/ Register

Discover Centmin Mod today
Register Now

Letsencrypt Changing from staging to live cert

Discussion in 'Domains, DNS, Email & SSL Certificates' started by duderuud, Apr 21, 2021.

Previous Thread Next Thread
Loading...
  1. Apr 21, 2021 #1
    duderuud

    duderuud Active Member

    318
    97
    28
    Dec 5, 2020
    The Netherlands
    Ratings:
    +215
    Local Time:
    7:53 AM
    1.29 x
    11.4
    I recently changed the webserver host and had troubles getting a live LE certificate working with Cloudflare.

    I now got it working with a staging certificate (afaik) and the CF setting to Full (instead of Full strict).

    I'm struggling to change the staging cert to a live cert so I can change the CF setting back to Full strict.

    I tried to use acmetool.sh acme-menu to issue a Live HTTPS Default certificate but that returns a "domain not changed/skipped" error so it seems the staging certificate is in the way of a live certificate.

    Do I somehow need to force a reissue of a live certificate?
     
  2. Apr 22, 2021 #2
    eva2000

    eva2000 Administrator Staff Member

    58,905
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    3:53 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    how did you issue the staging Letsencrypt SSL cert ? exact steps and/or commands used ? if it was manual acme.sh run, you can try with --force flag
     
  3. Apr 22, 2021 #3
    duderuud

    duderuud Active Member

    318
    97
    28
    Dec 5, 2020
    The Netherlands
    Ratings:
    +215
    Local Time:
    7:53 AM
    1.29 x
    11.4
    No, I used the add new vhost option in the main menu.
    (Deleted the vhost after issuing a live cert failed and started again).
     
  4. Apr 23, 2021 #4
    eva2000

    eva2000 Administrator Staff Member

    58,905
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    3:53 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    In that case, try acmetool.sh add reissue-only option for existing nginx HTTPS SSL vhosts with domain.com.ssl.conf vhost config files that exist. This only does reissue of letsencrypt SSL cert without touching the nginx vhost. Ideal for use when you tried creating a Nginx HTTPS SSL default vhost site but letsencrypt SSL issuance failed the first time. When it fails, Centmin Mod usually falls back to self-signed SSL as a place holder for the domain.com.ssl.conf vhost config. Though haven't tested it for staging Letsencrypt only self-signed SSL, but I think it would work the same.

    When you run:
    Code (Text):
    cd /usr/local/src/centminmod/addons
./acmetool.sh reissue-only domain.com live

    It will only try reissuing the letsencrypt SSL certificate for the domain = domain.com for live production SSL certificate without touching any of the existing nginx vhost at domain.com.ssl.conf
     
  5. Apr 23, 2021 #5
    duderuud

    duderuud Active Member

    318
    97
    28
    Dec 5, 2020
    The Netherlands
    Ratings:
    +215
    Local Time:
    7:53 AM
    1.29 x
    11.4
    The reissue worked like a charme. I just had to restart Nginx to get rid of the CF certificate error.

    Thanks!
     
  6. Apr 23, 2021 #6
    eva2000

    eva2000 Administrator Staff Member

    58,905
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    3:53 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Great to hear :D
     
Previous Thread Next Thread
Loading...

.