Automatic renewal fails sometimes
Sometimes renewal of a letsencrypt certificate fails. We saw this happen for www.tibet.nu (tibet.nu kept working).
When we looked on the proxy we saw the certificate was missing in /etc/haproxy/le/{ip}/
In the letsencrypt logs we found the following:
# grep -C2 2018.03.02.*tibet.nu /var/log/letsencrypt/letsencrypt.log.*
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:29,746:DEBUG:acme.client:Storing nonce: vzeEfvKo53blQW2m4sci6laLqePA8-XGt8fOtwxju3U
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:29,748:INFO:certbot.auth_handler:Performing the following challenges:
/var/log/letsencrypt/letsencrypt.log.137:2018-03-02 15:43:29,748:INFO:certbot.auth_handler:http-01 challenge for www.tibet.nu
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:29,863:INFO:certbot.auth_handler:Waiting for verification...
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:29,864:DEBUG:acme.client:JWS payload:
--
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:34,627:INFO:certbot.crypto_util:Generating key (3072 bits): /opt/certbots/213.108.104.105/keys/2551_key-certbot.pem
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:34,692:INFO:certbot.crypto_util:Creating CSR: /opt/certbots/213.108.104.105/csr/2551_csr-certbot.pem
/var/log/letsencrypt/letsencrypt.log.137:2018-03-02 15:43:34,693:DEBUG:certbot.client:CSR: CSR(file='/opt/certbots/213.108.104.105/csr/2551_csr-certbot.pem', data='0\x82\x03\x860\x82\x01\xee\x02\x01\x020\x171\x150\x13\x06\x03U\x04\x03\x0c\x0cwww.tibet.nu0\x82\x01\xa20\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\x00\x03\x82\x01\x8f\x000\x82\x01\x8a\x02\x82\x01\x81\x00\xb1\xd5\xbc\x97\xa9\xf2\xcb\xc4h\x18\xfc,E\x80\xcd\xe3\x137\xd6\xe2\x992\xafj\xbfwhO\xf1\n8 Ke[b\xc2&?\x07\x96\xf8\xbd\x92#\xdc\xab\xfaD\xb1\r71\xf8\x0e\xb6\xc95\x96I\xf9o\x91\x9d\x1cY4\xd3\xabt*%\x0b\xe6\xbb%\x8e\xdf},\xd0\x1a\xa1\xd4\xa47\xa0\xcb\x85"XG\xdbq\x8e\xd7\xd9\xe0W\xe8\x8d\x93\xab\x1fj\x8f\x0cJ?G\xd7\x1aJ\x8b\xd7\xc5\xe4`\x10\xb6\x05\xcf\xc0/\xab[\xb7\xbb;_\xdc\xe6\x9a\x1fq\x89\x14r81\xe3\xb1q\xee\x90X\x8e\xef\xbe\xe1G\x0b\x9b\xb7\xb0\xd1\xb0N5\xc8\xddXL\x04\x94@4\xef\x1b\xcc\xd2\xe0=H\x85\xb2\x14\xb5\x11\xe4\x95\x05\xf5\x1e\x91\xd7\xb7;\x7f\x16\x80v\xee\x86<\xab\x96\xcc\x1a\x0f\x98\xbe\x89\xa6\x17\xec\xb8\x1cG<\xa0R-\xd6g\xd4\xe0\xac#\xe9\x1b\x85\x96ow\xf3\x19\xfa\x15\xd0\xdd\n\xd6\xb6\x026\x12i\xbd\xc9\xb2\x13{\xf9\xcb\xfc>t\x9c\x84\xfb92X+\xd5]\xd4\x87\xa4G\xeb\x01\x98\xff\x84u\x89\xdd\n\nV\x8b\xf7?\xfe\x05oL[U\xbao\x97pn\xd2\xf1\xc6\xber\xcc\xb1|p\x8a\x80\xf4\'\xb1\x7f&\x8c/i\xe1\t\x7f\xe0\xe0\xb4\x1b\xc7\xef\xb8\xfe\x175b\xca\x98\xce\xd2\xf8\x17\x1e1c\xca\xc1\xab\x08Z\xed\xc4n\xb2\xc3\xb5\x931(s\xc0a6\xff:!