centmin.sh Registering a new toplevel domain with IPv4 "A" and IPv6 "AAAA" records, without www record, fails.

• CentOS Version: CentOS 7 64bit
• Centmin Mod Version Installed: 130.00beta01
• Nginx Version Installed: 1.23.3
• PHP Version Installed: 8.0.26
• MariaDB MySQL Version Installed: 10.4.27

After trying to register a new toplevel domain with IPv4 and IPv6 records and without www cname record, the script failed to get the LE certificate:

• 
  
  Code (Text):

  DOMAIN.org is a top level domain
  your server IPv4 IP address: X.126.152.9
  current DNS A record IPv4 address for DOMAIN is: X.126.152.9
  current DNS AAAA record IPv6 address for DOMAIN.org is: 2605:a140:2073:8910::1
  current DNS A record IP address for www.DOMAIN.org is: 
  !! Error: missing DNS A record for www.DOMAIN.org
  
  Abort this Nginx vhost domain setup to setup proper DNS A record(s) first? [y/n]: n
  
  Do you want to continue [y/n]: y
  
  ------------------------------------------------
  You have 4 options: 
  ------------------------------------------------
  1. issue staging test cert with HTTP + HTTPS (untrusted)
  2. issue staging test cert with HTTPS default (untrusted)
  3. issue live cert with HTTP + HTTPS (trusted)
  4. issue live cert with HTTPS default (trusted)
  Enter option number 1-4: 4
  
  ---------------------------------------------------------------------------
  
  "problems": [
        {
          "name": "AAAANotWorking",
          "explanation": "DOMAIN.org has an AAAA (IPv6) record (2605:X:X:8910::1) but a test request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address. You should either ensure that validation requests to this domain succeed over IPv6, or remove its AAAA record.",
          "detail": "Get \"http://DOMAIN.org/.well-known/acme-challenge/letsdebug-test\": dial tcp [2605:X:X:8910::1]:80: connect: connection refused\n\nTrace:\n@0ms: Making a request to http://DOMAIN.org/.well-known/acme-challenge/letsdebug-test (using initial IP 2605:X:X:8910::1)\n@0ms: Dialing 2605:X:X:8910::1\n@27ms: Experienced error: dial tcp [2605:X:X:8910::1]:80: connect: connection refused",
          "severity": "Error"
  
  

---

 

The DOMAIN.ssl.conf file has the following lines with possible errors.

Here we should have uncommented the IPv6 directive if we need to validate with LE:

Code (Text):

   listen   80;
#x#   listen   [::]:80;

The next lines are missing the ÏPv6 directives:
listen [::]:443 ssl http2;

Code (Text):

server {
  listen 443 ssl http2;

  server_name DOMAIN.org www.DOMAIN.org;

after fixing those lines i did:

/usr/local/src/centminmod/addons/acmetool.sh reissue-only DOMAIN.org live

acme.sh keeps looking for www.DOMAIN.org record refusing to continue without it

Code (Text):

www.DOMAIN.org:Verify error:DNS problem: NXDOMAIN looking up A for www.DOMAIN.org - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for www.DOMAIN.org - check that a DNS record exists for this domain

At CMM 124.00stable if the www record is not pointed in DNS its ignored and LE just signs the certificate for top level domain without www, but here appears its not optional.

 

commands with https drops:

Code (Text):

curl: (60) Issuer certificate is invalid

http commands got a:

Code (Text):

HTTP/1.1 302 Moved Temporarily

BTW: Its possible to downgrade to CMM 124.00stable ?

 

Against my feelings but since im in a hurry, i pointed the www to the same IPv4 and IPv6 address and fixed the conf.ssl file as stated on my previous post then i did the reissue certificate command and everything worked as it should, but i would like a way to avoid the imperative use of "www" for top level domains and perhaps the vhost template should be generated properly if IPv6 is used. Thanks for your hard work eva2000.

