Letsencrypt Official acmetool.sh testing thread for Centmin Mod 123.09beta01

did you create nginx vhost separately before running

Code (Text):

./acmetool.sh acmeinstall
./acmetool.sh issue centmintest.com lived

that could of been problem as you don't need to create it separately as the last command does that too

---

 

did you create nginx vhost separately before running

ah you did create separately that's why !

these updates should fix that specifically

• Beta Branch - acmetool.sh 1.0.2 ensure nginx ssl directory exists | Centmin Mod Community
• Beta Branch - fix directory check in 123.09beta01 | Centmin Mod Community

 

It should. Just the assumption was /usr/local/nginx/conf/ssl/centmintest.com/ would of been created by acmetool.sh via /usr/bin/nv when it sets up self-signed ssl cert routine which is created regardless of you answering no if letsencrypt is detected. Should be fixed with Beta Branch - acmetool.sh 1.0.2 ensure nginx ssl directory exists | Centmin Mod Community

 

Thanks @pamamolf for the info. Will check it out

I think i know what's going on. If you created a non-selfsigned ssl cert nginx vhost with Centmin Mod centmin.sh menu options 2, 22 or /usr/bin/nv command, then /usr/local/nginx/conf/ssl/yourdomain.com directory and the self-signed ssl cert files don't exist. Then acmetool.sh currently detects if /usr/local/nginx/conf/conf.d/yourdomain.com.ssl.conf exists or not for HTTPS nginx vhost and if doesn't exist, creates it via the self-signed ssl cert creation routine. (So i should check more than just /usr/local/nginx/conf/conf.d/yourdomain.com.ssl.conf existence to trigger the self-signed ssl cert creation routine. I should also check for /usr/local/nginx/conf/ssl/yourdomain.com existence and the self-signed ssl certificates within it to determine if self-signed ssl cert creation routine should be triggered)

Then when acmetool.sh successfully uses acme.sh client to get a letsencrypt ssl certificate, it auto replaces the self-signed ssl certificate with letencrypt ssl certificate. If acme.sh client fails verification of your domain and can not get letsencrypt ssl certificate, it falls back to and leaves self-signed ssl certificate.

 

@pamamolf added fix for this issue where nginx vhost was created prior with no self-signed ssl cert setup. So update to latest 123.09beta01

example if you issue with newdomain.com previously created with self-signed ssl setup answer = no

Code (Text):

addons/acmetool.sh issue newdomain.com

You'll see an extra segment of output at the beginning triggering the self-signed ssl cert check and generation.

Code (Text):

[self-signed ssl cert check] required by acmetool.sh

/usr/local/nginx/conf/ssl/newdomain.com ~/tools/acme.sh
---------------------------------------------------------------
Generating self signed SSL certificate...
CSR file can also be used to be submitted for paid SSL certificates
If using for paid SSL certificates be sure to keep both private key and CSR safe
creating CSR File: newdomain.com.csr
creating private key: newdomain.com.key
creating self-signed SSL certificate: newdomain.com.crt
openssl req -new -newkey rsa:2048 -sha256 -nodes -out newdomain.com.csr -keyout newdomain.com.key -subj "/C=/ST=/L=/O=newdomain.com/OU=newdomain.com/CN=newdomain.com"
Generating a 2048 bit RSA private key
....................+++
............................................................................................................................+++
writing new private key to 'newdomain.com.key'
-----
openssl x509 -req -days 36500 -sha256 -in newdomain.com.csr -signkey newdomain.com.key -out newdomain.com.crt
Signature ok
subject=/O=newdomain.com/OU=newdomain.com/CN=newdomain.com
Getting Private key

---------------------------------------------------------------
Generating dhparam.pem file - can take a few minutes...
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
.....+......+*
dhparam file generation time: 66.134662728

 

your cloudflare config is redirecting https requests to http and then nginx is redirecting http to https LOL

Code (Text):

curl -I https://centmintest.com
HTTP/1.1 301 Moved Permanently
Date: Fri, 23 Sep 2016 10:49:07 GMT
Connection: keep-alive
Set-Cookie: __cfduid=d42c7711ee0c69e8990573a5c0e63bb681474627747; expires=Sat, 23-Sep-17 10:49:07 GMT; path=/; domain=.centmintest.com; HttpOnly
Location: http://centmintest.com/
Server: cloudflare-nginx
CF-RAY: 2e6d6d9e2d3d3828-ATL

Code (Text):

curl -I http://centmintest.com
HTTP/1.1 302 Moved Temporarily
Date: Fri, 23 Sep 2016 10:49:55 GMT
Content-Type: text/html
Connection: keep-alive
Set-Cookie: __cfduid=deee4af0a45d336c31b3daf0a23a8bdb21474627795; expires=Sat, 23-Sep-17 10:49:55 GMT; path=/; domain=.centmintest.com; HttpOnly
Location: https://centmintest.com/
X-Powered-By: centminmod
Server: cloudflare-nginx
CF-RAY: 2e6d6ec9f7443870-ATL

 

there's no options for cloudflare to redirect https to http unless you have a page rule set i don't think.

 

Strange that doesn't happen for my cloudflare based domains. Might want to contact cloudflare support to ask. Could be you need to go into Cloudflare DNS only mode to use own HTTPS based sites.

 

check browser security console tab, if cloudflare is active with cache/protection you will use cloudflare's ssl certificates

 

save time, just ask cloudflare support