}\xe0\x10\xcef\xe9zU\xb6\x85}\x0b\xa1%\xdfe\xd7\xf1\r\xbc\xf6\xdc\xc3\x98\x88\x0c\xd0\xa40\xdfo\x03s\xdd}\x02\x03\x01\x00\x01\xa0*0(\x06\t*\x86H\x86\xf7\r\x01\t\x0e1\x1b0\x190\x17\x06\x03U\x1d\x11\x04\x100\x0e\x82\x0cwww.tibet.nu0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\x00\x03\x82\x01\x81\x00v4\x90\x07\xee\x1c^\xedh8\xeb\x84m\xc5\xed\xacL\xc2\xb8$\xfc\xbb\xb1\x12E\xa0Hi\xc5mh1\xf2\xc2\xec\x10s\xb7O\xd0\x845\xa2\xef\xab\xc0\xed\xd3K\xdc\x85[\xf1\x88L2>(H\xcb\x8c\x88\x9f\x0f\x156^v\xeb\xb8\x19g\x8d\xed\xee\xda\xb4m\x1eQ\xc7?\xef%\x986\xe9\x17R\t\x8c\xff\x8b\t\xf7\xf6)\xe5\x10\xc1\x8bL\xe4Du\x08\x8d=\xc9\xaf\xb8\x8d\xe5\xa1D\xc1\x1e<4\xa7\xc1\xb3\xb1Z\x81\x93\x83(\xdf\xd5>^\xcc81\xec[\xd1\xd4\xf5\xd0\x99\x90\xd6n\xe1\xf0\x1f\xe53\x07\x13\xbdV\\\xf4\xa8>\x19\x16\xf2\xb7\t\xecuAyi\x9c\x0f\xef\xd2\xf48L=\x93\xb9\xc3\xf8\x88\xf7to<\x17PvJ\xc0\xbc\xe9\xac\x97\x08\xe1F?Kv\r\xf1s\x83\xab\xcd\x91!\x11\x01\x02\x83\x9c\x11\xd0\x9a\x1c\xaa\x8f\x04\x8e\xb5:d\xa60\x8c\'\xe4\x04m\x9eYs\xe2[\xb3Ah\xc1\x18)\xb7\xbf\xbc\t3T}f\x18\xc9\xb0Qy\x15#\xcbNjgf\xc0\x83\xa7;\xdbo\x9e\xb4Sn\xe09\xb4|w-\xf5\x13\xd0\x8c\xd8/\x9f\xf6\xf9M<|\xd6w\xc4r##\xf2\x03f\x84\xd9\t\xafw\xbe\xd13\xad\xd2r~\x01sb\xbe\xa6<\x91k\xa7\xf2\x1dpT\x85\xba\xad\x08\xb78K\x90YC\xdf\xb2Lm\n\xc3\xca\x1e\x9b\xce\xef\x8b\xf4B\n\x95\xb68\r\x87\xb3\x81\xfa{\x12\xb68QZ\xd0\xe7\x04 \tB\xc6\x15\x96\xc9\xdf\xe6x\xbcJ\xa17g\xec\xb0\x90', form='der'), domains: [u'www.tibet.nu']
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:34,694:DEBUG:acme.client:Requesting issuance...
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:34,695:DEBUG:acme.client:JWS payload:
--
/var/log/letsencrypt/letsencrypt.log.137-
/var/log/letsencrypt/letsencrypt.log.137-MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMTDkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0NlowSjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMTGkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EFq6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWAa6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIGCCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNvbTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9kc3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAwVAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcCARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwuY3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsFAAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJouM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwuX4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlGPfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
/var/log/letsencrypt/letsencrypt.log.137:2018-03-02 15:43:35,435:DEBUG:certbot.storage:Writing new private key to /opt/certbots/213.108.104.105/archive/www.tibet.nu/privkey6.pem.
