Letsencrypt renewal fails: Could not bind to IPv4 or IPv6.. Skipping

Question

The full error message I'm getting is:

Attempting to renew cert from /etc/letsencrypt/renewal/somedomain.com.conf produced an unexpected error: Problem binding to port 443: Could not bind to IPv4 or IPv6.. Skipping.

This is running on an AWS ubuntu 14.04 instance. All ports are open outgoing and 443 is open incoming.

I my case, same issue, but I found my domain not rightly mapped with IP address. as I fixed IP address with A record entry, all works great for me. — Tejas Tank, Jan 18 '18 at 12:04
@TejasTank same symptom perhaps but likely a different issue — eis, Dec 05 '19 at 17:51

score 100 · Answer 1 · edited Nov 07 '20 at 00:33

100

You just need to stop all running servers like Apache, nginx or OpenShift before doing this.

Stop Nginx

sudo systemctl stop nginx

Stop Apache2

sudo systemctl stop apache2

edited Nov 07 '20 at 00:33

Promise Preston

24,334
12
145
143

answered Dec 03 '17 at 09:32

shadaï ALI

1,447
1
11
11

3

Is this is the only option to renew the SSL certificates? The whole server should be down while updating it? – Raz Buchnik Mar 04 '20 at 14:59
so sad the console output omits this tiny detail. – Marcus Rohrmoser Feb 05 '23 at 20:36

score 81 · Answer 2 · answered Sep 17 '17 at 17:48

81

you probably run the script with (preconfigurated) --standalone when your server is already running at port 443.

You can stop server before renew and start them after.

man says:

--apache          Use the Apache plugin for authentication & installation
--standalone      Run a standalone webserver for authentication
--nginx           Use the Nginx plugin for authentication & installation
--webroot         Place files in a server's webroot folder for authentication
--manual          Obtain certificates interactively, or using shell script hooks

If I run renew with --apache I can't get any error.

answered Sep 17 '17 at 17:48

JKLIR

1,008
1
9
11

7

thanks...used `./certbot-auto renew --apache` and worked like a charm – gthuo Feb 19 '18 at 08:07
note that using `--apache` requires apache plugin to be installed. if you don't have that, you'll need to add stop/start server hooks around any autorenewals. – eis Dec 04 '19 at 21:09
you must stop the server in order to do that? – Raz Buchnik Mar 04 '20 at 16:00
Raz: No, If you call with parameter --apache or --nginx (depending on which server you use) – JKLIR Mar 04 '20 at 16:49

score 18 · Answer 3 · answered Sep 25 '17 at 23:31

As hinted in the other answers, you need to pass the option for your running webserver, for example:

Without webserver param:

sudo certbot renew

Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:tls-sni-01 challenge for example.com
Cleaning up challenges Attempting to renew cert (example.com) from /etc/letsencrypt/renewal/example.com.conf produced an unexpected error:
Problem binding to port 443: Could not bind to IPv4 or IPv6.. Skipping.

Then, again with the webserver param (success):

sudo certbot renew --nginx

Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges: tls-sni-01 challenge for example.com
Waiting for verification...
Cleaning up challenges

new certificate deployed with reload of nginx server; fullchain is /etc/letsencrypt/live/example.com/fullchain.pem

Congratulations, all renewals succeeded. The following certs have been renewed: /etc/letsencrypt/live/example.com/fullchain.pem (success)

This worked for me. I didn't need to stop the server. Just had to pass the --nginx flag. — Raffi, Jun 03 '21 at 15:19

score 16 · Answer 4 · edited Nov 10 '21 at 16:50

[This is specifically for ubuntu]

Login as root user to your server
Stop your server using the following command (for nginx)

service nginx stop
Then renew your certificate

certbot renew
Start your server

service nginx start

[TIP] To check the expiry date of your renewed certificate, enter the command below

ssl-cert-check -c [Path_to_your_certificate]/fullchain.pem

For example

ssl-cert-check -c /etc/letsencrypt/live/[your_domain_name]/fullchain.pem

Or

ssl-cert-check -c /etc/letsencrypt/live/[your_domain_name]/cert.pem

If you don't have ssl-cert-check already installed in your server, install it using

apt install ssl-cert-check

Note: The certificate can be renewed only if it is not expired. If it is expired, you have to create new one.

