Acme Certs are Not Renewing - Again in 26.03.r.20260317.0210_RC

PatRyan

I'm running 26.03.r.20260317.0210_RC

The automatic renewal is not running correctly. The following is the log of the acme manual renewal (domain name renamed in the text)

MyDomain
Renewing certificate
account: MyDomain
server: letsencrypt-production-2

/usr/local/pkg/acme/acme.sh --issue --domain 'MyDomain.xx' --dns 'dns_dreamhost' --domain '.MyDomain.xx' --dns 'dns_dreamhost' --domain 'MyDomain.xx' --dns 'dns_dreamhost' --domain '.MyDomain.xx' --dns 'dns_dreamhost' --home '' --accountconf '/tmp/acme/MyDomain/accountconf.conf' --force --always-force-new-domain-key --reloadCmd 'reloadcmd.sh' --log-level 3 --log 'acme_issuecert.log'
Array
(
[path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[SSL_CERT_DIR] => /etc/ssl/certs/
[DH_API_KEY] => 97CC73NTMVZWHHTL
)
[Sun Mar 22 23:42:32 PDT 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Sun Mar 22 23:42:32 PDT 2026] Using pre-generated key: /.acme.sh/MyDomain.xx/MyDomain.xx.key.next
[Sun Mar 22 23:42:32 PDT 2026] Generating next pre-generate key.
[Sun Mar 22 23:42:32 PDT 2026] Multi domain='DNS:MyDomain.xx,DNS:.MyDomain.xx,DNS:MyDomain.xx,DNS:.MyDomain.xx'
[Sun Mar 22 23:42:35 PDT 2026] Getting webroot for domain='MyDomain.xx'
[Sun Mar 22 23:42:35 PDT 2026] Getting webroot for domain='.MyDomain.xx'
[Sun Mar 22 23:42:35 PDT 2026] Getting webroot for domain='MyOtherDomain.xx'
[Sun Mar 22 23:42:36 PDT 2026] Getting webroot for domain='. MyOtherDomain.xx '
[Sun Mar 22 23:42:36 PDT 2026] MyDomain.xx is already verified, skipping dns-01.
[Sun Mar 22 23:42:36 PDT 2026] *.MyDomain.xx is already verified, skipping dns-01.
[Sun Mar 22 23:42:36 PDT 2026] MyOtherDomain.xx is already verified, skipping dns-01.
[Sun Mar 22 23:42:36 PDT 2026] *. MyOtherDomain.xx is already verified, skipping dns-01.
[Sun Mar 22 23:42:36 PDT 2026] Verification finished, beginning signing.
[Sun Mar 22 23:42:36 PDT 2026] Let's finalize the order.
[Sun Mar 22 23:42:36 PDT 2026] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/2777491981/493379754501'
[Sun Mar 22 23:42:38 PDT 2026] Downloading cert.
[Sun Mar 22 23:42:38 PDT 2026] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/06bd2508bd874f48c9122cee584b13b21fad'
[Sun Mar 22 23:42:39 PDT 2026] Cert success.
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

[Sun Mar 22 23:42:39 PDT 2026] Your cert is in: /.acme.sh/MyDomain.xx/MyDomain.xx.cer
[Sun Mar 22 23:42:39 PDT 2026] Your cert key is in: /.acme.sh/MyDomain.xx/MyDomain.xx.key
[Sun Mar 22 23:42:39 PDT 2026] The intermediate CA cert is in: /.acme.sh/MyDomain.xx/ca.cer
[Sun Mar 22 23:42:39 PDT 2026] And the full-chain cert is in: /.acme.sh/MyDomain.xx/fullchain.cer
[Sun Mar 22 23:42:39 PDT 2026] Your pre-generated key for future cert key changes is in: /.acme.sh/MyDomain.xx/MyDomain.xx.key.next
[Sun Mar 22 23:42:39 PDT 2026] Running reload cmd: reloadcmd.sh eval: reloadcmd.sh: not found
[Sun Mar 22 23:42:39 PDT 2026] Reload error for: MyDomain.xx

There was a patch file that fixed this problem when it occurred in 25.11. This seemed to have been fixed but has returned with this RC.

Gertjan

@PatRyan

Yeah, true. Your other post was posted below 25.x.

marcosm

Are you able to reproduce it each time? If so does it still happen if you uninstall/install (not reinstall) the package (you can make a quick BE to roll back and retest things)?

PatRyan

@marcosm yes I did try to uninstall acme and reinstall it. Same result.

A bit difficult to test because acme limits the frequency that they will issue a renewal. So make a change and I have to wait at least 24 hours before trying again.

I still have the system patch I used with 25.11. I plan to try that tonight when my time window opens. I’ll report back with the result.

PatRyan

The system patch worked fine. Certificate renewed.

If anyone is looking for the patch see https://forum.netgate.com/post/1230050

marcosm

To be clear the patch does not need to be reverted before or after upgrading the system or package. The latest version already includes the fix and reverting it would simply re-introduce the bug. The patch may simply be deleted once on the newer package version.

PatRyan

@marcosm I may indeed have reverted the patch and therefore introduced the bug. That would explain why others have not come across this as an issue.

I know that I "cleaned up" a few things recently and one of them was to delete the patch. I bet I hit Revert prior to also hitting Delete.

Odd that uninstalling acme and then reinstalling it didn't seem to fix it but reinstalling the patch did the trick.

Much appreciate your help.