Join the community today
Become a Member

Letsencrypt Help with error. Can't get letsencrypt to work

Discussion in 'Domains, DNS, Email & SSL Certificates' started by Itworx4me, Mar 22, 2020.

  1. Itworx4me

    Itworx4me Active Member

    316
    29
    28
    Mar 14, 2017
    Ratings:
    +52
    Local Time:
    9:50 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    I got this when reissuing:
    Code (Text):
    -------------------------------------------------
    acmetool.sh is in beta testing phase
    please read & provide bug reports &
    feedback for this tool via the forums
    https://centminmod.com/acmetool
    -------------------------------------------------
    
    continue [y/n] ? y
    
    -----------------------------------------------------
    updating acme.sh client...
    -----------------------------------------------------
    Cloning into 'acme.sh'...
    [Sun Mar 22 20:05:57 UTC 2020] It is recommended to install socat first.
    [Sun Mar 22 20:05:57 UTC 2020] We use socat for standalone server if you use standalone mode.
    [Sun Mar 22 20:05:57 UTC 2020] If you don't use standalone mode, just ignore this warning.
    [Sun Mar 22 20:05:57 UTC 2020] Installing to /root/.acme.sh
    [Sun Mar 22 20:05:57 UTC 2020] Installed to /root/.acme.sh/acme.sh
    [Sun Mar 22 20:05:58 UTC 2020] Installing alias to '/root/.bashrc'
    [Sun Mar 22 20:05:58 UTC 2020] OK, Close and reopen your terminal to start using acme.sh
    [Sun Mar 22 20:05:58 UTC 2020] Installing alias to '/root/.cshrc'
    [Sun Mar 22 20:05:58 UTC 2020] Installing alias to '/root/.tcshrc'
    [Sun Mar 22 20:05:58 UTC 2020] Installing cron job
    19 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null
    [Sun Mar 22 20:05:58 UTC 2020] Good, bash is found, so change the shebang to use bash as preferred.
    [Sun Mar 22 20:05:58 UTC 2020] OK
    https://github.com/acmesh-official/acme.sh
    v2.8.6
    -----------------------------------------------------
    acme.sh updated
    -----------------------------------------------------
    grep 'root' /usr/local/nginx/conf/conf.d/insidepromod.com.ssl.conf
      root /home/nginx/domains/insidepromod.com/public;
    
    -----------------------------------------------------------
    reissue & install letsencrypt ssl certificate for insidepromod.com
    -----------------------------------------------------------
    /root/.acme.sh/acme.sh --force --createDomainKey -d insidepromod.com -d www.insidepromod.com -k 2048 --useragent centminmod-centos7-acmesh-webroot
    [Sun Mar 22 20:05:59 UTC 2020] Creating domain key
    [Sun Mar 22 20:05:59 UTC 2020] The domain key is here: /root/.acme.sh/insidepromod.com/insidepromod.com.key
    testcert value = live
    /root/.acme.sh/acme.sh --force --issue -d insidepromod.com -d www.insidepromod.com --days 60 -w /home/nginx/domains/insidepromod.com/public -k 2048 --useragent centminmod-centos7-acmesh-webroot --log /root/centminlogs/acmetool.sh-debug-log-220320-200551.log --log-level 2
    [Sun Mar 22 20:05:59 UTC 2020] Multi domain='DNS:insidepromod.com,DNS:www.insidepromod.com'
    [Sun Mar 22 20:06:00 UTC 2020] Getting domain auth token for each domain
    [Sun Mar 22 20:06:02 UTC 2020] Getting webroot for domain='insidepromod.com'
    [Sun Mar 22 20:06:02 UTC 2020] Getting webroot for domain='www.insidepromod.com'
    [Sun Mar 22 20:06:02 UTC 2020] Verifying: insidepromod.com
    [Sun Mar 22 20:06:06 UTC 2020] insidepromod.com:Verify error:Invalid response from http://insidepromod.com/.well-known/acme-challenge/5HdtNCsmQX0142STaMivTNvyNwN3WTDr2wG5dbnojhQ [2606:4700:3030::681c:186d]:
    [Sun Mar 22 20:06:06 UTC 2020] Please check log file for more details: /root/centminlogs/acmetool.sh-debug-log-220320-200551.log
    LECHECK = 1
    
    log files saved at /root/centminlogs
    -rw-r--r-- 1 root root 3.1K Mar 22 20:05 cmm-login-git-checks_220320-200521.log
    -rw-r--r-- 1 root root  44K Mar 22 20:06 acmetool.sh-debug-log-220320-200551.log
    -rw-r--r-- 1 root root 3.0K Mar 22 20:06 acmesh-reissue-only_220320-200551.log


     
  2. eva2000

    eva2000 Administrator Staff Member

    55,245
    12,253
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,833
    Local Time:
    2:50 PM
    Nginx 1.27.x
    MariaDB 10.x/11.4+
    oh yeah uncomment and restore the server{} context which has 302 redirect from non-https to https and restart nginx service before doing re-issuance
     
  3. Itworx4me

    Itworx4me Active Member

    316
    29
    28
    Mar 14, 2017
    Ratings:
    +52
    Local Time:
    9:50 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    Finally success. Do I need to go in and change the ssl.conf lines to this now?

    From this:
    Code (Text):
    ssl_certificate      /usr/local/nginx/conf/ssl/insidepromod.com/insidepromod.com.crt;
      ssl_certificate_key  /usr/local/nginx/conf/ssl/insidepromod.com/insidepromod.com.key;
    
      #resolver 8.8.8.8 8.8.4.4 valid=10m;
      #resolver_timeout 10s;
      #ssl_stapling on;
      #ssl_stapling_verify on;
      #ssl_trusted_certificate /usr/local/nginx/conf/ssl/insidepromod.com/insidepromod.com-trusted.crt;


    To this:
    Code (Text):
    ssl_certificate      /usr/local/nginx/conf/ssl/insidepromod.com/insidepromod.com-acme.cer;
      ssl_certificate_key  /usr/local/nginx/conf/ssl/insidepromod.com/insidepromod.com-acme.key;
    
      resolver 8.8.8.8 8.8.4.4 valid=10m;
      resolver_timeout 10s;
      ssl_stapling on;
      ssl_stapling_verify on;
      ssl_trusted_certificate /usr/local/nginx/conf/ssl/insidepromod.com/insidepromod.com-fullchain-acme.key;


    Thanks,
    Itworx4me
     
  4. eva2000

    eva2000 Administrator Staff Member

    55,245
    12,253
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,833
    Local Time:
    2:50 PM
    Nginx 1.27.x
    MariaDB 10.x/11.4+
    You can do that though it will still work with self-signed ssl as CF Full non-strict SSL allows self-signed SSL certs on nginx origin. But for letsencrypt, yes change it, so if you ever need to disable Cloudflare proxy orange cloud, your Centmin Mod Nginx origin letsencrypt SSL will still be valid for HTTPS