About three months ago, we applied for SSL certificate through let s encrypt. Now it's almost the same time. When we boarded the server, we were going to run the certificate update program, but there was a problem when we executed it:

The version of pyOpenSSl is too low. According to some practices on the Internet, we uninstall the lower version of pyOpenSSl, and reinstall the latest version of pyOpenSSl. However, the execution of certbot certificates again still appears:

  ...
  File "/usr/lib/python2.7/site-packages/acme/jose/interfaces.py", line 9, in <module>
    from acme.jose import util
  File "/usr/lib/python2.7/site-packages/acme/jose/util.py", line 5, in <module>
    import OpenSSL
  File "/usr/lib/python2.7/site-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import rand, crypto, SSL
  File "/usr/lib/python2.7/site-packages/OpenSSL/SSL.py", line 118, in <module>
    SSL_ST_INIT = _lib.SSL_ST_INIT
AttributeError: 'module' object has no attribute 'SSL_ST_INIT'

The following reasons are found on the Internet. It seems that Alibaba cloud server is the problem. Other servers don't have this situation, and there are various online solutions. Here, the method of reinstallation before complete uninstallation is adopted:

[root@oldpan etc]# pip uninstall certbot

Previously, I used pip to install, so I used pip to uninstall. If I used apt or rpm to install, I need the corresponding uninstall command.

[root@oldpan etc]# pip install certbot
 ...
[root@oldpan etc]# certbot certificates
Traceback (most recent call last):
  File "/usr/bin/certbot", line 7, in <module>
    from certbot.main import main
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 11, in <module>
    from acme import jose

[root@oldpan etc]# pip uninstall acme
Uninstalling acme-0.20.0:
  /usr/lib/python2.7/site-packages/acme-0.20.0.dist-info/DESCRIPTION.rst
  /usr/lib/python2.7/site-packages/acme-0.20.0.dist-info/INSTALLER
  /usr/lib/python2.7/site-packages/acme-0.20.0.dist-info/METADATA
  /usr/lib/python2.7/site-packages/acme-0.20.0.dist-info/RECORD
  /usr/lib/python2.7/site-packages/acme-0.20.0.dist-info/WHEEL
  /usr/lib/python2.7/site-packages/acme-0.20.0.dist-info/entry_points.txt
  /usr/lib/python2.7/site-packages/acme-0.20.0.dist-info/metadata.json
  /usr/lib/python2.7/site-packages/acme-0.20.0.dist-info/top_level.txt
Proceed (y/n)? y
  Successfully uninstalled acme-0.20.0

[root@oldpan etc]# pip install acme
 ...
/usr/lib/python2.7/site-packages (from cffi>=1.7; platform_python_
implementation != "PyPy"->cryptography>=0.8->acme)
Installing collected packages: acme
Successfully installed acme-0.20.0

[root@oldpan etc]# certbot certificates
/usr/lib/python2.7/site-packages/requests/__init__.py:80: RequestsDependencyWarning: urllib3 (1.22) or chardet
 (2.2.1) doesn't match a supported version!
  RequestsDependencyWarning)
Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Found the following certs:
  Certificate Name: oldpan.me
    Domains: oldpan.me www.oldpan.me
    Expiry Date: 2018-01-19 04:08:01+00:00 (VALID: 6 days)
    Certificate Path: /etc/letsencrypt/live/oldpan.me/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/oldpan.me/privkey.pem
-------------------------------------------------------------------------------

It's OK to verify again. Note that port 80 is required to communicate with the intermediate server when the certificate is reactivated. If the website is not allowed to run at this time, it's OK to temporarily close the website, update the certificate, and then open the website.