/var/log/letsencrypt/letsencrypt.log.137:2018-03-02 15:43:35,436:DEBUG:certbot.storage:Writing certificate to /opt/certbots/213.108.104.105/archive/www.tibet.nu/cert6.pem.
/var/log/letsencrypt/letsencrypt.log.137:2018-03-02 15:43:35,436:DEBUG:certbot.storage:Writing chain to /opt/certbots/213.108.104.105/archive/www.tibet.nu/chain6.pem.
/var/log/letsencrypt/letsencrypt.log.137:2018-03-02 15:43:35,436:DEBUG:certbot.storage:Writing full chain to /opt/certbots/213.108.104.105/archive/www.tibet.nu/fullchain6.pem.
/var/log/letsencrypt/letsencrypt.log.137:2018-03-02 15:43:35,958:DEBUG:certbot.storage:Writing new config /opt/certbots/213.108.104.105/renewal/www.tibet.nu.conf.new.
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:35,960:DEBUG:certbot_haproxy.installer:save title: None, temporary: False
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:43:35,960:DEBUG:certbot_haproxy.installer:Adding changed files () to reverter
--
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:45:21,428:DEBUG:acme.client:Storing nonce: wJkoUjv54UbcV-t2vHGEIPtXpPztGlcQJEUPuQ5umDA
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:45:21,430:INFO:certbot.auth_handler:Performing the following challenges:
/var/log/letsencrypt/letsencrypt.log.137:2018-03-02 15:45:21,430:INFO:certbot.auth_handler:http-01 challenge for tibet.nu
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:45:21,511:DEBUG:certbot.error_handler:Encountered exception:
/var/log/letsencrypt/letsencrypt.log.137-Traceback (most recent call last):
--
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:45:21,511:DEBUG:certbot.error_handler:Calling registered functions
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:45:21,511:INFO:certbot.auth_handler:Cleaning up challenges
/var/log/letsencrypt/letsencrypt.log.137:2018-03-02 15:45:21,516:WARNING:certbot.renewal:Attempting to renew cert from /opt/certbots/213.108.104.105/renewal/tibet.nu.conf produced an unexpected error: At least one of the required ports is already taken.. Skipping.
/var/log/letsencrypt/letsencrypt.log.137-2018-03-02 15:45:21,516:DEBUG:certbot.renewal:Traceback was:
/var/log/letsencrypt/letsencrypt.log.137-Traceback (most recent call last):
--
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:42:59,618:DEBUG:acme.client:Storing nonce: oodNBQkUhOgPhFwkmsqBUQkumhVyVhkVEYFQVUnwtqU
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:42:59,619:INFO:certbot.auth_handler:Performing the following challenges:
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:42:59,619:INFO:certbot.auth_handler:http-01 challenge for www.tibet.nu
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:42:59,702:DEBUG:certbot.error_handler:Encountered exception:
/var/log/letsencrypt/letsencrypt.log.138-Traceback (most recent call last):
--
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:42:59,702:DEBUG:certbot.error_handler:Calling registered functions
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:42:59,702:INFO:certbot.auth_handler:Cleaning up challenges
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:42:59,705:WARNING:certbot.renewal:Attempting to renew cert from /opt/certbots/213.108.104.105/renewal/www.tibet.nu.conf produced an unexpected error: At least one of the required ports is already taken.. Skipping.
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:42:59,706:DEBUG:certbot.renewal:Traceback was:
/var/log/letsencrypt/letsencrypt.log.138-Traceback (most recent call last):
--
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:33,573:DEBUG:acme.client:Storing nonce: bRjgZwU5V6FcEk-wEB1k-FNFul3yLCACzF1v2rkgRLY
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:33,574:INFO:certbot.auth_handler:Performing the following challenges:
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:45:33,575:INFO:certbot.auth_handler:http-01 challenge for tibet.nu
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:33,684:INFO:certbot.auth_handler:Waiting for verification...
