/ Register

Learn about Centmin Mod LEMP Stack today
Become a Member

Letsencrypt Lets Encrypt Issue Error

Discussion in 'Add Ons' started by MarkKiss, Aug 30, 2019.

Previous Thread Next Thread
Loading...
  1. Aug 30, 2019 #1
    MarkKiss

    MarkKiss New Member

    24
    3
    3
    Sep 2, 2015
    Ratings:
    +4
    Local Time:
    2:23 PM
    • CentOS Version: CentOS 7 64bit
    • Centmin Mod Version Installed: 23.09beta01
    • Nginx Version Installed: 1.17.3
    • PHP Version Installed: 7.2
    • MariaDB MySQL Version Installed: 10.2
    • When was last time updated Centmin Mod code base ? : Today
    • Persistent Config: Yes
      Code (Text):
      LETSENCRYPT_DETECT='y'
    • ERROR
    • Code (Text):
      [Thu Aug 29 17:57:39 UTC 2019] Verifying: destiny2.cz
[Thu Aug 29 17:57:42 UTC 2019] destiny2.cz:Verify error:Fetching https://destiny2.cz/.well-known/acme-challenge/PqwC87z2OTlEJuMBXlj2fJeOHGaoACGwK3AXxVQHfWE: Connection refused
[Thu Aug 29 17:57:42 UTC 2019] Please check log file for more details: /root/centminlogs/acmetool.sh-debug-log-290819-175729.log
    • LOG
    • Code (Text):
      [Thu Aug 29 17:57:36 UTC 2019] Lets find script dir.
[Thu Aug 29 17:57:36 UTC 2019] _SCRIPT_='/root/.acme.sh/acme.sh'
[Thu Aug 29 17:57:36 UTC 2019] _script='/root/.acme.sh/acme.sh'
[Thu Aug 29 17:57:36 UTC 2019] _script_home='/root/.acme.sh'
[Thu Aug 29 17:57:36 UTC 2019] Using config home:/root/.acme.sh
[Thu Aug 29 17:57:36 UTC 2019] LE_WORKING_DIR='/root/.acme.sh'
[Thu Aug 29 17:57:36 UTC 2019] Running cmd: issue
[Thu Aug 29 17:57:36 UTC 2019] _main_domain='destiny2.cz'
[Thu Aug 29 17:57:36 UTC 2019] _alt_domains='www.destiny2.cz'
[Thu Aug 29 17:57:36 UTC 2019] Using config home:/root/.acme.sh
[Thu Aug 29 17:57:36 UTC 2019] ACME_DIRECTORY='https://acme-v02.api.letsencrypt.org/directory'
[Thu Aug 29 17:57:36 UTC 2019] _ACME_SERVER_HOST='acme-v02.api.letsencrypt.org'
[Thu Aug 29 17:57:36 UTC 2019] DOMAIN_PATH='/root/.acme.sh/destiny2.cz'
[Thu Aug 29 17:57:36 UTC 2019] '/home/nginx/domains/destiny2.cz/public' does not contain 'dns'
[Thu Aug 29 17:57:36 UTC 2019] Using ACME_DIRECTORY: https://acme-v02.api.letsencrypt.org/directory
[Thu Aug 29 17:57:36 UTC 2019] _init api for server: https://acme-v02.api.letsencrypt.org/directory
[Thu Aug 29 17:57:36 UTC 2019] GET
[Thu Aug 29 17:57:36 UTC 2019] url='https://acme-v02.api.letsencrypt.org/directory'
[Thu Aug 29 17:57:36 UTC 2019] timeout=
[Thu Aug 29 17:57:36 UTC 2019] _CURL='curl -L --silent --dump-header /root/.acme.sh/http.header  -g '
[Thu Aug 29 17:57:37 UTC 2019] ret='0'
[Thu Aug 29 17:57:37 UTC 2019] response='{
  "VSTGaKgi9xk": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
  "meta": {
   "caaIdentities": [
     "letsencrypt.org"
   ],
   "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",
   "website": "https://letsencrypt.org"
  },
  "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
  "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
  "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
  "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
}'
[Thu Aug 29 17:57:37 UTC 2019] ACME_KEY_CHANGE='https://acme-v02.api.letsencrypt.org/acme/key-change'
[Thu Aug 29 17:57:37 UTC 2019] ACME_NEW_AUTHZ
[Thu Aug 29 17:57:37 UTC 2019] ACME_NEW_ORDER='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Thu Aug 29 17:57:37 UTC 2019] ACME_NEW_ACCOUNT='https://acme-v02.api.letsencrypt.org/acme/new-acct'
[Thu Aug 29 17:57:37 UTC 2019] ACME_REVOKE_CERT='https://acme-v02.api.letsencrypt.org/acme/revoke-cert'
[Thu Aug 29 17:57:37 UTC 2019] ACME_AGREEMENT='https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf'
[Thu Aug 29 17:57:37 UTC 2019] ACME_NEW_NONCE='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
[Thu Aug 29 17:57:37 UTC 2019] ACME_VERSION='2'
[Thu Aug 29 17:57:37 UTC 2019] _on_before_issue
[Thu Aug 29 17:57:37 UTC 2019] _chk_main_domain='destiny2.cz'
[Thu Aug 29 17:57:37 UTC 2019] _chk_alt_domains='www.destiny2.cz'
[Thu Aug 29 17:57:37 UTC 2019] '/home/nginx/domains/destiny2.cz/public' does not contain 'no'
[Thu Aug 29 17:57:37 UTC 2019] Le_LocalAddress
[Thu Aug 29 17:57:37 UTC 2019] d='destiny2.cz'
[Thu Aug 29 17:57:37 UTC 2019] Check for domain='destiny2.cz'
[Thu Aug 29 17:57:37 UTC 2019] _currentRoot='/home/nginx/domains/destiny2.cz/public'
[Thu Aug 29 17:57:37 UTC 2019] d='www.destiny2.cz'
[Thu Aug 29 17:57:37 UTC 2019] Check for domain='www.destiny2.cz'
[Thu Aug 29 17:57:37 UTC 2019] _currentRoot='/home/nginx/domains/destiny2.cz/public'
[Thu Aug 29 17:57:37 UTC 2019] d
    I have no clue whats wrong all shoud be good
     
