acmetool.sh issue certificate without www. subject alternative name

by default entering domain.com will auto add www version too so no need to do anything else

 

First try running your intended SSL certificate domain through the letsdebug.net online testing tool to check for potential errors with HTTP-01 validation. If you created Centmin Mod 123.09beta01 or higher Nginx site with Letsencrypt via centmin.sh menu option 2, 22 or nv command line, you now also have an automatic letsdebug.net API check log saved at /root/centminlogs/letsdebug-yourdomain.com-${DT}.log where yourdomain.com is domain specified during nginx vhost creation and DT is date/timestamp. Inspecting the /root/centminlogs/letsdebug-yourdomain.com-${DT}.log log will also give you clues as to why letsencrypt SSL certificate issuance failed.

How was the initial letsencrypt ssl certificate obtained ? Which method ?

• Was the domain nginx vhost alreadying created prior or new domain nginx vhost site setup for first time ?
• Via centmin.sh menu option 2, 22, /usr/bin/nv ?
• If you ran centmin.sh menu option 2 or 22, which letsencrypt option did you select from
  Code (Text):

  -------------------------------------------------------------
  Setup full Nginx vhost + Wordpress + WP Plugins
  -------------------------------------------------------------
  
  Enter vhost domain name you want to add (without www. prefix): acme3.domain1.com
  
  Create a self-signed SSL certificate Nginx vhost? [y/n]: n
  Get Letsencrypt SSL certificate Nginx vhost? [y/n]: y
  
  You have 4 options:
  1. issue staging test cert with HTTP + HTTPS
  2. issue staging test cert with HTTPS default
  3. issue live cert with HTTP + HTTPS
  4. issue live cert with HTTPS default
  Enter option number 1-4: 1
  

• Via addons/acmetool.sh ? which specific command ? examples
  Code (Text):

  ./acmetool.sh issue acme.domain.com
  

  Code (Text):

  ./acmetool.sh issue acme.domain.com live
  

  Code (Text):

  ./acmetool.sh issue acme.domain.com d
  

  Code (Text):

  ./acmetool.sh issue acme.domain.com lived
  

• What was order of steps you did ? Did you run centmin.sh menu option 2 first with letsencrypt ? Then did you run addons/acmetool.sh afterwards ?

Troubleshooting

There are various steps you can do to troubleshoot letsencrypt issuances, renews, reissues etc.

• acmetool.sh logs all command line or shell menu runs to log files at /root/centminlogs. To troubleshoot, copy the contents of the log run and post contents of log to pastebin.com or gist.github.com and share link in this thread. To find the log list the logs in ascending date order
  Code (Text):

  ls -lahrt /root/centminlogs

  .
• You can also do a quick grep filter on all previous and current acmetool.sh runs of the underlying acme.sh client for errors listed in errordetails field of each log using the command below:
  Code (Text):

  find /root/centminlogs/ -type f -name 'acme*.log' -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n' | sort | awk '{print $3}' | xargs -d '\n' grep -i 'errordetail'
  

• For direct acmetool.sh runs, there should be a 2nd & 3rd & 4th log in format /root/centminlogs/centminmod_${DT}_nginx_addvhost_nv.log and /root/centminlogs/acmetool.sh-debug-log-$DT.log and /root/centminlogs/acmesh-issue_*.log or /root/centminlogs/acmesh-reissue_*.log which would need to be included via separate pastebin.com or gist.github.com post.
• Enable acmetool.sh debug mode. In persistent config file at /etc/centminmod/custom_config.inc (create it if doesn't exist) add and enable acmetool.sh debug mode which gives much more verbose letsencrypt issuance process information when you re-run acmetool.sh or centmin.sh menu options 2, 22 or /usr/bin/nv command lines.
  
  Code (Text):

  ACMEDEBUG='y'

If acme.sh auto renewals didn't happen, check output for the following commands

Code (Text):

grep acme /var/log/cron* | sed -e "s|$(hostname -s)|host|g"

Code (Text):

echo y | /usr/local/src/centminmod/addons/acmetool.sh checkdates

Code (Text):

"/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh"

Code (Text):

echo | openssl s_client -connect yourdomain.com:443

Without the answers to above questions and logs, there is nothing to help troubleshoot.

SSLLabs Test

Also run your HTTPS domain site through SSLLabs tester at SSL Server Test (Powered by Qualys SSL Labs) if it says untrusted SSL cert and prompts to continue the test, continue the test.

Cloudflare

If you use Cloudflare, instead of the default Letsencrypt web root validation, you can use Cloudflare's DNS API for Letsencrypt DNS validation for your domain. See the outline at bottom of page at Letsencrypt Free SSL Certificates

 

Oh that might be the problem. Do you mean you used git clone of repo? Centmin Mod no longer uses Git clone directly for initial install, it's done via the officially installers listed on Github readme GitHub - centminmod/centminmod: CentOS Shell menu based Nginx LEMP web stack auto installer (GPLv3 licensed) or Centmin Mod LEMP Stack Install Nginx on CentOS

i.e. like

Code (Text):

yum -y update; curl -O https://centminmod.com/installer.sh && chmod 0700 installer.sh && bash installer.sh

 

You shouldn't need to download acmetool.sh it should be natively installed at /usr/local/src/centminmod/addons/acmetool.sh to be used by centmin.sh menu option 2, 22 or via nv command line.

Admittedly, acmetool.sh acme-menu hasn't been worked on for ages as non-menu command line is all addons/acmetool.sh is used for in underlying centmin.sh menu option 2, 22 or via nv command line usage. But your first try with centmin.sh menu option 2 also had same issue so probably rules it out.

If you can provide the full log for acmesh-issue_270123-141235.log via private message attachment that would help.

Do you have the exact error message? Or do you mean message = !! Error: DNS A record IP doesn't match any found on this server ? Are you running behind Cloudflare Orange cloud proxy? As that message would be expected as Cloudflare hides the domain's real IP address with it's own. In 130.00beta01, yesterday I updated it's code for centmin.sh menu option 2 to also add a note for Cloudflare users to ignore the = !! Error: DNS A record IP doesn't match any found on this server message as it's expected to not match if Cloudflare is used.

acmetool.sh and centmin.sh menu option 2, 22 or nv system DNS checks will use dig with Google 8.8.8.8 DNS resolver, so if that isn't working properly, it probably would cause issues like this. You can see the code for centmin.sh menu option 2 check_dns() function for 124.00stable at top of inc/nginx_addvhost.inc include file at centminmod/nginx_addvhost.inc at 124.00stable · centminmod/centminmod

If you can provide full centminmod_124.00stable.s70_270123-125219_nginx_addvhost.log log too via private message attachment - might need to zip it up for size limits that would help with troubleshooting

 

Your ISP connection is behind NAT or you mean the actual VPS/server that Centmin Mod is installed on is behind NAT?

 

Ah then yes that probably is the problem. Centmin Mod hasn't really been designed or tested for NAT setup servers - primarily due to me not using them so can't really test them and 99.99999% of users aren't using NAT setup servers so doesn't make sense for me to dedicate free time for this. That's probably why.

I'll check the log you provided but pretty sure that's why. Who's your web host?

 

Thanks for the reminder. If you're just doing local testing I recommend VirtualBox setup guest OS servers. Been using them for years for very early Centmin Mod testing to take advantage of VirtualBox snapshot backup/restore feature https://community.centminmod.com/threads/centos-7-4-minimal-iso-install-virtualbox-5-1.12983/