/ Register

Join the community today
Register Now

Letsencrypt Let's encrypt will work on subdomain using a Cname record?

Discussion in 'Domains, DNS, Email & SSL Certificates' started by pamamolf, Jul 3, 2019.

Previous Thread Next Thread
Loading...
Page 2 of 2
  1. Jul 6, 2019 #21
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    Code:
    16:  include /usr/local/nginx/conf/ssl_include.conf;
19:  #ssl_client_certificate /usr/local/nginx/conf/ssl/cloudflare/cdn.mydomain.com/origin.crt;
20:  #ssl_verify_client on;
24:  ssl_ciphers TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS;
25:  ssl_prefer_server_ciphers   on;
35:  ssl_buffer_size 1369;
36:  ssl_session_tickets on;
41:  #ssl_stapling on;
42:  #ssl_stapling_verify on;
    and:

    Code:
    -rw-r--r-- 1 root root  424 Dec 25  2018 dhparam.pem
-rw-r--r-- 1 root root 1.7K Jul  2 23:24 cdn.mydomain.com.key
-rw-r--r-- 1 root root 1.1K Jul  2 23:24 cdn.mydomain.com.csr
-rw-r--r-- 1 root root 1.4K Jul  2 23:24 cdn.mydomain.com.crt
drwxr-xr-x 7 root root 4.0K Jul  4 20:32 ..
-rw-r--r-- 1 root root 1.7K Jul  4 22:09 cdn.mydomain.com-acme.cer
-rw------- 1 root root 1.7K Jul  4 22:09 cdn.mydomain.com-acme.key
drwxr-xr-x 2 root root 4.0K Jul  4 22:09 .
-rw-r--r-- 1 root root 3.6K Jul  4 22:09 cdn.mydomain.com-fullchain-acme.key
-rw-r--r-- 1 root root  749 Jul  4 22:24 cdn.mydomain.com.crt.key.conf

     
  2. Jul 6, 2019 #22
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    besides uncommenting these 2 for OCSP stapling
    Code (Text):
    #ssl_stapling on;
#ssl_stapling_verify on;

    everything looks in order for it to work
     
  3. Jul 6, 2019 #23
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    I uncomment the two values and try to restart Nginx but i got the same error :(
    Code:
    Starting nginx: nginx: [emerg] SSL_CTX_use_PrivateKey("/usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key") failed (SSL: err...alues mismatch)
    There is a missmatch with a private key and something related to:
    Code:
    /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key
    Don't know why and what i can try :(
     
  4. Jul 6, 2019 #24
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    output for command
    Code (Text):
    ls -lahrt /root/.acme.sh/cdn.mydomain.com/


    have you previously used acmetool.sh, centmin.sh menu option 2, 22 or nv commands to create cdn.mydomain.com so that previous letsencrypt ssl certificate has been issue ?

    check acme.sh's version of the private key /root/.acme.sh/cdn.mydomain.com/cdn.mydomain.com.key is same as acme.sh installed one at /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key

    output for command
    Code (Text):
    diff -q /root/.acme.sh/cdn.mydomain.com/cdn.mydomain.com.key /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key

    if returns to prompt with no message = same

    otherwise diff will report the 2 files differ
     
  5. Jul 6, 2019 #25
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    ls -lahrt /root/.acme.sh/cdn.mydomain.com/
    Code:
    -rw-r--r--  1 root root 1.7K Jul  2 23:33 cdn.mydomain.com.key
drwx------ 10 root root 4.0K Jul  4 21:27 ..
-rw-r--r--  1 root root  220 Jul  4 21:27 cdn.mydomain.com.csr.conf
-rw-r--r--  1 root root 1005 Jul  4 21:27 cdn.mydomain.com.csr
-rw-r--r--  1 root root 3.6K Jul  4 21:28 fullchain.cer
-rw-r--r--  1 root root 1.7K Jul  4 21:28 ca.cer
drwxr-xr-x  3 root root 4.0K Jul  4 21:36 .
-rw-r--r--  1 root root    0 Jul  4 21:36 cdn.mydomain.com.cer
drwxr-xr-x  2 root root 4.0K Jul  4 21:36 backup
-rw-r--r--  1 root root 1.1K Jul  4 22:09 cdn.mydomain.com.conf
    Yes i create using menu 2 the subdomain first with self signed certificate and then i try to use Let's encrypt as usual (only HTTPS live) but as i didn't had the A record it was failed. Probably fall back to self signed again as Nginx was working after that....