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:33,685:DEBUG:acme.client:JWS payload:
--
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:38,535:INFO:certbot.crypto_util:Generating key (3072 bits): /opt/certbots/213.108.104.105/keys/2561_key-certbot.pem
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:38,578:INFO:certbot.crypto_util:Creating CSR: /opt/certbots/213.108.104.105/csr/2561_csr-certbot.pem
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:45:38,579:DEBUG:certbot.client:CSR: CSR(file='/opt/certbots/213.108.104.105/csr/2561_csr-certbot.pem', data='0\x82\x03~0\x82\x01\xe6\x02\x01\x020\x131\x110\x0f\x06\x03U\x04\x03\x0c\x08tibet.nu0\x82\x01\xa20\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\x00\x03\x82\x01\x8f\x000\x82\x01\x8a\x02\x82\x01\x81\x00\xc3\xd35\xe8?\xcfd^2\x08\xa0\xe8\xa0\xac\x8f\xe9}\x9b\xbb\xdd\xfasv~v\xe9\xf3).m\x8a>j\x8d\xd7\xe9(\xb5e\xbd\x9e\xb7~<\xf3k6u\x93\xb2YO\r\x9c\xd1\x99\x0c\xb9\x07\xac\x13\xe5\x1a\xd2\x90\\\xa0\xf6x\x8ek7Es7\x18\x9f\xe5\xfdD\xe7\xa4\x1a\xf7A\xf0\x07)a\x03\xee\xdd\x8e}\xcdp\xfcG\\\n\xf0\x82v\x15\x0f8\xe3\xd0F0\xc1\x8e&|\x9c\xf1\x0eo\xfe\x9e\x90\x80\xe1\x96^\x9f\xe70Z\x07\xa21\xc3k\x00\x0ev\x82W\x8d*4?Q1\xb8\x1e\xd7\xac2e\xe4%k`\xd3p\xb4\xdaV\x12\xd2\xc5\xdbB\x1d\xe4\x19\xd2\x1dI\x8d#b\'\xc7"\xef\x07|g\xc4a\xf1\xd4G\x9a\xf1A\xb5\x8a\x86\xec\x94\xe5#o&\x13\xdf8\xdbfm*u{(S\xe1\x8d\xd7Mal\t\\\x1c\xb0p\n\x99\xff\x9b5r\x9a\xbd\x8b\xc3\x00\xfc\xd5\x8cD\x18\x8a\xce\xb5 \xd6lg\x84\xb8\x1f\x00C&<l7\x81\xfd{\xb9=\xfeJ\x1b<\n\xc9=sW\x9b\xf1\xd3\xe5\xb6^\xddtJ<>\xeb\x1c\xe1\xb0j\xc4O\x10Ud\x16F0\xaa\xa0\xc5\x90\xaa8\xe8T_\xf7\x9d\x82\xb7s\x88\x9e:j=\x1dq\x9d-\\\xaf\x02\xc3\xcbZ\x0e[d\'\xc9\x1c\x8e\xbb;\xb0\xe1\x80\xde\xc0\x8a\x9br\xc1\x16\xbd\xb3\xcd-\xce2\xfdo\xde\xb9/sN\xd2I\xf1w\xe4`]\xa4\xde\xfbh\xf6yn\xf2+\xba\x07"\xc1\xe8\x9c\xc4i\x84\xb5\x9e\xef\x8b\xbfu\xe8O\x02\x03\x01\x00\x01\xa0&0$\x06\t*\x86H\x86\xf7\r\x01\t\x0e1\x170\x150\x13\x06\x03U\x1d\x11\x04\x0c0\n\x82\x08tibet.nu0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x0b\x05\x00\x03\x82\x01\x81\x00\xb2\xf2\xf5\xdby\x90\x95\x0c\x01\xcfc\x8c\xecGr\xb3"OA\x8bb,;\xc9\xba,\xa2\xae\xde\x0f\xb0\xf3\xedf6 H5ot\xa1\xb9\x95\xba\x1c\xaa4w\x94B)E\xd5\xab\xad\xefB=\xc4\xdep[\x01\x08\xe7\xee.\xa86/-\xfb^(\xb4\x1f\x9a\x92ie<\xe9\xe8\x06=W\xae6\xb8\x11\xa1\xc7\x8d\xb142\xc4\xa9tV%\xc6\xc4\xc8\xb1TbuS\xf1\x07\x1a\x1bC\xcd}\x93R\x8b\x819\xce\xde\'\x18(\xd1\x7f@7D\xb3[?M \x14\x15\xe7\xb1\xeeP\xa5\x85\xcd\xaa$\xb0)\x01\xd1E\xe7\xdd$kI\xf1\x0e\xd8\x0c\xa6(a\xa8\xe7\xad\x9f^\x03z`)\xc7_\xc8\xfdX\xb4\xb0\xeb\x91 ,%R\x1e\x11\xe5\x84+\xde\xd9\xec\xb31\xe5\x1b\x14^R\x1f\xf0okU"\x1e!Ac^S\xa6\x8c\x84Z\xfc\x95\xd7\x0bD\x04\x81H\'\xcf\xc5\xa43"R/6\xf2\xbfK*\xf9{\x18\xe3WC\x83\xb2pV\xe5(\xdb3h9\xcd\xea\x91\xd2;\xb6\xa5\x8a\xf8k\xccpw\x90\xc7\xdeLez\xa4\xdd=\x02\x7fd\xe8"\xb0\x13\xf0\x8e\xbd0\xd5\xaf{\x94F\xd9\x96?\xc1BL\xf8\xac\xf0\xae9\x91\xa5\xcf\xf4\xb3\xcdoy%\xf8@\x08l"\xdc\xe3\xfcY\xa9\xfa\x10g\x98J\xc98\x8bg,\x04\x08\xc9\xea]\xf6\x96\x1a\x88\x80^U\x18\xd9\xb3\xf6\x85)\xcd\xfen\xdc\xbf\xcd\xaf\xc3\xb1\x16Ll\xa1f)G\x908@\xdaA\x9a\xc7-\xfbU-v\xc2\xbb\xd5c\x87\xa7', form='der'), domains: [u'tibet.nu']
