Letsencrypt Fresh install and SSL_ERROR_UNRECOGNIZED_NAME_ALERT issue

• CentOS Version: Rocky Linux 8
• Centmin Mod Version Installed: 131.00stable
• Nginx Version Installed: 1.27.2 ?
• PHP Version Installed: 7.4.33
  
• MariaDB MySQL Version Installed: 10.4.xx
  
• When was last time updated Centmin Mod code base ? : Dec 24th,2024
  
• Persistent Config: Do you have any persistent config file options set in /etc/centminmod/custom_config.inc ? You can check via this command:
  
  Code (Text):

  cat /etc/centminmod/custom_config.inc
  [*]LETSENCRYPT_DETECT='y'
  DUALCERTS='y'
  SELFSIGNEDSSL_ECDSA='y'
  PHPFINFO='y'
  PHP_OVERWRITECONF='n'
  PYTHON_INSTALL_ALTERNATIVES='y'
  

I just added a new domain, and everything seemed fine until I visited www.mydomain.com, and got these errors using Firefox v133.0.3:

---

Secure Connection Failed
An error occurred during a connection to www.mydomain.com. SSL peer has no certificate for the requested DNS name.

Error code: SSL_ERROR_UNRECOGNIZED_NAME_ALERT

• The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
• Please contact the website owners to inform them of this problem.

Learn more…

But when I visit mydomain.com (without 'www'), the page works properly. Is there anything I might have missed?

 

I found the problem—it was caused by the Imperva CDN. I noticed that the script supports Cloudflare CDN with full SSL connections. In my case, if the domains are set up without the Cloudflare API and ID configured in the etc/centminmod/custom_config.inc file, what steps should I take to complete the setup?

 

Thank you for your detailed response. The previous issue was caused by Imperva, which I have now disabled.

The incorrect persistent config file was likely due to a typing error—the extra [*] is not present in the current file.

I now have a working SSL site. If I want to use Cloudflare, how should I perform domain DNS validation? Should I run
./acmetool.sh reissue-only domain.com live
after adding the appropriate Cloudflare token and ID in the custom_config.inc file?

Additionally, since the certificate has a 90-day validity, will the script handle automatic certificate renewal?

 

How do I set up SSL for an existing vhost to work with both Cloudflare and non-CDN setups?

I tried running:
./acmetool.sh issue mydomain.com lived
but the verification failed (the vhost is currently behind Cloudflare).

I have already configured the correct Cloudflare client ID and token, and the command:
./acmetool.sh check_cfapi
passed successfully.

What should I do to resolve this issue and complete the SSL setup?

I asked ChatGPT, and it gave me the following:

To set up SSL for an existing vhost that works both with Cloudflare (behind a CDN) and non-CDN setups, you need to ensure the correct configuration for DNS validation or HTTP validation. Here's a step-by-step guide based on your scenario:

Step 1: Verify Cloudflare API Configuration
You mentioned running ./acmetool.sh check_cfapi and it passed, which confirms that the Cloudflare API credentials are correct. This is crucial for DNS-based validation.

Step 2: Ensure the vhost Configuration Matches Your Validation Method

1. For DNS Validation (Recommended for Cloudflare setups):
   
   • Ensure your domain is set to "Proxied" (orange cloud) in Cloudflare DNS settings.
   • Use the following command to issue the SSL certificate:
     

Code:

./acmetool.sh issue mydomain.com livedns

• • This uses DNS validation, leveraging your Cloudflare API to handle the TXT records automatically.

• For HTTP Validation (if you want non-CDN setup or Cloudflare is "DNS-only"):
  
  • Temporarily disable "Proxied" mode (set it to "DNS-only," gray cloud) for your domain in Cloudflare.
  • Ensure your vhost serves HTTP requests properly for /.well-known/acme-challenge/ by adding the following block to your Nginx configuration:
    
    Code:

    location /.well-known/acme-challenge/ {
        root /usr/local/nginx/html;
    }
    

  Reload Nginx:
  Then run:
  
  Code:

  ./acmetool.sh issue mydomain.com live
  

After successful issuance, you can re-enable "Proxied" mode in Cloudflare.

