Letsencrypt SSL acme ssl obtain ssl success but its invalid and not secure

• If you ran centmin.sh menu option 2 or 22, which letsencrypt option did you select from
  Code (Text):

  Enter vhost domain name you want to add (without www. prefix): acme3.domain1.com
  
  Create a self-signed SSL certificate Nginx vhost? [y/n]: n
  Get Letsencrypt SSL certificate Nginx vhost? [y/n]: y
  
  You have 4 options:
  1. issue staging test cert with HTTP + HTTPS
  2. issue staging test cert with HTTPS default
  3. issue live cert with HTTP + HTTPS
  4. issue live cert with HTTPS default
  Enter option number 1-4: 1
  

Centmin Mod Self-Signed SSL Fallback

If you're seeing a Centmin Mod's self-signed ssl certificate instead of letsencrypt ssl certificate, then that's acmetool.sh and centminmod's fallback if letsencrypt verification fails to obtain letsencrypt ssl cert, it falls back to centmin mod self-signed ssl certificate on https port 443 side so to preserve the https nginx vhost

Troubleshooting

There are various steps you can do to troubleshoot failed letsencrypt issuances, renews, reissues etc.

• acmetool.sh logs all command line or shell menu runs to log files at /root/centminlogs. To troubleshoot, copy the contents of the log run and post contents of log to pastebin.com or gist.github.com and share link in this thread. To find the log list the logs in ascending date order
  Code (Text):

  ls -lahrt /root/centminlogs

  .
• For direct acmetool.sh runs, there should be a 2nd & 3rd & 4th log in format /root/centminlogs/centminmod_${DT}_nginx_addvhost_nv.log and /root/centminlogs/acmetool.sh-debug-log-$DT.log and /root/centminlogs/acmesh-issue_*.log or /root/centminlogs/acmesh-reissue_*.log which would need to be included via separate pastebin.com or gist.github.com post.
• Enable acmetool.sh debug mode. In persistent config file at /etc/centminmod/custom_config.inc (create it if doesn't exist) add and enable acmetool.sh debug mode which gives much more verbose letsencrypt issuance process information when you re-run acmetool.sh or centmin.sh menu options 2, 22 or /usr/bin/nv command lines.
  
  Code (Text):

  ACMEDEBUG='y'

Without the answers to above questions and logs, there is nothing to help troubleshoot.

 

Did you follow NSD example at Domains - Domain name DNS setup on local NSD server ? You need to register your vanity nameservers with your domain registrar before you can setup domain using vanity custom nameservers. Your domain DNS doesn't seem to be working check Global DNS Propagation Checker - What's My DNS? should return your server IP address for A records

I suggest you use a 3rd party DNS provider instead of NSD i.e. Cloudflare Cloudflare - DNS - Cloudflare DNS Only Configuration

But you managed to get your letsencrypt ssl cert successfully, so your DNS was working at time of issuance

 

also run your domain through dev ssllabs ssl tester for clues SSL Server Test (Powered by Qualys SSL Labs)

example for my centminmod.com site SSL Server Test: centminmod.com (Powered by Qualys SSL Labs)

 

need to contact your dns provider/domain registrar for help in setting up proper vanity custom nameservers

 

updated last reply of mine to clarify what i was saying

custom vanity nameservers need to be registered with domain/dns provider BEFORE they can be used as NS records Nginx Vhost & NSD DNS Setup - CentminMod.com LEMP Nginx web stack for CentOS

i.e. with dnsmadeeasy Vanity DNS | Welcome to DNS Made Easy Tutorials

each dns provider/domain registrar has their own way of registering nameservers for custom vanity nameservers, so need to contact them for instructions

 

There's generally 3 ways of setting up HTTPS SSL certificate for Centmin Mod Nginx HTTP/2 based HTTPS

Method 1. The traditional way via centmin.sh menu option 2, 22 and selecting yes to self-signed ssl certificates first. Then converting the self-signed ssl certificate to paid or free (Letsencrypt) web browser trusted SSL certificates outlined at How to switch self-signed SSL certificate to paid SSL certificate ? You would still need to follow the same steps outlined at Nginx SPDY SSL Configuration for obtaining and purchasing the paid SSL certificate and most important part is the concatenation of the SSL provider provided filesto create the mentioned /usr/local/nginx/conf/ssl/domaincom/ssl-unified.crt and /usr/local/nginx/conf/ssl/domaincom/ssl-trusted.crtfiles referenced in your Nginx SSL vhost config file.

You may need to also decide if you want to enable HTTP to HTTPS redirect outlined at How to force redirect from HTTP:// to HTTPS:// ?

If you didn't answer yes at time of initial nginx vhost creation to self-signed ssl certificates, you can manually setup the self-signed ssl certificate via the vhost generator by checking self-signed ssl box and enter a domain name. This will outline instructions for manually creating and setting up self-signed ssl certificate and nginx vhost settings. Then for web browser trusted ssl certificates you switch follow - How to switch self-signed SSL certificate to paid SSL certificate ?.

Method 2. Using and testing Centmin Mod 123.09beta01's new addons/acmetool.sh addon which is still in beta testing only for integrating Letsencrypt SSL certificates. And has both auto and manual methods.

Method 3. Fully manual method for free Letsencrypt SSL certificates.

• For existing non-HTTPS Nginx vhost sites migration to HTTPS as outlined at Migrating Existing Nginx Vhost From HTTP to HTTP/2 based HTTPS With Letsencrypt SSL Certificates
• For brand new Nginx vhosts not yet created on server use this guide Using Centmin Mod acmetool.sh addon for Nginx HTTP/2 based HTTPS with free Letsencrypt SSL certificates

So try one of the 2 application guides in method 3

 

from your ssllab result, you selected letsencrypt test staging ssl certs and not live ssl certs hence untrusted

Code (Text):

Get Letsencrypt SSL certificate Nginx vhost? [y/n]: y

You have 4 options:
1. issue staging test cert with HTTP + HTTPS
2. issue staging test cert with HTTPS default
3. issue live cert with HTTP + HTTPS
4. issue live cert with HTTPS default
Enter option number 1-4: 1

option 1 and 2 = test staging ssl certs

you should select 3 or 4 for live trusted ssl certs

following method for existing vhost outlined at Migrating Existing Nginx Vhost From HTTP to HTTP/2 based HTTPS With Letsencrypt SSL Certificates should fix it with live trusted ssl certs

 

yeah making it more clearer