This is Useful for nginx and nodejs Server. – KuLdip PaTel Jan 28 '20 at 13:15 — KuLdip PaTel, Jan 28 '20 at 13:15
This worked for me, had to stop nginx then suceeded. – Swapnil Chincholkar Mar 28 '22 at 06:32 — Swapnil Chincholkar, Mar 28 '22 at 06:32

score 5 · Answer 5 · answered Dec 16 '19 at 07:34

For NodeJS/PM2 users

I was using PM2 for my NodeJS service and when trying to renew the certificate I also got the "Problem binding to port 80: Could not bind to IPv4 or IPv6." error message.

As mentioned in above answers for Apache/Ngnix, Stopping my service and then trying to renew solved the problem.

pm2 stop all
sudo certbot renew
pm2 start all

score 5 · Answer 6 · edited Nov 10 '21 at 16:50

5

For ngnix

sudo certbot renew --nginx

edited Nov 10 '21 at 16:50

Nimantha

6,405
6
28
69

answered Jun 07 '20 at 10:45

Caffeines

169
2
5

'Could not choose appropriate plugin: The requested nginx plugin does not appear to be installed' – horvoje Mar 11 '22 at 09:47

score 4 · Answer 7 · edited Sep 02 '20 at 22:50

4

First you need to install NGiNX lets encrypt plugin (if you work with NGiNX):

sudo apt install python-certbot-nginx

Then you can safely run:

sudo certbot renew --nginx

and it will work.

Note: certbot should already be installed.

edited Sep 02 '20 at 22:50

user4157124

2,809
13
27
42

answered Aug 29 '20 at 07:29

Raz Buchnik

7,753
14
53
96

score 3 · Answer 8 · answered Jul 13 '17 at 15:46

3

This happened because you used --standalone. The purpose of that option is to launch a temporary webserver because you don't have one running.

Next time use the --webroot method, and you'll be able to use your already running nginx server.

answered Jul 13 '17 at 15:46

Михаил Соснин

31
2

2

copy pasted solutions. from: https://community.letsencrypt.org/t/trying-to-renew-cert-on-nginx-but-getting-problem-binding-to-port-443-could-not-bind-to-ipv4-or-ipv6/36289/3 – MaXi32 Sep 15 '17 at 04:51
@MaXi32 hehe I thought the same. :) – ArchNoob Dec 06 '17 at 05:51

score 1 · Answer 9 · answered Jul 31 '18 at 11:05

1

Borrowing from @JKLIR Simply run

/etc/letsencrypt/letsencrypt-auto renew --apache >> /var/log/letsencrypt/renew.log

to renew the ssl certificate

answered Jul 31 '18 at 11:05

RodneyO

125
1
7

score 1 · Answer 10 · answered Oct 22 '20 at 05:09

I had a similar issue when I was running two websites (hosts) on a single instance. I stopped Nginx and then ran sudo certbot certonly --standalone --preferred-challenges http -d domain.com -d www.domain.com. After restarting Nginx everything started to work fine.

tresf · Answer 11 · 2019-11-20T20:44:11.330

If you're trying to perform the certbot command as a regular user, you may not have access to bind to port 80 and other lower ports. If this is the case, you can grant python access to bind via:

First, see if you can find python 3+ (adjust as needed)
```
echo "$(readlink -f "$(which python3)")"
```

Allow python to open port 80 as a regular user (adjust as needed)

sudo setcap CAP_NET_BIND_SERVICE=+eip "$(readlink -f "$(which python3)")"

Re-run the failing certbot command.

Important: On Ubuntu 18.04, Python is called python3. It may be called a number of different things depending on the OS and how you obtained certbot. This command WILL VARY between OSs.

Warning: These lower ports are restricted for good reason. There are security considerations with the setcap command. You may read more about them here: https://superuser.com/a/892391

score 0 · Answer 12 · answered Oct 12 '20 at 06:51

I use Nginx and needed to stop the server before I can proceed. Then I run the command:

$ sudo ./certbot-auto  certonly --standalone -d chaklader.ddns.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for chaklader.ddns.net
Waiting for verification...
Cleaning up challenges
Subscribe to the EFF mailing list (email: xxx.chakfffder@gmail.com).

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/cdddddder.ddns.net/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/chaklader.ddns.net/privkey.pem
   Your cert will expire on 2045-01-10. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

Letsencrypt renewal fails: Could not bind to IPv4 or IPv6.. Skipping

12 Answers12