Cloudflare 'Astonishing' problem with letsencrypt/cloudflare

You'd have to contact Cloudflare tech support for an exact explanation. Did you use same Cloudflare account or created a new Cloudflare account to re-add the new site zone?

IIRC, if you create 2 Cloudflare accounts and add the same domain zone to both, the later one will override the first Cloudflare's system once the Cloudflare nameservers have propgrated to your domain's DNS.

 

Hi I see you posted on Cloudflare community forums too Interesting Problem; CA / certificate not working.

Not 100% sure I understand what you did but do you mean

1. You deleted your Cloudflare domain's zone and re-added it back again in 15minutes. That's probably not enough time between deleting and re-adding the same domain zone and Cloudflare's system would still have your previous domain zone settings in their system still.
2. And all your Cloudflare DNS records from BEFORE deletion were still there and re-added when you re-added your same domain name again and pointing to an old server IP address even before you got a chance to update the DNS records with new server IP? Or do you mean advance setting as in Cloudflare Full SSL strict was enabled by default when you re-added your domain zone the 2nd time? Or both old DNS IP from the previous domain zone setup + Cloudflare Full SSL strict was enabled too?
3. Thus Letsencrypt failed to re-validate and re-issue a new Letsencrypt SSL certificate for your Centmin Mod Nginx origins server on the fresh 2nd install/setup as Cloudflare Full SSL strict was enabled from the first time you added your domain zone? If at this point you switched from CF Full SSL strict to either Full SSL non-strict or Flexible SSL, does your site work? CF Full SSL strict would probably fail due to either first 2 assumptions I outlined because CF Full SSL strict requires a valid Letsencrypt SSL certificate on Centmin Mod Nginx origin side and if your domain zone's DNS records picked up the previous domain zone's server IP for DNS A records, it would be pointing to a different origin server and not your new Centmin Mod origin server's IP. If that is the case then, all you need to do is temporarily switch from Cloudflare Full SSL to Flexible SSL and update your domain zone's DNS A records for domain and www version A DNS records to ensure it's pointing to the correct new origin server's IP and then you can do is sort of partial manual steps from Migrating Existing Nginx Vhost From HTTP to HTTP/2 based HTTPS With Letsencrypt SSL Certificates in that you temporarily disable your /usr/local/nginx/conf/conf.d/domain.com.ssl.conf nginx vhost and recreate the non-https nginx vhost /usr/local/nginx/conf/conf.d/domain.com.conf using the official Nginx vhost generator at Generate Centmin Mod Nginx Vhost - CentminMod.com LEMP Nginx web stack for CentOS (which is step 1 of guide at Migrating Existing Nginx Vhost From HTTP to HTTP/2 based HTTPS With Letsencrypt SSL Certificates).
   
   Then follow manual steps 2, 3, 4, 5 and 6 of guide at Migrating Existing Nginx Vhost From HTTP to HTTP/2 based HTTPS With Letsencrypt SSL Certificates where step 6 you can re-enable your https /usr/local/nginx/conf/conf.d/domain.com.ssl.conf nginx vhost and disable your non-https nginx vhost /usr/local/nginx/conf/conf.d/domain.com.conf again. Then you should be able to re-enable CF Full SSL strict.

Using Letsencrypt DNS based domain validation instead

However, if you're behind Cloudflare and don't want to deal with the default Centmin Mod's Letsencrypt web root authentication, Centmin Mod's Letsencrypt SSL integration also supports using Letsencrypt DNS validation via Cloudflare's DNS API when you setup the optionally enabled variables for Cloudflare API Token is set in persistent config file at /etc/centminmod/custom_config.inc prior to creating your Centmin Mod Nginx HTTPS vhost domain name via centmin.sh menu option 2, 22 or nv command line. See https://community.centminmod.com/th...ull-cloudflare-dns-api-in-123-09beta01.20327/.

If the Centmin Mod Nginx vhost site has no data and can be totally deleted, then probably easiest to delete the Nginx vhost and re-create it after you setup Cloudflare API Token for Letsencrypt DNS domain validation first.

To properly remove an Nginx vhost the instructions are on official site at How to delete Nginx vhost account for existing domain/subdomain ? as well as on each Nginx vhost creation's ending output too lists the commands.

If you used centmin.sh menu option 2, 22 or nv command line to create your Nginx vhost site, you'd also get a log file for each Nginx vhost created which also contains a lists of the commands in 123.09beta01 and higher. Example for http2.domain.com remove log at /root/centminlogs/centminmod_140218-021218_nginx_addvhost_nv-remove-cmds-http2.domain.com.log

Code (Text):

ls -lahrt /root/centminlogs/ | grep remove
-rw-r--r--   1 root root 1.3K Feb 14 02:12 centminmod_140218-021218_nginx_addvhost_nv-remove-cmds-http2.domain.com.log

 

what is the problem exactly ?

