SSL Letsencrypt Cloudflare SSL Failed

Latest CMM Alam 8 (beta 140)

Now cmupdate run but on invoking cmm I get a message there is a newer version of acme tool available - but cmupdate doesnt appear to update to the latest version

---

Code:

------------------------------------------------------------------------------
Version Check:
------------------------------------------------------------------------------
!!!  there maybe a newer version of ./acmetool.sh available  !!!
https://community.centminmod.com/posts/34492/
update using centmin.sh menu option 23 submenu option 2

or via command: cmupdate

Always ensure Current Version is higher or equal to Latest Version
------------------------------------------------------------------------------
Current acmetool.sh Version: 1.0.93
Latest acmetool.sh Version: 1.0.92
------------------------------------------------------------------------------ 

This I dont believe is the problem

Site running Letsencrypt behind cloudflare on full strict mode with origin pull enabled all the ssl config correct - site been running for a year now with no changes

Getting CF error no ssl certificate as of July 2025 - nothing has changed though

Running

Code:

./acmetool.sh reissue-only MYDOMAIN.co.uk live
 

Was Getting

Code:

Invalid status. Verification error details: During secondary validation:

Changed some settings in CF including turning off and after a few attempts at reissue (all with the same above result) now get

Code:

[Tue Jul 23 07:27:24 UTC 2024] Error creating new order. Le_OrderFinalize not found. {
  "type": "urn:ietf:params:acme:error:rateLimited",
  "detail": "Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/failed-validation-limit/",
  "status": 429

 

Thanks

Code:

If your Centmin Mod Nginx domain is behind Cloudflare orange cloud enabled proxy and you have Cloudflare Full or Full Strict SSL mode enabled, it's recommended you use Cloudflare DNS API domain validation method for issuing Letsencrypt SSL certificates on your Centmin Mod Nginx origin server side. Set that up and do

I havent set that up - so will do a retry

 

new error

Code:

-----------------------------------------------------------
reissue & install letsencrypt ssl certificate for MYDOMAIN.co.uk
-----------------------------------------------------------
/root/.acme.sh/acme.sh --force --createDomainKey -d MYDOMAIN.co.uk -d www.MYDOMAIN.co.uk -k 2048 --useragent centminmod-centos8-acmesh-webroot
[Tue Jul 23 11:32:43 UTC 2024] Creating domain key
[Tue Jul 23 11:32:43 UTC 2024] The domain key is here: /root/.acme.sh/MYDOMAIN.co.uk/MYDOMAIN.co.uk.key
testcert value = live
/root/.acme.sh/acme.sh --force --dns dns_cf --issue -d MYDOMAIN.co.uk -d www.MYDOMAIN.co.uk --days 60 --pre-hook "/usr/local/src/centminmod/tools/pre-acme-hooks.sh all-check MYDOMAIN.co.uk" -w "/home/nginx/domains/MYDOMAIN.co.uk/public" -k "2048" --useragent "centminmod-centos8-acmesh-webroot" --log /root/centminlogs/acmetool.sh-debug-log-230724-113238.log --log-level 2 --preferred-chain "ISRG"
[Tue Jul 23 11:32:45 UTC 2024] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Tue Jul 23 11:32:45 UTC 2024] Runing pre hook:'/usr/local/src/centminmod/tools/pre-acme-hooks.sh all-check MYDOMAIN.co.uk'
Nginx root path: /home/nginx/domains/MYDOMAIN.co.uk/public
Le_Webroot: dns_cf,/home/nginx/domains/MYDOMAIN.co.uk/public
ECC Le_Webroot: /home/nginx/domains/MYDOMAIN.co.uk/public
The root paths match. Proceeding with the acme.sh operation.
[Tue Jul 23 11:32:45 UTC 2024] Multi domain='DNS:MYDOMAIN.co.uk,DNS:www.MYDOMAIN.co.uk'
[Tue Jul 23 11:32:48 UTC 2024] Getting webroot for domain='MYDOMAIN.co.uk'
[Tue Jul 23 11:32:48 UTC 2024] Getting webroot for domain='www.MYDOMAIN.co.uk'
[Tue Jul 23 11:32:49 UTC 2024] Adding TXT value: 4Z6t25Xxwjl8gbkzjVVgi7nG9PV8MBfvYQVcOoMxOwY for domain: _acme-challenge.MYDOMAIN.co.uk
[Tue Jul 23 11:32:52 UTC 2024] invalid domain
[Tue Jul 23 11:32:52 UTC 2024] Error adding TXT record to domain: _acme-challenge.MYDOMAIN.co.uk
[Tue Jul 23 11:32:53 UTC 2024] Please check log file for more details: /root/centminlogs/acmetool.sh-debug-log-230724-113238.log
LECHECK = 1

