Letsencrypt Official acmetool.sh testing thread for Centmin Mod 123.09beta01

eva2000 · Sep 28, 2016

Yup just fixed that too Help Design a new Nginx vhost index.html page template | Centmin Mod Community

replace in index.html template
Code (Text):
http://yui.yahooapis.com/pure/0.6.0
with
Code (Text):
//centminmod.com/purecss

dorobo · Sep 28, 2016

I got this when trying to get a live certificate using

Code (Text):

./acmetool.sh issue peristal.xyz lived

result:

Code (Text):

-----------------------------------------------------------
issue & install letsencrypt ssl certificate for peristal.xyz
-----------------------------------------------------------
testcert value = lived
/root/.acme.sh/acme.sh --issue -d peristal.xyz -d www.peristal.xyz -w /home/nginx/domains/peristal.xyz/public -k 2048 --useragent centminmod-centos7-acmesh-webroot --log /root/centminlogs/acmetool.sh-debug-log-280916-160855.log --log-level 2
[Wed Sep 28 16:08:59 PHT 2016] Skip, Next renewal time is: Sat Dec 17 07:54:49 UTC 2016
[Wed Sep 28 16:08:59 PHT 2016] Add '--force' to force to renew.
LECHECK = 2

issue skipped as ssl cert still valid

so it doesn't know how to differentiate a testing certificate from a live one? Or it's just that the testing one doesn't count towards your limit but it still regarded a valid certificate?

eva2000 · Sep 28, 2016

dorobo said: ↑

so it doesn't know how to differentiate a testing certificate from a live one? Or it's just that the testing one doesn't count towards your limit but it still regarded a valid certificate?
Click to expand...

use the checkdates function to list all your ssl certs obtained, nginx installed ones are live or staging installed while acme.sh listed ones will include dns validated ssl certs if you use certonly mode as well as identify live ssl certs by also listing a crt.sh url link to the ssl certificate transparency list only for live ssl certificates.

You can then use the SHA1 hash fingerprint listed to check if your peristal.xyz ssl certificate previously had a live ssl certificate issued as it will be still valid for up to 90 days from issue. i.e. if you issued live, then issued staging, then live again, you would get above message to skip renewal if the first live issuance was within 90 days of the 2nd live issuance attempt

post output for
Code (Text):
cd /usr/local/src/centminmod/addons
./acemtool.sh checkdates
if you want to use live again though, you can just use reissue instead of issue as that triggers --force

dorobo · Sep 28, 2016

nothing happened

Code (Text):

]# ./acmetool.sh checkdates

-------------------------------------------------
acmetool.sh is in beta testing phase
please read & provide bug reports &
feedback for this tool via the forums
https://community.centminmod.com/posts/34492/
-------------------------------------------------

continue [y/n] ? y
[root@localhost addons]#

eva2000 · Sep 28, 2016

can you post to pastebin.com or gist.github.com output for the diagnostic run with bash -x
Code (Text):
cd /usr/local/src/centminmod/addons
bash -x acmetool.sh checkdates

dorobo · Sep 28, 2016

ok please don't mind my previous post

So I repeated it again, a newly installed CentOS 7, issuing a cert on staging using
Code (Text):
 ./acmetool.sh issue peristal.xyz d
and then went live using a reissue
Code (Text):
 ./acmetool.sh reissue peristal.xyz lived
but I get this

[Apache Log] acmetool.sh-debug-log-280916-200714 - Pastebin.com

dorobo · Sep 28, 2016

and here is checkdates

Code (Text):

]# ./acmetool.sh checkdates

-------------------------------------------------
acmetool.sh is in beta testing phase
please read & provide bug reports &
feedback for this tool via the forums
https://community.centminmod.com/posts/34492/
-------------------------------------------------

continue [y/n] ? y
----------------------------------------------
nginx installed
----------------------------------------------

/usr/local/nginx/conf/ssl/peristal.xyz/peristal.xyz-acme.cer
SHA1 Fingerprint=8ABE34FAFA2A649E9B3A86FCF626825395A84C09
certificate expires in 89 days on 27 Dec 2016

----------------------------------------------
acme.sh obtained
----------------------------------------------

/root/.acme.sh/peristal.xyz/peristal.xyz.cer
SHA1 Fingerprint=8ABE34FAFA2A649E9B3A86FCF626825395A84C09
certificate expires in 89 days on 27 Dec 2016

eva2000 · Sep 28, 2016

dorobo said: ↑

[Apache Log] acmetool.sh-debug-log-280916-200714 - Pastebin.com
Click to expand...

same problem as before you're getting 404 not found
Code (Text):
[Wed Sep 28 20:07:29 PHT 2016] error='"error":{"type":"urn:acme:error:unauthorized","detail":"Invalid response from http://peristal.xyz/.well-known/acme-challenge/2U8un0VOrAuCLjAYYDWyXrnX-HqQPfkkRJsQjNPf_W8: "<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>"","status": 403}'
[Wed Sep 28 20:07:29 PHT 2016] errordetail='Invalid response from http://peristal.xyz/.well-known/acme-challenge/2U8un0VOrAuCLjAYYDWyXrnX-HqQPfkkRJsQjNPf_W8: '
I think the problem is you running staging default https before live default https.

