2.1.0', 'console_scripts', 'certbot')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 19, in main
    return internal_main.main(cli_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1736, in main
    return config.func(config, plugins)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1629, in renew
    renewal.handle_renewal_request(config)
  File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 558, in handle_renewal_request
    raise errors.Error(
certbot.errors.Error: 0 renew failure(s), 1 parse failure(s)
2026-10-18 06:47:05,357:ERROR:certbot._internal.log:0 renew failure(s), 1 parse failure(s)
2026-10-18 09:34:08,129:DEBUG:certbot._internal.main:certbot version: 2.1.0
2026-10-18 09:34:08,130:DEBUG:certbot._internal.main:Location of certbot entry point: /usr/bin/certbot
2026-10-18 09:34:08,130:DEBUG:certbot._internal.main:Arguments: ['-q', '--no-random-sleep-on-renew']
2026-10-18 09:34:08,130:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2026-10-18 09:34:08,192:DEBUG:certbot._internal.log:Root logging level set at 40
2026-10-18 09:34:08,195:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0001.conf
2026-10-18 09:34:08,213:DEBUG:certbot._internal.plugins.selection:Requested authenticator <certbot._internal.cli.cli_utils._Default object at 0x7fb87c7fd0> and installer <certbot._internal.cli.cli_utils._Default object at 0x7fb87c7fd0>
2026-10-18 09:34:08,225:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0001/cert2.pem
2026-10-18 09:34:08,231:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 09:34:08,234:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 09:34:08,234:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0002.conf
2026-10-18 09:34:08,242:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0002/cert1.pem
2026-10-18 09:34:08,245:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 09:34:08,247:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 09:34:08,247:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0003.conf
2026-10-18 09:34:08,256:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0003/cert1.pem
2026-10-18 09:34:08,258:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 09:34:08,260:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 09:34:08,260:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0004.conf
2026-10-18 09:34:08,269:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0004/cert1.pem
2026-10-18 09:34:08,272:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 09:34:08,274:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 09:34:08,274:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0005.conf
2026-10-18 09:34:08,282:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0005/cert1.pem
2026-10-18 09:34:08,285:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 09:34:08,287:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 09:34:08,287:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de-0006.conf
2026-10-18 09:34:08,296:INFO:certbot.ocsp:Cannot extract OCSP URI from /etc/letsencrypt/archive/meinewebseite.de-0006/cert1.pem
2026-10-18 09:34:08,298:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2026-10-18 09:34:08,300:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2026-10-18 09:34:08,301:DEBUG:certbot._internal.display.obj:Notifying user: Processing /etc/letsencrypt/renewal/meinewebseite.de.conf
2026-10-18 09:34:08,303:ERROR:certbot._internal.renewal:Renewal configuration file /etc/letsencrypt/renewal/meinewebseite.de.conf is broken.
2026-10-18 09:34:08,303:ERROR:certbot._internal.renewal:The error was: expected /etc/letsencrypt/live/meinewebseite.de/cert.pem to be a symlink
Skipping.
2026-10-18 09:34:08,307:DEBUG:certbot._internal.renewal:Traceback was:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 75, in _reconstitute
    renewal_candidate = storage.RenewableCert(full_path, config)
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/storage.py", line 506, in __init__
    self._check_symlinks()
  File "/usr/lib/python3/dist-packages/certbot/_internal/storage.py", line 585, in _check_symlinks
    raise errors.CertStorageError(
certbot.errors.CertStorageError: expected /etc/letsencrypt/live/meinewebseite.de/cert.pem to be a symlink

