So I'm trying to use certbot to get a LetsEncrypt certificate for my wordpress site on EC2 (using the AWS marketplace image by Bitnami, Ubuntu 14.04), but when running certbot --apache I get the following -

Error while running apache2ctl graceful.
httpd not running, trying to start
Action 'graceful' failed.
The Apache error log may have more information.

AH00112: Warning: DocumentRoot [/var/lib/letsencrypt/tls_sni_01_page/] does not exist
AH00112: Warning: DocumentRoot [/var/lib/letsencrypt/tls_sni_01_page/] does not exist
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using Set the 'ServerName' directive globally to suppress this message
(98)Address already in use: AH00072: make_sock: could not bind to address [::]:80
(98)Address already in use: AH00072: make_sock: could not bind to address
no listening sockets available, shutting down
AH00015: Unable to open logs

So there doesn't seem to be anything in the log file. Running service apache2 status gives "apache2 is not running".

I then did

sudo lsof -i :80 | grep LISTEN

which gave me -

httpd.bin 1584   root    4u  IPv6   9463      0t0  TCP *:http (LISTEN)
httpd.bin 1589 daemon    4u  IPv6   9463      0t0  TCP *:http (LISTEN)
httpd.bin 1590 daemon    4u  IPv6   9463      0t0  TCP *:http (LISTEN)
httpd.bin 1773 daemon    4u  IPv6   9463      0t0  TCP *:http (LISTEN)

I got a similar result with

sudo netstat -tulpn | grep :80

which gave me

tcp6       0      0 :::80                   :::*                    LISTEN      1584/httpd.bin  

Making me think that Apache is in fact running, but maybe not the same version or something? Anyone had any experience with a similar problem?


  • I am having the same issue! Did you manage to solve this? – fuzzi May 10 '18 at 2:12

What is your Listen directive set to? If listening to both IPv4 and IPv6 addresses, on Linux, the only way to do so is to use mapped addresses. So that is why it is only showing as listening on IPv6 in netstat. Relevant Apache docs here - https://httpd.apache.org/docs/2.2/bind.html

Now, as to why your certbot run is generating errors. Is Apache being started/stopped/restarted/reloaded via service commands or by calling a script like /etc/init.d/apache2 or using apache2ctl ? Is it being done that way consistently?

Pick one of the methods, stop apache, make sure it is reporting as stopped, restart apache, and see if it reports are being running. Then check the status with the other utilities and see if they agree.

Once the various methods all agree that apache is indeed running, then try running the certbot. Although to be honest I find it fairly trivial to do the certonly option (you'll need to stop apache to do this - certbot/letsencrypt spawns its own listeners on 443/80 as part of its process) and manually add the relevant changes to my apache config file(s)

  • I was going to add an answer but it would have been a rehash of this one. Upvoting it instead. Very often different tools don't agree on how to start a process and they might not "see" a process as started (or stopped) unless they were the ones to start or stop it. This in turn causes all kinds of weird behaviour. If certbot doesn't play safe with the existing tools, just go for --certonly at any suitable moment. – LSerni May 12 '18 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.