 

After trying on a new domain, but now using those variables:

Code (Text):

VPS_IPSIX_CHECK_DISABLE='n'
VPS_IPSIX_CHECK_DISABLE_DEBUG='y'

It failed again:

Code (Text):

-------------------------------------------------------------
ok: /usr/local/src/centminmod/addons/acmetool.sh
/usr/local/src/centminmod/addons/acmetool.sh issue DOMAIN.TLD lived

-----------------------------------------------------
updating acme.sh client...
-----------------------------------------------------
Cloning into 'acme.sh'...
[Wed Mar  1 19:52:31 CST 2023] Installing to /root/.acme.sh
[Wed Mar  1 19:52:31 CST 2023] Installed to /root/.acme.sh/acme.sh
[Wed Mar  1 19:52:31 CST 2023] Installing alias to '/root/.bashrc'
[Wed Mar  1 19:52:31 CST 2023] OK, Close and reopen your terminal to start using acme.sh
[Wed Mar  1 19:52:31 CST 2023] Installing alias to '/root/.cshrc'
[Wed Mar  1 19:52:31 CST 2023] Installing alias to '/root/.tcshrc'
[Wed Mar  1 19:52:31 CST 2023] Installing cron job
40 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null
[Wed Mar  1 19:52:31 CST 2023] Good, bash is found, so change the shebang to use bash as preferred.
[Wed Mar  1 19:52:32 CST 2023] OK
https://github.com/acmesh-official/acme.sh
v3.0.6
-----------------------------------------------------
set default acme.sh CA to letsencrypt:
acme.sh --set-default-ca --server letsencrypt
[Wed Mar  1 19:52:32 CST 2023] Changed default CA to: https://acme-v02.api.letsencrypt.org/directory
-----------------------------------------------------
acme.sh updated
-----------------------------------------------------
backup & remove /usr/local/nginx/conf/conf.d/DOMAIN.TLD.conf

[self-signed ssl cert check] required by acmetool.sh

[self-signed ssl] /usr/local/nginx/conf/ssl/DOMAIN.TLD/dhparam.pem exists
[self-signed ssl] /usr/local/nginx/conf/ssl/DOMAIN.TLD/DOMAIN.TLD.crt exists
[self-signed ssl] /usr/local/nginx/conf/ssl/DOMAIN.TLD/DOMAIN.TLD.key exists

[sslvhostsetup] create /usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf


VPS_IPSIX_CHECK_DISABLE=n
IP_SYSTEM_VALIDATE_V4=0
IP_SYSTEM_VALIDATE_V6=0
DEDI_LISTEN="listen   80;"
DEDI_LISTEN_V6="listen   [::]:80;"
DEDI_LISTEN_HTTPS_V6="listen   [::]:443 ssl http2;"
DEDI_LISTEN=listen   80;
DEDI_LISTEN_V6=listen   [::]:80;
[non-wp] backup & remove /usr/local/nginx/conf/conf.d/DOMAIN.TLD.conf
cat /usr/local/nginx/conf/ssl/DOMAIN.TLD/DOMAIN.TLD.crt.key.conf
  ssl_dhparam /usr/local/nginx/conf/ssl/DOMAIN.TLD/dhparam.pem;
  ssl_certificate      /usr/local/nginx/conf/ssl/DOMAIN.TLD/DOMAIN.TLD.crt;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/DOMAIN.TLD/DOMAIN.TLD.key;
  #ssl_trusted_certificate /usr/local/nginx/conf/ssl/DOMAIN.TLD/DOMAIN.TLD-trusted.crt;
cp -a /usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf /usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf-nonwp2
cat /usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf-nonwp1 /usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf-nonwp2 > /usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf
Redirecting to /bin/systemctl reload nginx.service

setting HTTPS default in /usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf

sed -i 's|^##x# HTTPS-DEFAULT|#x# HTTPS-DEFAULT|g' "/usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf"
sed -i "s|#x# server {| server {|" "/usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf"
sed -i "s|#x#   listen   80;|   listen   80;|" "/usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf"
sed -i "s|#x#   listen   [::]:80;|   listen   [::]:80;|" "/usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf"
sed -i "s|#x#   server_name DOMAIN.TLD www.DOMAIN.TLD;|   server_name DOMAIN.TLD www.DOMAIN.TLD;|" "/usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf"
sed -i "s|#x#   return 302 https://DOMAIN.TLD$request_uri;|   return 302 https://DOMAIN.TLD$request_uri;|" "/usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf"
sed -i "s|#x#   root /home/nginx/domains/DOMAIN.TLD/public;|   root /home/nginx/domains/DOMAIN.TLD/public;|" "/usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf"
sed -i "s|#x#   include \/usr\/local\/nginx\/conf\/staticfiles.conf;|   include \/usr\/local\/nginx\/conf\/staticfiles.conf;|" "/usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf"
sed -i "s|#x# }| }|" "/usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf"

remove /usr/local/nginx/conf/conf.d/DOMAIN.TLD.conf

grep 'root' /usr/local/nginx/conf/conf.d/DOMAIN.TLD.ssl.conf
   root /home/nginx/domains/DOMAIN.TLD/public;
  root /home/nginx/domains/DOMAIN.TLD/public;

