bunkerity / bunkerity/bunkerweb

[BUG] LE renewal: on config file errors reissue the cert

Open
#3,324 7 comments 0 reactions 1 assignee Claimed by @TheophileDiot View on GitHub
bug core next minor
Dominant language
Python
Stars
10.9k
Forks
643
Avg merge
1d 10h
Merged PRs (30d)
42

Description

### What happened?

During service restart i found out that some certificates have config file errors:

```
[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - Additionally, the following renewal configurations were invalid:
[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - /var/cache/bunkerweb/letsencrypt/etc/renewal/example.com.conf (parsefail)
[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - /var/cache/bunkerweb/letsencrypt/etc/renewal/example.eu.conf (parsefail)
[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - /var/cache/bunkerweb/letsencrypt/etc/renewal/www.example.ai-ecdsa.conf (parsefail)

[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - Renewal configuration file /var/cache/bunkerweb/letsencrypt/etc/renewal/example.com.conf is broken.
[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - The error was: expected /var/cache/bunkerweb/letsencrypt/etc/live/example.com/cert.pem to be a symlink
[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - Skipping.

[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - Renewal configuration file /var/cache/bunkerweb/letsencrypt/etc/renewal/www.example.ai-ecdsa.conf is broken.
[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - The error was: renewal config file {} is missing a required file reference
[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - Skipping.
[2026-03-14 10:39:11 +0000] [LETS-ENCRYPT.RENEW.CERTBOT] [372587] [ℹ️ ] - 0 renew failure(s), 3 parse failure(s)
```

### How to reproduce?

Can't reproduce why the LE errors happened at first.

### Configuration file(s) (yaml or .env)

```YAML

```

### Relevant log output

```shell
Example of a 0 byte config file:

ls -la /var/cache/bunkerweb/letsencrypt/etc/renewal/www.sysangels.ai-ecdsa.conf
-rw-r----- 1 nginx nginx 0 Mar 12 14:04 /var/cache/bunkerweb/letsencrypt/etc/renewal/www.example.ai-ecdsa.conf
```

### BunkerWeb version

1.6.9

### What integration are you using?

Linux

### Linux distribution (if applicable)

debian 13.3

### Removed private data

- [x] I have removed all private data from the configuration file and the logs

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.