If it's letsencrypt SSL certificate issuance, then try below troubleshooting steps

First try running your intended SSL certificate domain through the letsdebug.net online testing tool to check for potential errors with HTTP-01 validation. If you created Centmin Mod 123.09beta01 or higher Nginx site with Letsencrypt via centmin.sh menu option 2, 22 or nv command line, you now also have an automatic letsdebug.net API check log saved at /root/centminlogs/letsdebug-yourdomain.com-${DT}.log where yourdomain.com is domain specified during nginx vhost creation and DT is date/timestamp. Inspecting the /root/centminlogs/letsdebug-yourdomain.com-${DT}.log log will also give you clues as to why letsencrypt SSL certificate issuance failed.

How was the initial letsencrypt ssl certificate obtained ? Which method ?

• Was the domain nginx vhost alreadying created prior or new domain nginx vhost site setup for first time ?
• Via centmin.sh menu option 2, 22, /usr/bin/nv ?
• If you ran centmin.sh menu option 2 or 22, which letsencrypt option did you select from
  Code (Text):

  -------------------------------------------------------------
  Setup full Nginx vhost + Wordpress + WP Plugins
  -------------------------------------------------------------
  
  Enter vhost domain name you want to add (without www. prefix): acme3.domain1.com
  
  Create a self-signed SSL certificate Nginx vhost? [y/n]: n
  Get Letsencrypt SSL certificate Nginx vhost? [y/n]: y
  
  You have 4 options:
  1. issue staging test cert with HTTP + HTTPS
  2. issue staging test cert with HTTPS default
  3. issue live cert with HTTP + HTTPS
  4. issue live cert with HTTPS default
  Enter option number 1-4: 1
  

Centmin Mod Self-Signed SSL Fallback

If you're seeing a Centmin Mod's self-signed ssl certificate instead of letsencrypt ssl certificate, then that's acmetool.sh and centminmod's fallback if letsencrypt verification fails to obtain letsencrypt ssl cert, it falls back to centmin mod self-signed ssl certificate on https port 443 side so to preserve the https nginx vhost

Troubleshooting

There are various steps you can do to troubleshoot failed letsencrypt issuances, renews, reissues etc.

• acmetool.sh logs all command line or shell menu runs to log files at /root/centminlogs. To troubleshoot, copy the contents of the log run and post contents of log to pastebin.com or gist.github.com and share link in this thread. To find the log list the logs in ascending date order
  Code (Text):

  ls -lahrt /root/centminlogs

  .
• For direct acmetool.sh runs, there should be a 2nd & 3rd & 4th log in format /root/centminlogs/centminmod_${DT}_nginx_addvhost_nv.log and /root/centminlogs/acmetool.sh-debug-log-$DT.log and /root/centminlogs/acmesh-issue_*.log or /root/centminlogs/acmesh-reissue_*.log which would need to be included via separate pastebin.com or gist.github.com post.
• Enable acmetool.sh debug mode. In persistent config file at /etc/centminmod/custom_config.inc (create it if doesn't exist) add and enable acmetool.sh debug mode which gives much more verbose letsencrypt issuance process information when you re-run acmetool.sh or centmin.sh menu options 2, 22 or /usr/bin/nv command lines.
  
  Code (Text):

  ACMEDEBUG='y'

What's output for this command?

Code (Text):

echo y | /usr/local/src/centminmod/addons/acmetool.sh checkdates

For posting code or output from commands to keep the formatting, you might want to use CODE tags for code How to use forum BBCODE code tags

SSLLabs Test

Also run your HTTPS domain site through SSLLabs tester at SSL Server Test (Powered by Qualys SSL Labs) if it says untrusted SSL cert and prompts to continue the test, continue the test.

 

On Cloudflare end disable these 2 options you have to

• Always use https: on
• Auto. https rewrites: on

Centmin Mod Nginx default HTTPS option will auto do non-https to https redirects. And if you enable Cloudflare side to do the same, you will end up in a redirect loop.

 

Did you select 2 or 4 when prompted below

Code (Text):

-------------------------------------------------------------
Setup full Nginx vhost + Wordpress + WP Plugins
-------------------------------------------------------------

Enter vhost domain name you want to add (without www. prefix): acme3.domain1.com

Create a self-signed SSL certificate Nginx vhost? [y/n]: n
Get Letsencrypt SSL certificate Nginx vhost? [y/n]: y

You have 4 options:
1. issue staging test cert with HTTP + HTTPS
2. issue staging test cert with HTTPS default
3. issue live cert with HTTP + HTTPS
4. issue live cert with HTTPS default
Enter option number 1-4: 1

2 will use staging untrusted Letsencrypt SSL certificate for tests. You need to select 4 for live trusted Letsencrypt SSL certificate issuance.

Otherwise, the issue could be this redirect loop.

 

You can try with Cloudflare DNS API validation too outlined at https://community.centminmod.com/th...with-letsencrypt-cloudflare.22446/#post-91917 which would bypass Letsencrypt web root file domain validation.

 

You shouldn't need to do that to be honest and probably cause problems down the line with Centmin Mod's acme.sh implementation. Best way would of been CF DNS API method I outlined above.