# Why is tryton not using renewed ssl certificate?
**URL:** https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335
**Category:** System Administrator
**Created:** [October 8, 2020, 3:41pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335 "2020-10-08T15:41:40Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@smoothsg](https://discuss.tryton.org/u/smoothsg)
#### Post date: [October 8, 2020, 3:41pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/1 "2020-10-08T15:41:41Z")
Hello guys,
The website in question has used the ssl certificate for months. Lately, the ssl certificate was renewed before expiration and the main website (on port 80) was using the renewed certificate without a hiccup but Tryton on port 8000 was giving warning about the site’s ssl certificate being expired, showing error like Certificate error! There is a problem with this website’s security certificate. Certificate expired on 5/10/2020!
The certificate is not expired, was not allowed to expire before renewal took place, I have not changed Tryton configuration and database looks good still. I have restarted Tryton but the error continues to show on website.
Server is a gnuhealth 4.3.2, SAO on Opensuse leap 15.1.
How can I make Tryton use the renewed ssl certificate?
I will appreciate your help,
Thank you.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [October 8, 2020, 3:54pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/2 "2020-10-08T15:54:34Z")
> [@smoothsg](#):
>
> Server is a gnuhealth 4.3.2
This does not tell us which version of Tryton it is.
> [@smoothsg](#):
>
> How can I make Tryton use the renewed ssl certificate?
It depends which process is actually doing the SSL. If it is `trytond` (which is not [recommended](https://docs.tryton.org/projects/server/en/latest/topics/configuration.html#ssl)) you just have to restart the process. If it is the proxy, you have to reload/restart it.
---
### Author:  [@smoothsg](https://discuss.tryton.org/u/smoothsg)
#### Post date: [October 8, 2020, 4:37pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/3 "2020-10-08T16:37:41Z")
> [@ced](#):
>
> > [@smoothsg](#):
> >
> > Server is a gnuhealth 4.3.2
>
> This does not tell us which version of Tryton it is.
trytond 5.0.23.
> [@ced](#):
>
> It depends which process is actually doing the SSL. If it is `trytond` (which is not [recommended](https://docs.tryton.org/projects/server/en/latest/topics/configuration.html#ssl)) you just have to restart the process. If it is the proxy, you have to reload/restart it.
Not a proxy. I restarted gnuhealth, got no joy, restarted the machine, still no joy!
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [October 8, 2020, 4:40pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/4 "2020-10-08T16:40:26Z")
> [@smoothsg](#):
>
> Not a proxy. I restarted gnuhealth, got no joy, restarted the machine, still no joy!
Then probably the configuration is pointing the the old certificate.
---
### Author:  [@smoothsg](https://discuss.tryton.org/u/smoothsg)
#### Post date: [October 9, 2020, 5:00pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/5 "2020-10-09T17:00:54Z")
Well related lines in the configuration are like:
certificate = /etc/letsencrypt/live/www.smoothgift.com/fullchain.pem
privatekey = /etc/letsencrypt/live/www.smoothgift.com/privkey.pem
When fullchain.pem in /etc/letsencrypt/live/www.smoothgift.com/ is viewed ( with openssl) the “not after” date is Oct 3 (expired) but the certificate in /etc/letsencrypt/live/smoothgift.com/fullchain.pem is valid till Dec 5. This means technically that Cerbot saved renewed certificates in the /etc/letsencrypt/live/smoothgift.com/ directory and not in the /etc/letsencrypt/live/www.smoothgift.com/ despite the fact that renewal was made for both [www.smoothgift.com](http://www.smoothgift.com) and [smoothgift.com](http://smoothgift.com).
That should be no problem by right as I would have just needed to change Tryton config line to e.g. certificate = /etc/letsencrypt/live/smoothgift.com/ because the certificates there are valid. But if I change Tryton config to certificate = /etc/letsencrypt/live/smoothgift.com/ Tryton refuses to load and leaves me no message in the log or status. And if I leave the config line as certificate = /etc/letsencrypt/live/www.smoothgift.com/ Tryton displays invalid certificate warning in the browser. [smoothgift.com](http://smoothgift.com) (also using apache) displays all good using /etc/letsencrypt/live/www.smoothgift.com/. Why is [smoothgift.com](http://smoothgift.com) not complaining?
Why is Tryton behaving this way? otherwise what 'am I missing?
Many thanks again!
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [October 9, 2020, 5:04pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/6 "2020-10-09T17:04:23Z")
> [@smoothsg](#):
>
> But if I change Tryton config to certificate = /etc/letsencrypt/live/smoothgift.com/ Tryton refuses to load and leaves me no message in the log or status.
The user probably does not have the right to read them.
---
### Author:  [@smoothsg](https://discuss.tryton.org/u/smoothsg)
#### Post date: [October 10, 2020, 11:16am UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/7 "2020-10-10T11:16:16Z")
> [@ced](#):
>
> The user probably does not have the right to read them.
But the directory has file permission 755 and files have 777 already which is why I guess other users have no problem reading them.
How do you advise I approach this, give tryton user specific access to the directory? create a tryon group and then give them read access to the directory? or something else? given OS is Opensuse. Thanks.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [October 10, 2020, 2:28pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/8 "2020-10-10T14:28:16Z")
If you change de `certficate` you must change also the `privatekey`.
---
### Author:  [@smoothsg](https://discuss.tryton.org/u/smoothsg)
#### Post date: [October 10, 2020, 2:38pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/9 "2020-10-10T14:38:51Z")
I don’t understand what you mean here Ced. I thought you were talking about user permission
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [October 10, 2020, 8:32pm UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/10 "2020-10-10T20:32:01Z")
Previously you said that you changed the `certficate` and it did not work and as you said the the permission on the certificate are correct. I suppose that you did not update the `privatekey` path.
---
### Author:  [@smoothsg](https://discuss.tryton.org/u/smoothsg)
#### Post date: [October 12, 2020, 9:46am UTC](https://discuss.tryton.org/t/why-is-tryton-not-using-renewed-ssl-certificate/3335/11 "2020-10-12T09:46:46Z")
Both certs and key are usually saved in the same directory by certbot and both are correctly in listed/updated in Tryton config.
So back to user Tryton probable inability to access the directory. How do I give user Tryton the access right needed (suitable to Tryton) as asked earlier above? Thanks Ced.