Lightsail bncert-tool fails certificate creation

This is a common issue with the Bitnami certificate tool (bncert-tool) when dealing with expired certificates that include domains you no longer own.

To resolve this issue, you can try the following steps:

1. First, back up your current SSL configuration files:

sudo cp /opt/bitnami/apache2/conf/server.crt /opt/bitnami/apache2/conf/server.crt.bak
sudo cp /opt/bitnami/apache2/conf/server.key /opt/bitnami/apache2/conf/server.key.bak
sudo cp /opt/bitnami/apache2/conf/server-ca.crt /opt/bitnami/apache2/conf/server-ca.crt.bak

2. Try resetting the certificates by following Bitnami's "Resetting the certificates" procedure, which should allow you to run the bncert-tool again as if it were a fresh installation.

3. If the bncert-tool still fails, you might want to consider using Certbot directly for more control over your Let's Encrypt certificates. This approach can bypass the limitations of the bncert-tool.

4. Another option is to use the "Set up your website" tool in Lightsail, which can install certificates for your WordPress site and might handle this situation better than the bncert-tool.

5. If you're using Cloudflare for DNS management, check if there are any CAA records that might be preventing new certificate issuance. Cloudflare sometimes adds these automatically, which can block other Certificate Authorities from issuing certificates.

Remember to always back up your WordPress installation and database before making significant changes to your SSL configuration. If these steps don't resolve your issue, you may need to contact AWS support for further assistance with your specific situation.
Sources
Replacing a TSL certificate on LightSail | AWS re:Post
Lightsail Certificates: Certificate validation always fails with external DNS managed by Cloudflare | AWS re:Post
LightSail: Bitnami bncert-tool succeeds but TLS cert was revoked | AWS re:Post