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:38,579:DEBUG:acme.client:Requesting issuance...
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:38,580:DEBUG:acme.client:JWS payload:
--
/var/log/letsencrypt/letsencrypt.log.138-
/var/log/letsencrypt/letsencrypt.log.138-MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMTDkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0NlowSjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMTGkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EFq6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWAa6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIGCCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNvbTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9kc3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAwVAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcCARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwuY3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsFAAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJouM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwuX4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlGPfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:45:39,348:DEBUG:certbot.storage:Writing new private key to /opt/certbots/213.108.104.105/archive/tibet.nu/privkey6.pem.
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:45:39,349:DEBUG:certbot.storage:Writing certificate to /opt/certbots/213.108.104.105/archive/tibet.nu/cert6.pem.
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:45:39,349:DEBUG:certbot.storage:Writing chain to /opt/certbots/213.108.104.105/archive/tibet.nu/chain6.pem.
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:45:39,349:DEBUG:certbot.storage:Writing full chain to /opt/certbots/213.108.104.105/archive/tibet.nu/fullchain6.pem.
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:45:39,835:DEBUG:certbot.storage:Writing new config /opt/certbots/213.108.104.105/renewal/tibet.nu.conf.new.
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:39,838:DEBUG:certbot_haproxy.installer:save title: None, temporary: False
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:45:39,838:DEBUG:certbot_haproxy.installer:Adding changed files ('/etc/haproxy/le/213.108.104.105/tibet.nu.pem',) to reverter
/var/log/letsencrypt/letsencrypt.log.138:2018-03-02 15:45:39,838:DEBUG:certbot.reverter:Creating backup of /etc/haproxy/le/213.108.104.105/tibet.nu.pem
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:39,839:DEBUG:certbot_haproxy.installer:save title: Deployed ACME Certificate, temporary: False
/var/log/letsencrypt/letsencrypt.log.138-2018-03-02 15:45:39,840:DEBUG:certbot_haproxy.installer:Adding changed files () to reverter
A PROXYLERENEW seemed to be insufficient to fix the missing certificate. We had to trigger a PROXYLEADD by switching off and on TLS for the domain in Cosmos.