Troubleshooting

"Error: too many certificates already issued"
Let's Encrypt enforces a rate limit of 5 duplicate certificates per week per
registered domain. During testing, use the staging API instead:

sudo certbot certonly --staging --standalone -d bng-site-a.example.com -m you@example.com --agree-tos

Staging certificates are not trusted by browsers but allow you to verify the
challenge flow works before using the production API.

"DNS-01 challenge failed — TXT record not found"
DNS propagation can be slow. Wait 60 seconds and retry. If using a provider
with high TTLs or slow propagation (some registrars take several minutes), wait
longer. You can check current propagation with:

dig TXT _acme-challenge.bng-site-a.example.com @8.8.8.8

The token should appear in the output before certbot will succeed.

"Certificate applies but browser still shows the old warning"
The gunicorn reload is immediate, but your browser may be caching the old
certificate. Force a full reload:

  • Chrome / Edge: Ctrl+Shift+R (Windows/Linux) or Cmd+Shift+R (macOS).
  • Firefox: Ctrl+Shift+R or Cmd+Shift+R.

If the warning persists after a hard refresh, confirm gunicorn picked up the new
certificate by checking the cert directly:

openssl s_client -connect <hostname>:8443 -servername <hostname> < /dev/null 
  | openssl x509 -noout -dates

The notAfter date should match the newly issued certificate's expiry.

Need help? Contact support →