Letsencrypt LE cert reissue failing

Please fill in any relevant information that applies to you:

• CentOS Version: CentOS 7 64bit
• Centmin Mod Version Installed: 130.00beta01
• Nginx Version Installed: i.e. 1.23.3
• PHP Version Installed: 7.2.34
• MariaDB MySQL Version Installed: 10.3
• When was last time updated Centmin Mod code base ? : Today
• Persistent Config: Do you have any persistent config file options set in /etc/centminmod/custom_config.inc ? You can check via this command:
  
  Code (Text):

  cat /etc/centminmod/custom_config.inc
  

  
  Post output in CODE tags.

Code:

LETSENCRYPT_DETECT='y'
MARCH_TARGETNATIVE='n'

I'm trying to reissue a cert for a domain (really trying to add a domain), but the reissue fails even if I only use the original domain. This is the command I'm using:

Code:

 /root/.acme.sh/acme.sh --force --issue --days 60 -d domain.com -w /home/nginx/domains/domain.com/public -k 2048 --useragent centminmod-centos-acmesh-webroot --log /root/centminlogs/acmetool.sh-debug-log-domain.com.log --log-level 2

The error I get back is a 404:

Code:

[Mon Apr 17 20:17:14 UTC 2023] domain.com:Verify error:1.2.3.4: Invalid response from https://domain.com/.well-known/acme-challenge/DAk5MBLstuffgoesheretoo: 404
[Mon Apr 17 20:17:15 UTC 2023] Please check log file for more details: /root/centminlogs/acmetool.sh-debug-log-domain.com.log

What am I missing here?

edit: BTW, the log has nothing obvious in it to me.

---

 

BTW, I did find this old thread: https://community.centminmod.com/threads/error-renewing-ssl-certificate.18492/

And I tried the reissue-only command listed in there but got the same error.

 

Thanks for the reply!

* letsdebug says that everything is fine (even in the log in the centminlogs folder).

* Cert was originally created via option 2, with the acme option of 4 (HTTPS default)

* The acme errors all show the same thing as listed above: Invalid response 404

* As far as I can tell, debug doesn't show anything more

 

I'm not certain we're on the same page here. The domain is currently secured with a valid working LE SSL certificate created originally by Cenmin 2. My attempt to reissue it (ideally to add another domain) is failing.

Thinking that maybe I did something wrong, I created a new temp domain with Centmin 2. That also created a valid working LE cert. I then did a text comparison of the two domain.com.ssl.conf files. They were identical, with the exception of the different domain names.

 

I tried adding the new domain (with the domain in server_names), it failed. So I've simplified it. I'm just trying to reissue the current cert and its failing. Once I get the current cert reissued successfully, I'll go back and add the other domain. So *all* I'm currently trying to do is reissue the exact same cert.

For the record, this is the command I'm using (maybe I have it wrong?).

Code:

 /root/.acme.sh/acme.sh --force --issue --days 60 -d domain.com -w /home/nginx/domains/domain.com/public -k 2048 --useragent centminmod-centos-acmesh-webroot --log /root/centminlogs/acmetool.sh-debug-log-domain.com.log --log-level 2

 

Okay, here ya go. In case its actually relavant, this vhost is installed as a subdomain of 'dev'.

Code:

#x# HTTPS-DEFAULT
 server {
   listen   80;
#x#
   server_name dev.domain.com www.dev.domain.com;
   return 302 https://dev.domain.com$request_uri;
   root /home/nginx/domains/dev.domain.com/public;
   include /usr/local/nginx/conf/staticfiles.conf;
 }

#

server {
  listen 443 ssl http2 reuseport;

  server_name dev.domain.com www.dev.domain.com;

  include /usr/local/nginx/conf/ssl/dev.domain.com/dev.domain.com.crt.key.conf;
  include /usr/local/nginx/conf/ssl_include.conf;

  # cloudflare authenticated origin pull cert community.centminmod.com/threads/13847/
  #ssl_client_certificate /usr/local/nginx/conf/ssl/cloudflare/dev.domain.com/origin.crt;
  #ssl_verify_client on;



  # mozilla recommended
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_prefer_server_ciphers   on;
  #add_header Alternate-Protocol  443:npn-spdy/3;

  # before enabling HSTS line below read centminmod.com/nginx_domain_dns_setup.html#hsts
  #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
  #add_header X-Frame-Options SAMEORIGIN;
  add_header X-Xss-Protection "1; mode=block" always;
  add_header X-Content-Type-Options "nosniff" always;
  #add_header Referrer-Policy "strict-origin-when-cross-origin";
  #add_header Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()";
  #spdy_headers_comp 5;
  ssl_buffer_size 1369;
  ssl_session_tickets on;

  # enable ocsp stapling
  resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 valid=10m;
  resolver_timeout 10s;
  ssl_stapling on;
  ssl_stapling_verify on;

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/dev.domain.com/log/access.log combined buffer=256k flush=5m;
  #access_log /home/nginx/domains/dev.domain.com/log/access.json main_json buffer=256k flush=5m;
  error_log /home/nginx/domains/dev.domain.com/log/error.log;

  include /usr/local/nginx/conf/autoprotect/dev.domain.com/autoprotect-dev.domain.com.conf;
  root /home/nginx/domains/dev.domain.com/public/app;
  # uncomment cloudflare.conf include if using cloudflare for
  # server and/or vhost site
  #include /usr/local/nginx/conf/cloudflare.conf;
  include /usr/local/nginx/conf/503include-main.conf;

  location / {

    include /usr/local/nginx/conf/503include-only.conf;
    index index.html;
    try_files $uri $uri/ /index.html?$args;

}

  include /usr/local/nginx/conf/php.conf;

  include /usr/local/nginx/conf/pre-staticfiles-local-dev.domain.com.conf;
  include /usr/local/nginx/conf/pre-staticfiles-global.conf;
  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

Code:

curl -I https://dev.domain.com

HTTP/1.1 200 OK
Date: Wed, 19 Apr 2023 20:14:50 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 4711
Last-Modified: Wed, 22 Mar 2023 21:02:43 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "641b6cf3-1267"
Server: nginx centminmod
X-Powered-By: centminmod
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes

Code:

curl -I http://dev.domain.com

HTTP/1.1 302 Moved Temporarily
Date: Wed, 19 Apr 2023 20:19:53 GMT
Content-Type: text/html
Content-Length: 138
Connection: keep-alive
Location: https://dev.domain.com/
Server: nginx centminmod
X-Powered-By: centminmod

Code:

curl -I https://www.dev.domain.com

curl: (51) Unable to communicate securely with peer: requested domain name does not match the server's certificate.

Code:

 curl -I http://www.dev.domain.com

HTTP/1.1 302 Moved Temporarily
Date: Wed, 19 Apr 2023 20:22:58 GMT
Content-Type: text/html
Content-Length: 138
Connection: keep-alive
Location: https://dev.domain.com/
Server: nginx centminmod
X-Powered-By: centminmod

 

No the domain is dev.domain.com and it was all handled by Centmin 2.

 

Yeah, that didn't help either.

I tried adding a new vhost for testing purposes. I can add, reissue, etc certs for this new test vhost without issue. So there's something very wrong with the dev. vhost that we're talking about here. I may just try blowing it away and recreating it at this point.

 

Recreating the vhost was certainly the nuclear option, but it worked. Thanks again for your help good sir!

 

Yeah, and you saw the config above. It makes zero sense.

 

If you actually still want them, I'd be happy to share. Otherwise, we can consider this resolved.