    Code:
    diff -q /root/.acme.sh/cdn.mydomain.com/cdn.mydomain.com.key /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key
    output nothing so the same...

    Then i did all the above following your instructions.

    Thank you
     
    Last edited: Jul 6, 2019
  6. Jul 6, 2019 #26
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    strange from ls output key is 2 days older than rest of letsencrypt issued/installed files via acme.sh
    Code (Text):
    -rw-r--r--  1 root root 1.7K Jul  2 23:33 cdn.mydomain.com.key
drwx------ 10 root root 4.0K Jul  4 21:27 ..
-rw-r--r--  1 root root  220 Jul  4 21:27 cdn.mydomain.com.csr.conf
-rw-r--r--  1 root root 1005 Jul  4 21:27 cdn.mydomain.com.csr
-rw-r--r--  1 root root 3.6K Jul  4 21:28 fullchain.cer
-rw-r--r--  1 root root 1.7K Jul  4 21:28 ca.cer
drwxr-xr-x  3 root root 4.0K Jul  4 21:36 .
-rw-r--r--  1 root root    0 Jul  4 21:36 cdn.mydomain.com.cer
drwxr-xr-x  2 root root 4.0K Jul  4 21:36 backup
-rw-r--r--  1 root root 1.1K Jul  4 22:09 cdn.mydomain.com.conf

    try renaming /usr/local/nginx/conf/ssl/cdn.mydomain.com/ directory and emptying it out and doing acme.sh install command again

    4 cmds to run
    Code (Text):
    cd /usr/local/nginx/conf/ssl/
cp -a /usr/local/nginx/conf/ssl/cdn.mydomain.com/ /usr/local/nginx/conf/ssl/cdn.mydomain.com.old/
rm -rf /usr/local/nginx/conf/ssl/cdn.mydomain.com/*
/root/.acme.sh/acme.sh --installcert -d cdn.mydomain.com --certpath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer --keypath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key --capath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer --reloadCmd /usr/bin/ngxreload --fullchainpath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-fullchain-acme.key
ngxrestart
     
  7. Jul 6, 2019 #27
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    Ok i did it and i got this:
    Code:
    [Fri Jul  5 21:50:33 UTC 2019] Installing cert to:/usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer
[Fri Jul  5 21:50:33 UTC 2019] Installing CA to:/usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer
[Fri Jul  5 21:50:33 UTC 2019] Installing key to:/usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key
[Fri Jul  5 21:50:33 UTC 2019] Installing full chain to:/usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-fullchain-acme.key
[Fri Jul  5 21:50:33 UTC 2019] Run reload cmd: /usr/bin/ngxreload
Reloading nginx configuration (via systemctl):  Job for nginx.service invalid.
                                                           [FAILED]
[Fri Jul  5 21:50:33 UTC 2019] Reload error for :
    systemctl status nginx.service