log files saved at /root/centminlogs
-rw-r--r--  1 root root   39K Jul 23 11:32 acmetool.sh-debug-log-230724-113238.log
-rw-r--r--  1 root root  3.5K Jul 23 11:32 acmesh-reissue-only_230724-113238.log

Have added the cf tokens and api and restarted ninx

 

Just read this after sending you a pm - my apologies - I cleared all the WAF rules and still the same

Will update cmm and try again

 

Ok, still got a txt error problem

Code:

The root paths match. Proceeding with the acme.sh operation.
[Mon Jul 29 15:51:14 UTC 2024] Multi domain='DNS:MYDOMAIN.co.uk,DNS:www.MYDOMAIN.co.uk'
[Mon Jul 29 15:51:17 UTC 2024] Getting webroot for domain='MYDOMAIN.co.uk'
[Mon Jul 29 15:51:17 UTC 2024] Getting webroot for domain='www.MYDOMAIN.co.uk'
[Mon Jul 29 15:51:17 UTC 2024] Adding TXT value: Y9ACCl8OOrtvR-WwX6RyxBLAHBLAHgNRl991ADVM for domain: _acme-challenge.MYDOMAIN.co.uk
[Mon Jul 29 15:51:21 UTC 2024] invalid domain
[Mon Jul 29 15:51:21 UTC 2024] Error adding TXT record to domain: _acme-challenge.jgsolar.co.uk
[Mon Jul 29 15:51:21 UTC 2024] Please check log file for more details: /root/centminlogs/acmetool.sh-debug-log-290724-155108.log
LECHECK = 1

 

Just check the custom config at /etc/centminmod/custom_config.inc and this is definitely there

Code:

# enable letsencrypt ssl certificate + dual RSA+ECDSA ssl certs https://centminmod.com/acmetool/
# https://community.centminmod.com/threads/official-acmetool-sh-testing-thread-for-centmin-mod-123-09beta01.8290/
LETSENCRYPT_DETECT='y'
DUALCERTS='y'
# Add CLOUDFLARE July 2024 - see - https://centminmod.com/letsencrypt-freessl.html#dns
CF_DNSAPI_GLOBAL='y'
CF_Token="6be7d901XXXXXXXXXXXX583f658cc95"
CF_Account_ID="a0427aXXXXXXXXXXXX3b2fa1241332"

The Token is from the CF page API and is the Global API key which I presume is correct
The Account ID is correct as it says account id in CF

Have disabled CF WAF rules
Have changed to Full from Full Strict

In API have



Still get the same txt error and no IPV6 only IPV4 in dns records A no AAAA

 

I did that but dont understand what value do I put in
CF_Token="YOUR_CF_TOKEN"

Whats Your CF Token ? If it's not the api key is it the name of my API ?

cant see anywhere in the api that specifies an CF TOKEN

At present have my global api in it as stated above

Run the acme update new ssl for the domain this morning and today it works - yesterday constant txt errors

So all good but would like to get the CF Token correct if possible.

Thankyou for all your help - much appreciated