# Let's Encrypt Certificate expired **URL:** \ **Category:** openBalena\ **Tags:** letsencrypt\ **Created:** [July 18, 2021, 6:48pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526 "2021-07-18T18:48:49Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Winkelmann](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/winkelmann/32/2419_2.png) [@Winkelmann](https://forums.balena.io/u/Winkelmann)\ **Post date:** [July 18, 2021, 6:48pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/1 "2021-07-18T18:48:49Z")
Hey, My infrastructure has been running for one and a half year by now. I’m using version 1.3.0 of OpenBalena. I’m using a Let’s Encrypt certificate generated and managed by OpenBalena. As I understand, that certificate is created for 90 days and automatically refreshed when needed. It seems that has worked for 1,5 years because I never had any errors related to expired certificate. However today I realized that one of my Raspberry Pi had an error because it is blipping it’s LED, indicating it doesn’t have access to the Balena instance. When I tried to connect to the Balena CLI to investigate is when I realized my certificate was expired. ```auto CERT_HAS_EXPIRED: request to https://api./login_ failed, reason: certificate has expired ``` If I go to the api from my web browser, same story. The certificate was generated 3 months ago, and has now been expired for 3 days. > Validity > Not Before: Fri, 16 Apr 2021 23:09:24 GMT > Not After: Thu, 15 Jul 2021 23:09:24 GMT I connected to my Balena Instance (running on DigitalOcean with no issues since october 2019), and tried restarting the cert-provider container with: ```auto ./scripts/compose restart cert-provider ``` That didn’t change anything. I also looked at the logs of that container, but there is nothing suspicious. Extract since I restarted (I first restarted the server, then a bit later manually restarted only the cert-provider) ![balena-cert-provider-logs](https://global.discourse-cdn.com/balena/original/2X/5/5a46b5e492ae3c8d74844a5b087f6aff768f328a.png) For now my infrastructure “works” because the actual work takes place outside the Balena Instance, so I’m not in a critical situation. However, I cannot access my devices from Balena, and cannot login to the Balena CLI because of this. I would appreciate your help in forcing the the Let’s Encrypt certificate to update. Thanks in advance Tim ---
**Author:** ![rmorillo24](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rmorillo24/32/10359_2.png) [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Post date:** [July 20, 2021, 4:44pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/2 "2021-07-20T16:44:17Z")
Hey Tim, We should first check if the certificate in use by openBalena is valid. Can you give a try to ‘curl https://api.your\_domain/ping’ from inside the openBalena server? By the way, I think the server needs a restart after the cert-provider is restarted. Might be worth trying if the curl command doesn’t return OK ---
**Author:** ![Winkelmann](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/winkelmann/32/2419_2.png) [@Winkelmann](https://forums.balena.io/u/Winkelmann)\ **Post date:** [July 24, 2021, 12:04pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/4 "2021-07-24T12:04:36Z")
Hey, the ping from withing the OpenBalena server returns the following: ![curl-fails](https://global.discourse-cdn.com/balena/original/2X/c/ccc0f8599776fe672f484d8cd20917443ad84c37.png) An extra restart changes nothing sadly. I left the full URL of my server in the screenshot, if you want to go check the certificate out or run any tests on your side. Tim ---
**Author:** ![toochevere](https://avatars.discourse-cdn.com/v4/letter/t/838e76/32.png) [@toochevere](https://forums.balena.io/u/toochevere)\ **Post date:** [August 6, 2021, 4:46pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/5 "2021-08-06T16:46:08Z")
Tim, how are you renewing our certificate? Do you have a LetsEncrypt agent running that is handling the renewal (along with the challenge that verifies domain control)? Is that agent still running? If the cert is expired, I would expect that is where the problem lies. ---
**Author:** ![toochevere](https://avatars.discourse-cdn.com/v4/letter/t/838e76/32.png) [@toochevere](https://forums.balena.io/u/toochevere)\ **Post date:** [August 6, 2021, 4:48pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/7 "2021-08-06T16:48:56Z")
Tim, sorry, I meant to say “how are you renewing THE certificate”. I suspect that the agent might be down. ---
**Author:** ![Winkelmann](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/winkelmann/32/2419_2.png) [@Winkelmann](https://forums.balena.io/u/Winkelmann)\ **Post date:** [August 7, 2021, 2:54pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/8 "2021-08-07T14:54:45Z")
Hey, I did not setup anything to renew the certificate. Since it’s creation was handled by OpenBalena, I figured it would also handle the renewal. I can confirm it did handle the renewal, because as I said, every certificate lasts 3 months, and it renewed them without any intervention from me for the past 1,5 years. But since the 15th of July, it hasn’t updated it. After digging into more logs with `./scripts/compose logs`, I think I finally found it: ```auto cert-provider_1 | crond: USER root pid 4073 cmd "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null cert-provider_1 | [Wed Jul 28 00:09:53 UTC 2021] Error, can not get domain token entry api. cert-provider_1 | [Wed Jul 28 00:09:53 UTC 2021] Please add '--debug' or '--log' to check more details. cert-provider_1 | [Wed Jul 28 00:09:53 UTC 2021] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh cert-provider_1 | [Wed Jul 28 00:09:53 UTC 2021] Error renew api.. ``` I’ll post this now, but I’ll keep digging into it and I’ll keep you updated. If you have any idea what the issue is, I would appriciate your help. Tim ---