    Code:
    Starting nginx: nginx: [emerg] open() "/usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com.crt.key.conf" failed (2: No such file or di...nfo.ssl.conf:15
    Line 15:
    Code:
      include /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com.crt.key.conf;
    So i copy it from:
    Code:
    /usr/local/nginx/conf/ssl/cdn.mydomain.com.old/cdn.mydomain.com.crt.key.conf
    and i add it to:
    Code:
    /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com.crt.key.conf
    Content of the folder:
    Code:
    /usr/local/nginx/conf/ssl/cdn.mydomain.com
    Code:
    -rw-r--r--  1 root root 1.7K Jul  2 23:33 cdn.mydomain.com.key
drwx------ 10 root root 4.0K Jul  4 21:27 ..
-rw-r--r--  1 root root  220 Jul  4 21:27 cdn.mydomain.com.csr.conf
-rw-r--r--  1 root root 1005 Jul  4 21:27 cdn.mydomain.com.csr
-rw-r--r--  1 root root 3.6K Jul  4 21:28 fullchain.cer
-rw-r--r--  1 root root 1.7K Jul  4 21:28 ca.cer
drwxr-xr-x  3 root root 4.0K Jul  4 21:36 .
-rw-r--r--  1 root root    0 Jul  4 21:36 cdn.mydomain.com.cer
drwxr-xr-x  2 root root 4.0K Jul  4 21:36 backup
-rw-r--r--  1 root root 1.1K Jul  5 21:50 cdn.mydomain.com.conf
    Content of the file:
    Code:
    /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com.crt.key.conf
    Code:
      ssl_dhparam /usr/local/nginx/conf/ssl/cdn.mydomain.com/dhparam.pem;
  ssl_certificate      /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/cdn.supereventforall.info/cdn.mydomain.com-acme.key;
  ssl_trusted_certificate /usr/local/nginx/conf/ssl/cdn.supereventforall.info/cdn.mydomain.com-acme.cer;
    ngxrestart output again issue with the Private key mismatch:
    Code:
    Starting nginx: nginx: [emerg] SSL_CTX_use_PrivateKey("/usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key") failed (SSL: err...alues mismatch)
    It is a test server and i can provide you login info if you want to check it....
     
  8. Jul 6, 2019 #28
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    try emptying out acme.sh directory /root/.acme.sh/cdn.mydomain.com and re-run acmetool.sh cert only mode + renaming /usr/local/nginx/conf/ssl/cdn.mydomain.com/ directory and emptying it out and doing acme.sh install command again

    8 cmds to run
    Code (Text):
    cd /root/.acme.sh/
rm -rf /root/.acme.sh/cdn.mydomain.com
./acmetool.sh certonly-issue cdn.mydomain.com live
cd /usr/local/nginx/conf/ssl/
cp -a /usr/local/nginx/conf/ssl/cdn.mydomain.com/ /usr/local/nginx/conf/ssl/cdn.mydomain.com.old2/
rm -rf /usr/local/nginx/conf/ssl/cdn.mydomain.com/*
/root/.acme.sh/acme.sh --installcert -d cdn.mydomain.com --certpath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer --keypath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key --capath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer --reloadCmd /usr/bin/ngxreload --fullchainpath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-fullchain-acme.key
ngxrestart
     
  9. Jul 7, 2019 #29
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    I did exactly all the above except running the acmetool.sh from /root/.acme.sh/ as i didn't have that tool there and i run it from cd /usr/local/src/centminmod/addons/

    All seems to be ok and i got this info:
    Code:
    cdn.mydomain.com is already verified, skip dns-01.
Cert success
    But at the end Nginx reload didn't work again :(