Try removing vhost, these's a new outpu remove cmd log which commands to remove the vhost and then just try a lived https default run

eva2000 · Sep 28, 2016

dorobo said: ↑
and here is checkdates
Code (Text):
]# ./acmetool.sh checkdates

-------------------------------------------------
acmetool.sh is in beta testing phase
please read & provide bug reports &
feedback for this tool via the forums
https://community.centminmod.com/posts/34492/
-------------------------------------------------

continue [y/n] ? y
----------------------------------------------
nginx installed
----------------------------------------------

/usr/local/nginx/conf/ssl/peristal.xyz/peristal.xyz-acme.cer
SHA1 Fingerprint=8ABE34FAFA2A649E9B3A86FCF626825395A84C09
certificate expires in 89 days on 27 Dec 2016

----------------------------------------------
acme.sh obtained
----------------------------------------------

/root/.acme.sh/peristal.xyz/peristal.xyz.cer
SHA1 Fingerprint=8ABE34FAFA2A649E9B3A86FCF626825395A84C09
certificate expires in 89 days on 27 Dec 2016
Click to expand...
same SHA1 finger print, so acme.sh obtained one is same as installed on on nginx. But acme.sh obtained ssl listing doesn't list a crt.sh url link so it means the ssl cert you have currently is the staging test ssl cert and not live ssl cert (obviously as it failed verification on recent live ssl cert reissue)

dorobo · Sep 28, 2016

So in other words you can't just transfer from staging to live via acme.sh without deleting the vhost conf?

eva2000 · Sep 28, 2016

dorobo said: ↑

So in other words you can't just transfer from staging to live via acme.sh without deleting the vhost conf?
Click to expand...

i'll have to investigate and see but looks like it due to how default https is setup in general. The steps are

acmetool.sh for https default setup:

If site vhost doesn't exist at /home/nginx/domains/domain.com then trigger nv command line method of nginx vhost setup with -s ydle flag to create both domain.com.conf and domain.com.ssl.conf.

Then acmetool.sh triggers acme.sh client to use web root authentication with letsencrypt servers to verify domain.com is valid with valid DNS A record pointing to server IP.

When letsencrypt issues the ssl cert staging or live via acme.sh client it saves to /root/.acme.sh/domain.com directory

Then acmetool.sh installs and copies over from /root/.acme.sh/domain.com the ssl files via acme.sh installcert command to /usr/local/nginx/conf/ssl/domain.com directory and updates domain.com.ssl.conf ssl vhost replacing existing self-signed ssl certs created by nv command with letsencrypt ssl certs using /usr/local/nginx/conf/ssl/domain.com path.

Then acmetool.sh if ssl cert issue is verified and valid, removes the domain.com.conf non-https vhost file and via sed enables the 302 http to https redirect server context in domain.com.ssl.conf vhost

I think when you run lived https default acmetool.sh you are might be still missing domain.com.conf non-https so verification of domain via webroot authentication isn't working OR the 302 http to https redirect created in 1st staging https default run didn't get sed replaced properly so letsencrypt servers accessing http isn't getting redirected to https.

can you post output of your domain.com.ssl.conf after the 2nd lived https default run to confirm

dorobo · Sep 28, 2016

Code (Text):

# Centmin Mod Getting Started Guide
# must read http://centminmod.com/getstarted.html
# For HTTP/2 SSL Setup
# read http://centminmod.com/nginx_configure_https_ssl_spdy.html

# redirect from www to non-www  forced SSL
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
#x# server {
#x#   
#x#   server_name peristal.xyz www.peristal.xyz;
#x#   return 302 https://$server_name$request_uri;
#x#   include /usr/local/nginx/conf/staticfiles.conf;
#x# }

server {
  listen 443 ssl http2;
  server_name peristal.xyz www.peristal.xyz;

  ssl_dhparam /usr/local/nginx/conf/ssl/peristal.xyz/dhparam.pem;
  ssl_certificate      /usr/local/nginx/conf/ssl/peristal.xyz/peristal.xyz.crt;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/peristal.xyz/peristal.xyz.key;
  include /usr/local/nginx/conf/ssl_include.conf;

  http2_max_field_size 16k;
  http2_max_header_size 32k;
  # mozilla recommended
  ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+ECDSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+SHA384:EECDH+AES128:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!CAMELLIA;
  ssl_prefer_server_ciphers   on;
  #add_header Alternate-Protocol  443:npn-spdy/3;

  #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;
  #spdy_headers_comp 5;
  ssl_buffer_size 1369;
  ssl_session_tickets on;
 
