Acme Certs are Not Renewing - Again in 26.03.r.20260317.0210_RC

PatRyan

I'm running 26.03.r.20260317.0210_RC

The automatic renewal is not running correctly. The following is the log of the acme manual renewal (domain name renamed in the text)

MyDomain
Renewing certificate
account: MyDomain
server: letsencrypt-production-2

/usr/local/pkg/acme/acme.sh --issue --domain 'MyDomain.xx' --dns 'dns_dreamhost' --domain '.MyDomain.xx' --dns 'dns_dreamhost' --domain 'MyDomain.xx' --dns 'dns_dreamhost' --domain '.MyDomain.xx' --dns 'dns_dreamhost' --home '' --accountconf '/tmp/acme/MyDomain/accountconf.conf' --force --always-force-new-domain-key --reloadCmd 'reloadcmd.sh' --log-level 3 --log 'acme_issuecert.log'
Array
(
[path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[SSL_CERT_DIR] => /etc/ssl/certs/
[DH_API_KEY] => 97CC73NTMVZWHHTL
)
[Sun Mar 22 23:42:32 PDT 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Sun Mar 22 23:42:32 PDT 2026] Using pre-generated key: /.acme.sh/MyDomain.xx/MyDomain.xx.key.next
[Sun Mar 22 23:42:32 PDT 2026] Generating next pre-generate key.
[Sun Mar 22 23:42:32 PDT 2026] Multi domain='DNS:MyDomain.xx,DNS:.MyDomain.xx,DNS:MyDomain.xx,DNS:.MyDomain.xx'
[Sun Mar 22 23:42:35 PDT 2026] Getting webroot for domain='MyDomain.xx'
[Sun Mar 22 23:42:35 PDT 2026] Getting webroot for domain='.MyDomain.xx'
[Sun Mar 22 23:42:35 PDT 2026] Getting webroot for domain='MyOtherDomain.xx'
[Sun Mar 22 23:42:36 PDT 2026] Getting webroot for domain='. MyOtherDomain.xx '
[Sun Mar 22 23:42:36 PDT 2026] MyDomain.xx is already verified, skipping dns-01.
[Sun Mar 22 23:42:36 PDT 2026] *.MyDomain.xx is already verified, skipping dns-01.
[Sun Mar 22 23:42:36 PDT 2026] MyOtherDomain.xx is already verified, skipping dns-01.
[Sun Mar 22 23:42:36 PDT 2026] *. MyOtherDomain.xx is already verified, skipping dns-01.
[Sun Mar 22 23:42:36 PDT 2026] Verification finished, beginning signing.
[Sun Mar 22 23:42:36 PDT 2026] Let's finalize the order.
[Sun Mar 22 23:42:36 PDT 2026] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/2777491981/493379754501'
[Sun Mar 22 23:42:38 PDT 2026] Downloading cert.
[Sun Mar 22 23:42:38 PDT 2026] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/06bd2508bd874f48c9122cee584b13b21fad'
[Sun Mar 22 23:42:39 PDT 2026] Cert success.
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

[Sun Mar 22 23:42:39 PDT 2026] Your cert is in: /.acme.sh/MyDomain.xx/MyDomain.xx.cer
[Sun Mar 22 23:42:39 PDT 2026] Your cert key is in: /.acme.sh/MyDomain.xx/MyDomain.xx.key
[Sun Mar 22 23:42:39 PDT 2026] The intermediate CA cert is in: /.acme.sh/MyDomain.xx/ca.cer
[Sun Mar 22 23:42:39 PDT 2026] And the full-chain cert is in: /.acme.sh/MyDomain.xx/fullchain.cer
[Sun Mar 22 23:42:39 PDT 2026] Your pre-generated key for future cert key changes is in: /.acme.sh/MyDomain.xx/MyDomain.xx.key.next
[Sun Mar 22 23:42:39 PDT 2026] Running reload cmd: reloadcmd.sh eval: reloadcmd.sh: not found
[Sun Mar 22 23:42:39 PDT 2026] Reload error for: MyDomain.xx

There was a patch file that fixed this problem when it occurred in 25.11. This seemed to have been fixed but has returned with this RC.