  2. Aug 31, 2019 #2
    EckyBrazzz

    EckyBrazzz Active Member

    589
    125
    43
    Mar 28, 2018
    >>>>Click here<<<< i'm nearby......
    Ratings:
    +231
    Local Time:
    10:23 AM
    1.17.x
    10.3.x
    Site gives (after accepting risk to continue)
    500 Internal Server Error
    nginx

    Might want to recompile something at centmin menu #4 to get it fixed.

    These I had also several times this week:
    Code (Text):
    '/home/nginx/domains/domain.com/public' does not contain 'dns'
'/home/nginx/domains/domain.com/public' does not contain 'no'

    Still don't have a clue why. Changed domain register for that domain and problem was gone.

    When you create a post: Don't post domains/passwords etc. that are in log files. Change that info (domain.com), remove passwords etc. Safety first.
     
    Last edited: Aug 31, 2019
    • Informative Informative x 1
  3. Aug 31, 2019 #3
    eva2000

    eva2000 Administrator Staff Member

    41,350
    9,279
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +14,236
    Local Time:
    11:23 PM
    Nginx 1.17.x
    MariaDB 5.5/10.x
    First try running your intended SSL certificate domain through the letsdebug.net online testing tool to check for potential errors with HTTP-01 validation.

    How was the initial letsencrypt ssl certificate obtained ? Which method ?
    • Was the domain nginx vhost alreadying created prior or new domain nginx vhost site setup for first time ?
    • Via centmin.sh menu option 2, 22, /usr/bin/nv ?
    • If you ran centmin.sh menu option 2 or 22, which letsencrypt option did you select from
      Code (Text):
      -------------------------------------------------------------
Setup full Nginx vhost + Wordpress + WP Plugins
-------------------------------------------------------------

Enter vhost domain name you want to add (without www. prefix): acme3.domain1.com

Create a self-signed SSL certificate Nginx vhost? [y/n]: n
Get Letsencrypt SSL certificate Nginx vhost? [y/n]: y

You have 4 options:
1. issue staging test cert with HTTP + HTTPS
2. issue staging test cert with HTTPS default
3. issue live cert with HTTP + HTTPS
4. issue live cert with HTTPS default
Enter option number 1-4: 1
    • Via addons/acmetool.sh ? which specific command ? examples
      Code (Text):
      ./acmetool.sh issue acme.domain.com
      Code (Text):
      ./acmetool.sh issue acme.domain.com live
      Code (Text):
      ./acmetool.sh issue acme.domain.com d
      Code (Text):
      ./acmetool.sh issue acme.domain.com lived
    • What was order of steps you did ? Did you run centmin.sh menu option 2 first with letsencrypt ? Then did you run addons/acmetool.sh afterwards ?

    Centmin Mod Self-Signed SSL Fallback



    If you're seeing a Centmin Mod's self-signed ssl certificate instead of letsencrypt ssl certificate, then that's acmetool.sh and centminmod's fallback if letsencrypt verification fails to obtain letsencrypt ssl cert, it falls back to centmin mod self-signed ssl certificate on https port 443 side so to preserve the https nginx vhost

    Troubleshooting



    There are various steps you can do to troubleshoot failed letsencrypt issuances, renews, reissues etc.
    • acmetool.sh logs all command line or shell menu runs to log files at /root/centminlogs. To troubleshoot, copy the contents of the log run and post contents of log to pastebin.com or gist.github.com and share link in this thread. To find the log list the logs in ascending date order
      Code (Text):
      ls -lahrt /root/centminlogs
      .
    • For direct acmetool.sh runs, there should be a 2nd & 3rd & 4th log in format /root/centminlogs/centminmod_${DT}_nginx_addvhost_nv.log and /root/centminlogs/acmetool.sh-debug-log-$DT.log and /root/centminlogs/acmesh-issue_*.log or /root/centminlogs/acmesh-reissue_*.log which would need to be included via separate pastebin.com or gist.github.com post.
    • Enable acmetool.sh debug mode. In persistent config file at /etc/centminmod/custom_config.inc (create it if doesn't exist) add and enable acmetool.sh debug mode which gives much more verbose letsencrypt issuance process information when you re-run acmetool.sh or centmin.sh menu options 2, 22 or /usr/bin/nv command lines.
      Code (Text):
      ACMEDEBUG='y'
    If acme.sh auto renewals didn't happen, check output for the following commands
    Code (Text):
    grep acme /var/log/cron* | sed -e "s|$(hostname -s)|host|g"

    Code (Text):
    echo y | /usr/local/src/centminmod/addons/acmetool.sh checkdates

    Code (Text):
    "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh"

    Code (Text):
    echo | openssl s_client -connect yourdomain.com:443

    Without the answers to above questions and logs, there is nothing to help troubleshoot.

    SSLLabs Test



    Also run your HTTPS domain site through SSLLabs tester at SSL Server Test (Powered by Qualys SSL Labs) if it says untrusted SSL cert and prompts to continue the test, continue the test.
     
Previous Thread Next Thread
Loading...

.