-----------------------------------------------------------
issue & install letsencrypt ssl certificate for DOMAIN.TLD
-----------------------------------------------------------
testcert value = lived
/root/.acme.sh/acme.sh --issue -d DOMAIN.TLD --days 60 -w /home/nginx/domains/DOMAIN.TLD/public -k 2048 --useragent centminmod-centos7-acmesh-webroot --log /root/centminlogs/acmetool.sh-debug-log-010323-195229.log --log-level 2 --preferred-chain  "ISRG"
[Wed Mar  1 19:52:34 CST 2023] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Wed Mar  1 19:52:34 CST 2023] Creating domain key
[Wed Mar  1 19:52:34 CST 2023] The domain key is here: /root/.acme.sh/DOMAIN.TLD/DOMAIN.TLD.key
[Wed Mar  1 19:52:34 CST 2023] Single domain='DOMAIN.TLD'
[Wed Mar  1 19:52:34 CST 2023] Getting domain auth token for each domain
[Wed Mar  1 19:52:35 CST 2023] Getting webroot for domain='DOMAIN.TLD'
[Wed Mar  1 19:52:35 CST 2023] Verifying: DOMAIN.TLD
[Wed Mar  1 19:52:36 CST 2023] Pending, The CA is processing your order, please just wait. (1/30)
[Wed Mar  1 19:52:38 CST 2023] DOMAIN.TLD:Verify error:XXX.XXX.XXX.XXX: Invalid response from https://DOMAIN.TLD/.well-known/acme-challenge/DxamfvWw3-9Qf4zTPMC6bT4g3LAFaCzgAfyNidvNYRE: 404
[Wed Mar  1 19:52:38 CST 2023] Please check log file for more details: /root/centminlogs/acmetool.sh-debug-log-010323-195229.log
LECHECK = 1

log files saved at /root/centminlogs
-rw-r--r-- 1 root root   35K Mar  1 19:52 acmetool.sh-debug-log-010323-195229.log
-rw-r--r-- 1 root root  6.0K Mar  1 19:52 acmesh-issue_010323-195229.log


-------------------------------------------------------------

waiting on letsdebug.net API check completion...
waiting on letsdebug.net API check completion...

{
  "id": 1392458,
  "domain": "DOMAIN.TLD",
  "method": "http-01",
  "status": "Complete",
  "created_at": "2023-03-02T01:52:39.128734Z",
  "started_at": "2023-03-02T01:52:39.132906Z",
  "completed_at": "2023-03-02T01:52:51.073827Z",
  "result": {
    "problems": [
      {
        "name": "AAAANotWorking",
        "explanation": "DOMAIN.TLD has an AAAA (IPv6) record (XXXX:XXXX:XXXX:XXXX::1) but a test request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address. You should either ensure that validation requests to this domain succeed over IPv6, or remove its AAAA record.",
        "detail": "Get \"http://DOMAIN.TLD/.well-known/acme-challenge/letsdebug-test\": dial tcp [XXXX:XXXX:XXXX:XXXX::1]:80: connect: connection refused\n\nTrace:\n@0ms: Making a request to http://DOMAIN.TLD/.well-known/acme-challenge/letsdebug-test (using initial IP XXXX:XXXX:XXXX:XXXX::1)\n@0ms: Dialing XXXX:XXXX:XXXX:XXXX::1\n@27ms: Experienced error: dial tcp [XXXX:XXXX:XXXX:XXXX::1]:80: connect: connection refused",
        "severity": "Error"
      },
      {
        "name": "StatusNotOperational",
        "explanation": "The current status as reported by the Let's Encrypt status page is Degraded Performance as at 2023-03-01 19:57:06.729 +0000 UTC. Depending on the reported problem, this may affect certificate issuance. For more information, please visit the status page.",
        "detail": "https://letsencrypt.status.io/",
        "severity": "Warning"
      }
    ]
  }
}

The reason ? The DOMAIN.TLD.ssl.conf doesnt have the proper IPv6 directives, then i correct that file adding the proper IPv6 parameters, then i run the command:

Code:

/usr/local/src/centminmod/addons/acmetool.sh reissue-only DOMAIN.TLD live

And everything works fine.

 

That 2 lines (IPv6 directives) were totally missing from vhost conf file.