Category Archives: Howto Tutorials (EN)

Howto Tutorials English contribution. Howto’s and tutorials, technical workaround, DevOps Code for Professionals.

WARNING: recursion requested but not available

you mey get the following warning when trying to query with dig:

; <<>> DiG 9.16.37-Debian <<>> domain.tld
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: FORMERR, id: 34429
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

DIG sends DNS COOKIE option, this option is enabled by default starting with BIND 9.11. Unfortunately, the query with this option means that the DNS server, often older Windows DNS servers, treats the request as incorrect, or does not understand the query, which means that the request is rejected.

A workaround can be to pass the+nocookieor+noedn to disable the EDNS option.

$ dig domain.tld +nocookie

How to Check Lets Encrypt Certificate expiration date

When using Let’s Encrypt certificates, which are provided via the ACME protocol by the ACME client software, known as Certbot for Linux operating systems, it is intended that the certificates must be renewed every 90 days before they expire.

Many of us are familiar with the e-mail: Let’s Encrypt certificate expiration notice for domain.

Your certificate (or certificates) for the names listed below will expire in 20 days (on 31 Mar 23 08:33 +0000). Please make sure to renew your certificate before then, or visitors to your web site will encounter errors.

We recommend renewing certificates automatically when they have a third of their total lifetime left. For Let’s Encrypt’s current 90-day certificates, that means renewing 30 days before expiration. See for details.

So let’s see the options, using commands in examples, to get the expiry date of Let’s Encrypt certificates to renew them in time for our myhost server before they expire and become invalid.

Check Certificates Expiry Date

To view a list of the certificates Certbot knows about, run the certificates subcommand in the terminal shell:

$ sudo certbot certificates

This returns details similar as follows, along with the Expiry Date:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name:
    Expiry Date: 2023-03-26 08:39:39+00:00 (VALID: 14 days)
    Certificate Path: /etc/letsencrypt/live/
    Private Key Path: /etc/letsencrypt/live/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Let’s see how the expiry date of any certificate can be queried, so not just only Let’s Encrypt certificates.

$ sudo openssl x509 -dates -noout < /etc/letsencrypt/live/

This command, running in a Linux terminal, displays the expiration date of each certificate, according to the ITU-T standard specifications for X.509 digital certificates.

Renew your Let’s Encrypt Certificates

The Let’s Encrypt certificates can be renewed before they expire using this command.

$ sudo certbot renew

Here the Let’s Encrypt certificate is only renewed for the domain and it’s hostname, using the apache2 webserver.

$ sudo certbot --apache -d -d

The Let’s Encrypt certificate should only be renewed for the hostname, e.g. using various services such as an SMTP mail transport agent that uses starttls.

$ sudo certbot --standalone certonly -d