**Author:** ![Winkelmann](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/winkelmann/32/2419_2.png) [@Winkelmann](https://forums.balena.io/u/Winkelmann)\ **Post date:** [August 7, 2021, 3:10pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/9 "2021-08-07T15:10:04Z")
Well looks like I found the error: acme.sh version 2.8.1 (inside the cert-provider container) tries to get a new cert from: [https://acme-v01.api.letsencrypt.org/directory](https://acme-v01.api.letsencrypt.org/directory) ```auto { "type": "urn:acme:error:serverInternal", "detail": "ACMEv1 is deprecated and you can no longer get certificates from this endpoint. Please use the ACMEv2 endpoint, you may need to update your ACME client software to do so. Visit https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430/27 for more information." } ``` So year. It’s deprecated. I guess that’s what happens when you run an old version of a software (OpenBalena in my case). I’m going to try and update acme.sh and keep you updated. ---
**Author:** ![Winkelmann](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/winkelmann/32/2419_2.png) [@Winkelmann](https://forums.balena.io/u/Winkelmann)\ **Post date:** [August 7, 2021, 3:40pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/10 "2021-08-07T15:40:55Z")
Okay, here is the solution for anyone running an old version of OpenmBalena: The problem is that ACMEv1 was deprecated recently, but the `cert-provider` included in OpenBalena hasn’t been updatd to use ACMEv2. Here is what I did to fix it. On the Server running OpenBalena: ```auto # Find out the id of the cert-provider container docker ps # Run bash in the cert-provider container docker exec -it bash cd /root/.acme.sh # Get the latest version that will support ACMEv2 ./acme.sh --upgrade # Register a new account on LetsEncrypt ./acme.sh --register-account --server letsencrypt # Set it as default ./acme.sh --set-default-ca --server letsencrypt # Find the folder containing your cert and cert config cd /usr/src/app/certs/api. # Edit the config file. Only vim is available vi api..conf ``` Replace all references to `https://acme-v01.api.letsencrypt.org` with `https://acme-v02.api.letsencrypt.org`. Save and exit. Run the certificate updater (with debug to see that everything is working) ```auto "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" --debug ``` Main references for finding the solution: > > **[End of Life Plan for ACMEv1](https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430/27)** > > We have fully turned off the ACMEv1 API as a viable way to get a Let’s Encrypt certificate. Users will see this message when they attempt to issue a certificate with the ACMEv1 API: ACMEv1 is deprecated and you can no longer get certificates from... > **[Acme v02 upgrade from v01](https://community.letsencrypt.org/t/acme-v02-upgrade-from-v01/131196)** > > Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so... ---
**Author:** ![toochevere](https://avatars.discourse-cdn.com/v4/letter/t/838e76/32.png) [@toochevere](https://forums.balena.io/u/toochevere)\ **Post date:** [August 8, 2021, 11:23am UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/11 "2021-08-08T11:23:46Z")
Nice! Thanks @winkelmann ! 👏 I’ll document this and also make sure that the latest version of OpenBalena is doing the right thing. ---
**Author:** ![jose\_barrero](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@jose\_barrero](https://forums.balena.io/u/jose_barrero)\ **Post date:** [November 17, 2021, 10:43pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/27 "2021-11-17T22:43:40Z")
hi @Winkelmann I am running openbalena 2.0.0 I’m facing the same issue with my certificates but I can’t follow your steps. here are the steps i could reproduce: ![image](https://global.discourse-cdn.com/balena/original/2X/1/1aa0b83824b74dcf04ca5c0a8f8ef5a6394808ea.png) but then i cant seem to find any folder with domain specific configuration so im stuck at: cd /usr/src/app/certs/api. # Edit the config file. Only vim is available vi api..conf what version of openbalena were you using? I would appreciate any help thanks ---
**Author:** ![Winkelmann](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/winkelmann/32/2419_2.png) [@Winkelmann](https://forums.balena.io/u/Winkelmann)\ **Post date:** [November 19, 2021, 5:45pm UTC](https://forums.balena.io/t/lets-encrypt-certificate-expired/339526/28 "2021-11-19T17:45:13Z")
Hey, I was and am still using version 1.3.0. I believe the path I gave should be the same for everyone,. Since we are inside the Docker Container, the folder containing the certificates is controlled by the people that developed Balena. My best guess is, that folder was moved elsewhere between version 1.3.0 and 2.0.0 I don’t have that version or the time to deploy it for testing, so I’m afraid I can’t help you much. You could do a file system search (inside the docker container) for the file “`api..conf`”. If you’re lucky, it might point you to the correct folder. Otherwise, you are going to need to ask a Balena developper where the certificates are stored in version 2.0.0 (@toochevere ?) Hope it helps Tim