• Step 3: Automatic Certificate Renewal
  The script should handle automatic renewal as long as the initial setup is correct:
  
  • DNS validation will use your Cloudflare API.
  • HTTP validation requires /.well-known/acme-challenge/ to be accessible.
  You can confirm this by checking the cron jobs (crontab -l) set up by Centmin Mod for SSL renewals.
  
  Step 4: Update Your vhost to Use SSL
  Once the certificate is issued, configure your Nginx vhost to use SSL. Below is an example:

• Code:

  server {
      listen 443 ssl http2;
      server_name mydomain.com www.mydomain.com;
  
      ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
  
      root /path/to/your/website;
      index index.html index.php;
  
      location / {
          try_files $uri $uri/ =404;
      }
  }
  

• Reload Nginx

• I am not sure if ChatGPT's answer is right?

 

I see. I’ve checked those posts, and everything works well with the new vhost.

However, my current failed domain is behind Cloudflare. When I tried to issue or reissue the certificate, it seems that acmetool.sh didn’t generate a DNS TXT record through Cloudflare’s API. Since my domain resolves to Cloudflare instead of the server IP, the verification failed.

Is there an option to use Cloudflare’s DNS API for domain validation?

 

I tested one of my domains. which is behind Cloudflare, and ran the command:

Code:

./acmetool.sh reissue-only go2uk.org lived

It returned the following errors:

Code:

go2uk.org nginx HTTPS SSL vhost doesn't already exist at
/usr/local/nginx/conf/conf.d/go2uk.org.ssl.conf
reissue-only command is for use with existing nginx HTTPS SSL based vhosts only
aborting...

The error message was clear, so I tried the command:

Code:

./acmetool.sh issue go2uk.org lived

Everything seemed fine during the process, with no errors reported. However, after the setup was complete and I visited the domain, I encountered errors from Cloudflare:

Invalid SSL certificate Error code 526

 

I have pasted the logs here: https://pastebin.com/uL5eggAA; https://pastebin.com/TjRcgCgD
in which I don't see any errors.

 

Code:

/usr/local/src/centminmod/addons/acmetool.sh checkdates
----------------------------------------------
nginx installed
----------------------------------------------

/usr/local/nginx/conf/ssl/go2uk.org/go2uk.org-acme.cer
SHA1 Fingerprint=B79912F34D2F7F2E38A96063FF142F7A9C8F95B6
certificate expires in 89 days on 30 Mar 2025

/usr/local/nginx/conf/ssl/go2uk.org/go2uk.org-acme-ecc.cer
SHA1 Fingerprint=4AAB4067DC20AAC6017FE1EE475AAF2B860DB8E5
certificate expires in 89 days on 30 Mar 2025

----------------------------------------------
acme.sh obtained
----------------------------------------------

/root/.acme.sh/go2uk.org_ecc/go2uk.org.cer
SHA1 Fingerprint=4AAB4067DC20AAC6017FE1EE475AAF2B860DB8E5
[ below certifcate transparency link is only valid ~1hr after issuance ]
https://crt.sh/?sha1=4AAB4067DC20AAC6017FE1EE475AAF2B860DB8E5
certificate expires in 89 days on 30 Mar 2025
Letsencrypt validation method: Le_Webroot='dns_cf'

/root/.acme.sh/go2uk.org/go2uk.org.cer
SHA1 Fingerprint=B79912F34D2F7F2E38A96063FF142F7A9C8F95B6
[ below certifcate transparency link is only valid ~1hr after issuance ]
https://crt.sh/?sha1=B79912F34D2F7F2E38A96063FF142F7A9C8F95B6
certificate expires in 89 days on 30 Mar 2025
Letsencrypt validation method: Le_Webroot='dns_cf'

Is this correct?

Yes. The vhost site that I used reissue option was already created on the server (without https).

The logs must be deleted by the staff for some reasons.

It was set to Full strict mode. Now I change it to Full, and it works fine.

So, if I migrating a site to a new VPS, how do I set up properly?
My idea is, create vhost in the new VPS, without https, then move the data to the new VPS, then change DNS setting, then issue certificates?