PHP-FPM Downgrade from php 8.2.x to 7.3.x failed

Yeah won't work, EL9 min PHP version is PHP 7.4 unfortunately as PHP 7.3 or older don't support EL9's OpenSSL 3.x and not available PHP <=7.3 patches for EL9. If you need to use PHP 7.4, use EL8 os like AlmaLinux 8

 

EL8 uses OpenSSL 1.1.1 branch only never OpenSSL 3.x so no chance of that happening

 

Are you using Cloudflare, if you are you can use Cloudflare DNS API to validate domain for Letsencrypt Cloudflare DNS API domain validation method

 

Cloudflare DNS API method should work then as it validates using TXT DNS record not DNS A/AAAA records

 

Yes, running opendkim.sh independently on two servers with the same domain generates two different private keys. Since DNS only holds one public key per DKIM selector (e.g., default2026._domainkey.yourdomain.com), one server's signatures will fail verification.

I just updated 132.00stable, 140.00beta01 and 141.00beta01 to support a workaround outlined below, so run cmupdate first.

The conflict depends on whether you’re referring to the server’s main hostname or a hosted site domain (vhostname). opendkim.sh handles these as two separate cases. Running it independently on both servers generates different private keys. Since DNS only holds one public key per DKIM selector (e.g., default2026._domainkey.yourdomain.com), one server’s signatures will fail verification.

Scenario 1 — Same server main hostname on both servers

This applies when both servers share the same FQDN (e.g., server.example.com), which opendkim.sh auto-detects via hostname -f. Running addons/opendkim.sh without arguments triggers this path.

Option A — Share the same DKIM private key (recommended for standby/failover clones)

Run opendkim.sh on the secondary first to set up the service and populate KeyTable/SigningTable/TrustedHosts, then replace its generated keys with the primary’s keys:

Code (Text):

# On secondary: run opendkim.sh first to install and configure everything
cd /usr/local/src/centminmod
addons/opendkim.sh

# Stop opendkim on secondary before replacing keys
systemctl stop opendkim

# On primary: rsync keys to secondary (overwrites secondary's generated keys)
rsync -avz --no-perms --no-owner --no-group \
  /etc/opendkim/keys/server.example.com/ \
  root@secondary-ip:/etc/opendkim/keys/server.example.com/

# On secondary: fix ownership and restart
chown -R opendkim: /etc/opendkim/keys/server.example.com/
systemctl start opendkim

One DNS TXT record covers both servers. The public key is in /etc/opendkim/keys/server.example.com/default2026.txt on the primary server.

Option B — Use a unique selector on the secondary server

Code (Text):

# On secondary: generate with a custom selector suffix
cd /usr/local/src/centminmod
SELECTOR="default2026sec" addons/opendkim.sh

# Verify secondary config
addons/opendkim.sh check

# Verify DNS record propagated for the secondary selector
dig +short default2026sec._domainkey.server.example.com TXT

With Option B, two DNS TXT records are required: default2026._domainkey (primary) and default2026sec._domainkey (secondary).

Scenario 2 — Same hosted site domain (vhostname) on both servers

This applies when both servers host the same domain (e.g., mysite.com) and you pass it as an argument. Running addons/opendkim.sh mysite.com triggers this path.

Option A — Share the same DKIM private key (recommended for standby/failover clones)

Code (Text):

# On secondary: run opendkim.sh for the vhostname first
cd /usr/local/src/centminmod
addons/opendkim.sh mysite.com

# Stop opendkim on secondary before replacing keys
systemctl stop opendkim

# On primary: rsync vhostname keys to secondary
rsync -avz --no-perms --no-owner --no-group \
  /etc/opendkim/keys/mysite.com/ \
  root@secondary-ip:/etc/opendkim/keys/mysite.com/

# On secondary: fix ownership and restart
chown -R opendkim: /etc/opendkim/keys/mysite.com/
systemctl start opendkim

Option B — Use a unique selector on the secondary server

Code (Text):

# On secondary: generate with a custom selector suffix
SELECTOR="default2026sec" addons/opendkim.sh mysite.com

# Verify DNS record for secondary selector
dig +short default2026sec._domainkey.mysite.com TXT

Which option to choose:

Setup Recommended

• Standby/failover — only one server sends email at a time Option A (share key via rsync)
• Active-active HA — both servers send email simultaneously Option B (unique selector per server)

Verify DKIM configuration on either server:

Code (Text):

cd /usr/local/src/centminmod
addons/opendkim.sh check

# Verify DNS TXT record is live (main hostname)
dig +short default2026._domainkey.server.example.com TXT

# Verify DNS TXT record is live (vhostname)
dig +short default2026._domainkey.mysite.com TXT