  # enable ocsp stapling
  #resolver 8.8.8.8 8.8.4.4 valid=10m;
  #resolver_timeout 10s;
  #ssl_stapling on;
  #ssl_stapling_verify on;
  #ssl_trusted_certificate /usr/local/nginx/conf/ssl/peristal.xyz/peristal.xyz-trusted.crt; 

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/peristal.xyz/log/access.log main_ext buffer=256k flush=60m;
  error_log /home/nginx/domains/peristal.xyz/log/error.log;

  include /usr/local/nginx/conf/autoprotect/peristal.xyz/autoprotect-peristal.xyz.conf;
  root /home/nginx/domains/peristal.xyz/public;
  # uncomment cloudflare.conf include if using cloudflare for
  # server and/or vhost site
  #include /usr/local/nginx/conf/cloudflare.conf;
  include /usr/local/nginx/conf/503include-main.conf;

  location / {
  include /usr/local/nginx/conf/503include-only.conf;

# block common exploits, sql injections etc
#include /usr/local/nginx/conf/block.conf;

  # Enables directory listings when index file not found
  #autoindex  on;

  # Shows file listing times as local time
  #autoindex_localtime on;

  # Enable for vBulletin usage WITHOUT vbSEO installed
  # More example Nginx vhost configurations at
  # http://centminmod.com/nginx_configure.html
  #try_files    $uri $uri/ /index.php;

  }

  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/php.conf;
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

eva2000 · Sep 28, 2016

yup as suspected the sed replace to enable http to https 302 redirect was not processed so still commented out
Code (Text):
# redirect from www to non-www  forced SSL
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
#x# server {
#x#   
#x#   server_name peristal.xyz www.peristal.xyz;
#x#   return 302 https://$server_name$request_uri;
#x#   include /usr/local/nginx/conf/staticfiles.conf;
#x# }
will need to fix this for subsequent issue/reissue run times

dorobo · Sep 28, 2016

I tried with another domain using

./acmetool.sh issue domain.com

and then

./acmetool.sh reissue domain.com live

and it works okay.

so the problem is with https only

dorobo · Sep 28, 2016

I did checkdates and found this on the other domain

Code (Text):

/root/.acme.sh/domain.xyz/domain.xyz.cer
SHA1 Fingerprint=53AEEFED7D2D540A011B09167D27577EB330150F
[ link maybe 404 not found, certifcate transparency logged ~1hr after issuance ]
https://crt.sh/?sha1=53AEEFED7D2D540A011B09167D27577EB330150F
certificate expires in 89 days on 27 Dec 2016

/root/.acme.sh/peristal.xyz/peristal.xyz.cer
SHA1 Fingerprint=8ABE34FAFA2A649E9B3A86FCF626825395A84C09
certificate expires in 89 days on 27 Dec 2016

what is "[ link maybe 404 not found, certifcate transparency logged ~1hr after issuance ]"

eva2000 · Sep 28, 2016

dorobo said: ↑

so the problem is with https only
Click to expand...

yeah it's https only as it needs the http to https 302 redirect working for subsequent letsencrypt webroot authentication to pass

i have pinpointed the problem so working on the fix

dorobo said: ↑

what is "[ link maybe 404 not found, certifcate transparency logged ~1hr after issuance ]"
Click to expand...

all live letsencrypt ssl certs issues get reported to google ssl certificate transparency records which are publicly listed at crt.sh. The are only added to records 1hr after issuance. So if you just issued a letsencrypt live ssl cert, then ran checkdates and copy and paste that crt.sh link into your browser it will be 404 not found for 1st hour after issuance. Only >1hr can you visit the crt.sh to look at your issued live letsencrypt ssl certs public certificate transparency record.

edit: hmm might change that wording to below link is valid only 1hr after issuance

dorobo · Sep 28, 2016

I tried plugging the sha1 of peristal.xyz into
Code (Text):
https://crt.sh/?sha1=
so that it's
Code (Text):
https://crt.sh/?sha1=8ABE34FAFA2A649E9B3A86FCF626825395A84C09
but it also says certificate not found

eva2000 · Sep 28, 2016

dorobo said: ↑

I tried plugging the sha1 of peristal.xyz into

crt.sh | Certificate Search

so that it's

crt.sh | 8abe34fafa2a649e9b3a86fcf626825395a84c09

but it also says certificate not found
Click to expand...

yes because it's not a valid added entry link until ~1hr after issuance

dorobo · Sep 28, 2016

eva2000 said: ↑

yes because it's not a valid added entry link until ~1hr after issuance
Click to expand...

right. but shouldn't it also say the notice? (404 not found)

eva2000 · Sep 28, 2016

maybe they updated the error notice, it use to say 404 for me

Log in / Register

Forums

Want to subscribe to topics you're interested in?

Letsencrypt Official acmetool.sh testing thread for Centmin Mod 123.09beta01

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

dorobo Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

Letsencrypt Official acmetool.sh testing thread for Centmin Mod 123.09beta01

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

dorobo Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

dorobo Active Member

eva2000 Administrator Staff Member

.