    Then i try to restart it manually using: ngxrestart and i got FAILED

    Code:
    systemctl status nginx.service
    Output:
    Code:
    Starting nginx: nginx: [emerg] open() "/usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com.crt.key.conf" failed (2: No such file or di...nfo.ssl.conf:15
    so i create the file:
    Code:
    /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com.crt.key.conf
    and i add inside:
    Code:
      ssl_dhparam /usr/local/nginx/conf/ssl/cdn.mydomain.com/dhparam.pem;
  ssl_certificate      /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key;
  ssl_trusted_certificate /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer;
    and then restart Nginx again and got FAILED but with another error this time.
    Code:
    systemctl status nginx.service
    Output:
    Code:
    Starting nginx: nginx: [emerg] BIO_new_file("/usr/local/nginx/conf/ssl/cdn.mydomain.com/dhparam.pem") failed (SSL: error:02001002:system library:fopen:No such file or...
    So i copy from the .old folder the dhparam.pem and place it at the correct folder.
    Code:
    ls -lahrt ls -lahrt /usr/local/nginx/conf/ssl/cdn.mydomain.com/
    Code:
    -rw-r--r-- 1 root root  424 Dec 25  2018 dhparam.pem
drwxr-xr-x 9 root root 4.0K Jul  6 13:20 ..
-rw-r--r-- 1 root root 3.6K Jul  6 13:21 cdn.mydomain.com-acme.cer
-rw------- 1 root root 1.7K Jul  6 13:21 cdn.mydomain.com-acme.key
-rw-r--r-- 1 root root 3.6K Jul  6 13:21 cdn.mydomain.com-fullchain-acme.key
-rw-r--r-- 1 root root  415 Jul  6 13:29 cdn.mydomain.com.crt.key.conf
drwxr-xr-x 2 root root 4.0K Jul  6 13:38 .
    Then i restart Nginx and now it works !!!!!!

    WOW SUPER !!!!

    But on the site when i disable Cloudflare Ii can see the green lock and let's encrypt info there with no warnings or any problems but when i try to open homepage my images are not loading and from the inspect from Chrome i can see this error:
    Code:
    Failed to load resource: net::ERR_CERT_COMMON_NAME_INVALID
    Checking on the net i found this:
    If you happened to have a self-signed certificate that was created before the change linked below the newer browsers definitely didn't like it because they now require the FQDN of the system in the SubjectAltName field of the certificate.

    Solution something like this?

    Chrome Deprecates Subject CN Matching

    Apparently the solution is to instruct openssl to generate a V3 compatible subjectAltName...

    Thank you
     
  10. Jul 7, 2019 #30
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Interesting will need to read up on this
    where are images being loaded from cdn.mydomain.com without cloudflare ? they should be served via letsencrypt ssl issued ssl cert
     
  11. Jul 7, 2019 #31
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    updated 123.09beta01's self-signed ssl certificate generation routines now so future generated self-signed ssl certificates include the v3 subjectAltName fields :)

    selfsigned-ssl-sans-01.png
     
  12. Jul 7, 2019 #32
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    Should i re do the:

    Code:
    cd /root/.acme.sh/
rm -rf /root/.acme.sh/cdn.mydomain.com
./acmetool.sh certonly-issue cdn.mydomain.com live
cd /usr/local/nginx/conf/ssl/
cp -a /usr/local/nginx/conf/ssl/cdn.mydomain.com/ /usr/local/nginx/conf/ssl/cdn.mydomain.com.old2/
rm -rf /usr/local/nginx/conf/ssl/cdn.mydomain.com/*
/root/.acme.sh/acme.sh --installcert -d cdn.mydomain.com --certpath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer --keypath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.key --capath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-acme.cer --reloadCmd /usr/bin/ngxreload --fullchainpath /usr/local/nginx/conf/ssl/cdn.mydomain.com/cdn.mydomain.com-fullchain-acme.key
ngxrestart
    to test it?

    As that change is related to the previous self signed certificates ?
     
    Last edited: Jul 8, 2019
  13. Jul 8, 2019 #33
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    When Cloudflare is disabled the images are coming from Wasabi Cloud....
     
  14. Jul 8, 2019 #34
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    it wouldn't change it if wasabi is one serving the images though but you can try

    then that problem would be wasabi ssl certificate configuration
     
  15. Jul 19, 2019 #35
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    Does that help?
    [​IMG]
     
  16. Jul 19, 2019 #36
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Wasabi needs to provide the SSL cert for your cdn.mydomain.com just like Amazon AWS Cloudfront, Sucuri Cloudproxy and Cloudflare would do for CDN accelerated files.
     
  17. Jul 31, 2019 #37
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
  18. Aug 1, 2019 #38
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
  19. Aug 1, 2019 #39
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    4:07 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    Don't know :(

    This is what i got as a reply:

     
Previous Thread Next Thread
Loading...
Page 2 of 2

.