Letsencrypt Official acmetool.sh testing thread for Centmin Mod 123.09beta01

Ran into a bug today. Followed the instructions for migrating a non https host over to https with a lets encrypt certificate. The example config generated on this page: https://centminmod.com/vhost.php includes the line that I had to comment out:

include /usr/local/nginx/conf/ssl_include.conf;

As in the example config alot of the ssl values are already included in the vhost config.... Here is what it told me to use:

---

Code:

# Centmin Mod Getting Started Guide
# must read http://centminmod.com/getstarted.html
# For HTTP/2 SSL Setup
# read http://centminmod.com/nginx_configure_https_ssl_spdy.html

# redirect from www to non-www  forced SSL
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
# server {
#   server_name xxx.com www.xxxk.com;
#    return 302 https://xxx.com$request_uri;
# }

server {
  listen 443 ssl http2;
  server_name xxx.com www.xxx.com;

  ssl_dhparam /usr/local/nginx/conf/ssl/xxx.com/dhparam.pem;
  ssl_certificate      /usr/local/nginx/conf/ssl/xxx.com/xxx.com-acme.cer;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/xxx.com/xxx.com-acme.key;
  include /usr/local/nginx/conf/ssl_include.conf;

  http2_max_field_size 16k;
  http2_max_header_size 32k;
  http2_max_requests 5000;
  # dual cert supported ssl ciphers
  ssl_ciphers TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS;
  ssl_prefer_server_ciphers   on;
  #add_header Alternate-Protocol  443:npn-spdy/3;
  #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;
  #spdy_headers_comp 5;
  ssl_buffer_size 1369;
  ssl_session_tickets on;
 
  # enable ocsp stapling
  #resolver 8.8.8.8 8.8.4.4 valid=10m;
  #resolver_timeout 10s;
  #ssl_stapling on;
  #ssl_stapling_verify on;
  #ssl_trusted_certificate /usr/local/nginx/conf/ssl/xxx.com/xxx.com-trusted.crt; 

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/mxxx.com/log/access.log combined buffer=256k flush=5m;
  error_log /home/nginx/domains/xxx.com/log/error.log;

  root /home/nginx/domains/xxx.com/public;

location / {
     index index.php index.html index.htm;
     try_files $uri $uri/ /index.php?$uri&$args;
}

location /admin.php {
     auth_basic "Private";
     auth_basic_user_file /usr/local/nginx/conf/htpasswd_admin_php;
        include /usr/local/nginx/conf/php.conf;
        allow 127.0.0.1;
        #allow YOURIPADDRESS;
        deny all;
}

location /install/data/ {
     internal;
}

location /install/templates/ {
     internal;
}

location /internal_data/ {
     internal;
}

location /library/ {
     internal;
} 

# xenforo 2 uncomment / remove hash from next 3 lines
#location /src/ {
#     internal;
#}

  include /usr/local/nginx/conf/php.conf;
  include /usr/local/nginx/conf/staticfiles.conf;
  #include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

 

I am creating multiple vhosts using 'acmetool.sh issue testdomain.com lived'.
I noticed that by default it creates a vhost config with 'reuseport':

Code:

server {
  listen 443 ssl http2 reuseport;
  server_name testdomain.com www.testdomain.com;

But then nginx fails to start with this error:

Code:

Starting nginx: nginx: [emerg] duplicate listen options for 0.0.0.0:443 in /usr/local/nginx/conf/conf.d/virtual.conf:9

Same happens when I create vhosts using centmin.sh > menu 2 (selfsigned or let's encrypt)

By removing 'reuseport' everything works fine.
But I am a bit confused if this is supposed to work like this?

 

That is interesting.
Both commands give the same result:

Code:

/usr/local/nginx/conf/conf.d/virtual.conf:9:  listen 443 ssl http2 default_server backlog=4095 reuseport;
/usr/local/nginx/conf/conf.d/virtual.conf:10:  listen [::]:443 ssl http2 default_server backlog=4095 reuseport;

 

Yep, I added IPv6 myself, as well as let's encrypt on the hostname.
I thought that I could use 'reuseport' for ipv4 and ipv6, because those are different IP:PORT combinations.

Anyway, if I use your second example, the vhost creation goes well. Thnx!

 

I tried that also! So your first example also works:

Code:

listen 443 ssl http2 default_server backlog=4095 reuseport;
listen [::]:443 ssl http2 default_server backlog=4095 reuseport ipv6only=on;

..but then the creation of new vhosts fails, because the script tries to add 'reuseport' for the newly created vhost.
Probably because it detects more than one reuseport and fails that check.

 

Does this have a cron job to automatically request new certs at certain intervals or do we need to remind ourselves to update every 60 days?

edit: I just read that it does.