2026-10-18 09:34:08,308:DEBUG:certbot._internal.display.obj:Notifying user: 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2026-10-18 09:34:08,308:DEBUG:certbot._internal.display.obj:Notifying user: The following certificates are not due for renewal yet:
2026-10-18 09:34:08,308:DEBUG:certbot._internal.display.obj:Notifying user:   /etc/letsencrypt/live/meinewebseite.de-0001/fullchain.pem expires on 2027-01-14 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0002/fullchain.pem expires on 2026-12-26 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0003/fullchain.pem expires on 2026-12-26 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0004/fullchain.pem expires on 2026-12-26 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0005/fullchain.pem expires on 2026-12-26 (skipped)
  /etc/letsencrypt/live/meinewebseite.de-0006/fullchain.pem expires on 2027-01-09 (skipped)
2026-10-18 09:34:08,308:DEBUG:certbot._internal.display.obj:Notifying user: No renewals were attempted.
2026-10-18 09:34:08,308:DEBUG:certbot._internal.display.obj:Notifying user: 
Additionally, the following renewal configurations were invalid: 
2026-10-18 09:34:08,308:DEBUG:certbot._internal.display.obj:Notifying user:   /etc/letsencrypt/renewal/meinewebseite.de.conf (parsefail)
2026-10-18 09:34:08,309:DEBUG:certbot._internal.display.obj:Notifying user: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2026-10-18 09:34:08,309:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/certbot", line 33, in <module>
    sys.exit(load_entry_point('certbot==2.1.0', 'console_scripts', 'certbot')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 19, in main
    return internal_main.main(cli_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1736, in main
    return config.func(config, plugins)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1629, in renew
    renewal.handle_renewal_request(config)
  File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 558, in handle_renewal_request
    raise errors.Error(
certbot.errors.Error: 0 renew failure(s), 1 parse failure(s)
2026-10-18 09:34:08,313:ERROR:certbot._internal.log:0 renew failure(s), 1 parse failure(s)

Thanks a lot

2
  • Has the process of issuing or renewing the certificates worked successfully in the past?
  • If so, what has changed in the meantime?

Edit:

It must have only just worked. Your certificates are still valid for quite some time and can’t be updated just yet. That won’t be possible until 30 days before they expire.

3

Yes, it has been worked for a long time.

I only did some Nextcloud and nextcloudpi updates.

At some day, I could not access to my instance because of an outdated cert.

At this time I’ve got some problems with the cert updates.

With the occ setupchecks I get some message “Forwarded for headers: Your remote address could not be determined.”. I’m not sure if this the problem.

My config.php got some entrys:

   'trusted_domains' => 
22   array (
23     0 => 'localhost',
24     1 => '192.168.2.2',
25     2 => 'meinewebseite.de',
26   ),
27   'datadirectory' => '/srv/nextcloud/ncdata/data',
28   'dbtype' => 'mysql',
29   'version' => '34.0.5.1',
30   'overwrite.cli.url' => 'https://meinewebseite.de/',

I just did an update, so the version is now 34.0.5.1

4

Currently a dist-upgrade is missing. I got no time for that now.

Is it possible to install a new nextcloudpi instance and restore one of my old backups?

5

Are you using a Reverse Proxy?

If so read: Occ setupchecks → remote address could not be determined and 101: reverse proxy

6

I don’t use a reverse proxy.

7

If you run occ via the terminal or a cron job, there is no web browser and no proxy redirection. This message is normal and harmless in this context

8

Hi @buzzzz, the error in your log is about the lineage named meinewebseite.de (the one without a -000x suffix): certbot expects /etc/letsencrypt/live/meinewebseite.de/cert.pem to be a symlink into /etc/letsencrypt/archive/meinewebseite.de/, and apparently it’s a regular file there. I’d check it with ls -l /etc/letsencrypt/live/meinewebseite.de/ and sudo certbot certificates. If that lineage is a leftover (it looks like you have several -0001 to -0006 ones that renew fine), the simplest fix is probably to back up /etc/letsencrypt first and then remove the broken one with sudo certbot delete --cert-name meinewebseite.de. If you still need it, replace the plain files in live/ with symlinks to the highest numbered cert/chain/fullchain/privkey files in the archive folder, for example ln -sf ../../archive/meinewebseite.de/cert1.pem cert.pem. Afterwards sudo certbot renew --dry-run should show whether the parse failure is gone. Also, so many numbered lineages usually mean certs were requested several times for the same domain, so it’s worth checking which one your web server config actually points at before deleting anything.