Gertjan

@PatRyan

Like you, my challenge was still valid, so renewal took the short cut :

V2_bhf.tld
Renewing certificate 
account: V2_bhf.tld 
server: letsencrypt-production-2 

/usr/local/pkg/acme/acme.sh  --issue  --domain 'bhf.tld' --dns 'dns_nsupdate'  --domain '*.bhf.tld' --dns 'dns_nsupdate'  --home '/tmp/acme/V2_bhf.tld/' --accountconf '/tmp/acme/V2_bhf.tld/accountconf.conf' --force --always-force-new-domain-key --reloadCmd '/tmp/acme/V2_bhf.tld/reloadcmd.sh' --dnssleep '120' --log-level 3 --log '/tmp/acme/V2_bhf.tld/acme_issuecert.log'
Array
(
    [path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
    [PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
    [SSL_CERT_DIR] => /etc/ssl/certs/
    [NSUPDATE_SERVER] => /tmp/acme/V2_bhf.tld/bhf.tldnsupdate
    [NSUPDATE_KEYNAME] => update
    [NSUPDATE_KEYALGO] => 165
    [NSUPDATE_KEY] => /tmp/acme/V2_bhf.tld/bhf.tldnsupdate
    [NSUPDATE_ZONE] => bhf.tld
)
[Mon Mar 23 08:19:08 CET 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Mon Mar 23 08:19:09 CET 2026] Registering account: https://acme-v02.api.letsencrypt.org/directory
[Mon Mar 23 08:19:10 CET 2026] Already registered
[Mon Mar 23 08:19:10 CET 2026] ACCOUNT_THUMBPRINT='PeytXQsPkEceYAR-EuMNTi2YZSlVOL3elQBM35eLgdk'
[Mon Mar 23 08:19:10 CET 2026] Using pre-generated key: /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key.next
[Mon Mar 23 08:19:10 CET 2026] Generating next pre-generate key.
[Mon Mar 23 08:19:10 CET 2026] Multi domain='DNS:bhf.tld,DNS:*.bhf.tld'
[Mon Mar 23 08:19:12 CET 2026] Getting webroot for domain='bhf.tld'
[Mon Mar 23 08:19:13 CET 2026] Getting webroot for domain='*.bhf.tld'
[Mon Mar 23 08:19:13 CET 2026] bhf.tld is already verified, skipping dns-01.
[Mon Mar 23 08:19:13 CET 2026] *.bhf.tld is already verified, skipping dns-01.
[Mon Mar 23 08:19:13 CET 2026] Verification finished, beginning signing.
[Mon Mar 23 08:19:13 CET 2026] Let's finalize the order.
[Mon Mar 23 08:19:13 CET 2026] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/3014454136/493388472841'
[Mon Mar 23 08:19:15 CET 2026] Downloading cert.
[Mon Mar 23 08:19:15 CET 2026] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/06abfe80bb1d434cac4626288b9bd6a07137'
[Mon Mar 23 08:19:16 CET 2026] Cert success.
-----BEGIN CERTIFICATE-----
MIIFEzCCA/ugAwIBAgISBqv+gLsdQ0ysRiYoi5vWoHE3MA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
......
9G6czgghzpvBovndMOzjt6CfCCLR7cIOL+snnBAozBBJmfR4gCRMJMaRVP/UWrcw
mT28jk4I9LCITO6ujVh8JtE5EaVWw/doCztWSw7BxrCYmvoCA89Xqbc1lxQcHvnD
LG++YLs77A==
-----END CERTIFICATE-----
[Mon Mar 23 08:19:16 CET 2026] Your cert is in: /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.cer
[Mon Mar 23 08:19:16 CET 2026] Your cert key is in: /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key
[Mon Mar 23 08:19:16 CET 2026] The intermediate CA cert is in: /tmp/acme/V2_bhf.tld/bhf.tld/ca.cer
[Mon Mar 23 08:19:16 CET 2026] And the full-chain cert is in: /tmp/acme/V2_bhf.tld/bhf.tld/fullchain.cer
[Mon Mar 23 08:19:16 CET 2026] Your pre-generated key for future cert key changes is in: /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key.next
[Mon Mar 23 08:19:16 CET 2026] Running reload cmd: /tmp/acme/V2_bhf.tld/reloadcmd.sh

IMPORT CERT V2_bhf.tld, /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key, /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.cer
update cert![Mon Mar 23 08:19:17 CET 2026] Reload successful

And that's a pass.

It looks like the (your) file /tmp/acme/bhf.tld/reloadcmd.sh could be created ? At least, it should be there, because that's the 'command' to import the created certificate into the pfSense certificate GUI storage.

Instead of "bhf.tld" you should have your domain name.

It contains one line :
For me :

usr/local/pkg/acme/acme_command.sh importcert "V2_bhf.tld" "bhf.tld" "/tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key" "/tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.cer" "/tmp/acme/V2_bhf.tld/bhf.tld/ca.cer" "/tmp/acme/V2_bhf.tld/bhf.tld/fullchain.cer"