lego keeps trying to renew a removed domain

[marekyggdrasil]

Dear Lego Community,

This is nearly a copy paste from this issue as I was redirected here.

I usually renew my certificate as follows

sudo /opt/bitnami/letsencrypt/lego --path /opt/bitnami/letsencrypt --email="MYEMAIL" --http --http-timeout 30 --http.webroot /opt/bitnami/apps/letsencrypt --domains="DOMAIN1" --domains="DOMAIN3" renew

where MYEMAIL is the email address and DOMAIN1 and DOMAIN3 are my domains. Recently I decided to get rid of one of my domains thus its DNS records no longer point to this server.

Problem is, lego script fails to renew the remaining domains because of this, it appears to ignore the --domains= argument and just tries to renew everything.

2022/11/04 07:54:54 [INFO] [DOMAIN1] acme: Trying renewal with -35 hours remaining
2022/11/04 07:54:54 [INFO] [DOMAIN1, DOMAIN2, DOMAIN3] acme: Obtaining bundled SAN certificate
2022/11/04 07:54:55 [INFO] [DOMAIN1] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/171998926657
2022/11/04 07:54:55 [INFO] [DOMAIN2] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/170566293892
2022/11/04 07:54:55 [INFO] [DOMAIN3] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/172211732877
2022/11/04 07:54:55 [INFO] [DOMAIN1] acme: authorization already valid; skipping challenge
2022/11/04 07:54:55 [INFO] [DOMAIN3] acme: authorization already valid; skipping challenge
2022/11/04 07:54:55 [INFO] [DOMAIN2] acme: Could not find solver for: tls-alpn-01
2022/11/04 07:54:55 [INFO] [DOMAIN2] acme: use http-01 solver
2022/11/04 07:54:55 [INFO] [DOMAIN2] acme: Trying to solve HTTP-01

in the output above DOMAIN2 still appears while I would expect there to be only the DOMAIN1 and DOMAIN3 as these are the values provided with --domains= arguments.

How does lego script know about DOMAIN2? What I tried:

1. I checked directory trees rooted in /opt/bitnami/apps/letsencrypt and /opt/bitnami/letsencrypt and I could not find domains list.
2. I checked $DOMAINS and $DOMAIN environmental variables, empty.
3. I disabled SSL in Apache vhosts and in /opt/bitnami/apache/conf/bitnami/bitnami-ssl.conf in case if lego script takes list from there.
4. I tried to remove the certificates from /opt/bitnami/letsencrypt/certificates/ and /opt/bitnami/letsencrypt/archive in case if list of domains is taken from the file names.
5. I tried running /opt/bitnami/bncert-tool once again without mentioning this DOMAIN2 but lego still remembers it.
6. I found some tutorials mentioning running ./certbot and ./certbot-auto but my bitnami instnace on AWS Lightsail does not seem to have certbot installed, it seems to only have bncert-tool and lego script.

I'm out of ideas how to make lego script forget about DOMAIN2, I would prefer not to buy it again just to set the A record and let the script pass for my remaining domains.

[ldez]

Hello,

When you create a certificate and pass several domains to the command line, lego will basically create one certificate that handles all your domains.

When you try to renew, lego will find the certificate related to your domain, this certificate contains several domains, and lego will extract and use those domains during the renewal.

So you have to remove your previous certificate.

[marekyggdrasil]

I followed your advice, here are the steps

Create directories to temporary move the certificates

mkdir dummy-certs/archive
mkdir dummy-certs/certificates

move them

sudo mv /opt/bitnami/letsencrypt/certificates/* /home/bitnami/dummy-certs/certificates
sudo mv /opt/bitnami/letsencrypt/archives/* /home/bitnami/dummy-certs/archives

generate new ones

sudo /opt/bitnami/letsencrypt/lego --path /opt/bitnami/letsencrypt --email="EMAIL" --http --http-timeout 30 --http.webroot /opt/bitnami/apps/letsencrypt --domains="DOMAIN1" run

and

sudo /opt/bitnami/letsencrypt/lego --path /opt/bitnami/letsencrypt --email="EMAIL" --http --http-timeout 30 --http.webroot /opt/bitnami/apps/letsencrypt --domains="DOMAIN3" run

then important to remove the virtualhost that was using the removed domain from the apache configuration /opt/bitnami/apache/conf/bitnami/bitnami-ssl.conf and restart the apache

sudo /opt/bitnami/ctlscript.sh restart apache

and it worked!

[marekyggdrasil]

I did try to remove before but instead of run I did renew again and that is the reason why it did not work.