/ Register

Want more timely Centmin Mod News Updates?
Become a Member

SSL Letsencrypt How can i enable/install dual certs on existing domain?

Discussion in 'Domains, DNS, Email & SSL Certificates' started by pamamolf, May 18, 2019.

Previous Thread Next Thread
Loading...
  1. May 18, 2019 #1
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    8:47 AM
    Nginx-1.29.x
    MariaDB 10.6.x
    Hello

    1)How can i enable/install dual certs on existing domain with self signed certificate?

    2)How can i enable/install dual certs on existing domain with let’s encrypt certificate?

    Thank you
     
  2. May 18, 2019 #2
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    3:47 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Same method for either of the 2 situations you mentioned if using Centmin Mod 123.09beta01 or newer version. If you want to use dual RSA 2048bit + ECDSA 256bit SSL certificates, ensure your persistent config file /etc/centminmod/custom_config.inc has these 2 set
    Code (Text):
    LETSENCRYPT_DETECT='y'
DUALCERTS='y'

    Then provided your domain is already using Centmin Mod generated Nginx HTTPS/SSL vhost and you have the nginx vhost in format /usr/local/nginx/conf/conf.d/domain.com.ssl.conf, you should be able to use acmetool.sh reissue-only option to reissue Letsencrypt SSL certs in both RSA 2048bit + ECDSA 256bit SSL certificate types.
    Then test domain using SSLlabs tester to verify that your have both RSA 2048bit + ECDSA 256bit Letsencrypt SSL certificates SSL Server Test (Powered by Qualys SSL Labs)
     
  3. May 19, 2019 #3
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    8:47 AM
    Nginx-1.29.x
    MariaDB 10.6.x
    Any ciphers order that needed or anything to adjust as i don't know how it will know that i am using two certificates and use the faster one on supported browsers?
     
  4. May 19, 2019 #4
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    3:47 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    123.09beta01's nginx vhost HTTPS routine these days puts all ssl certs into an include file for your nginx vhost, so when you switch to dual certs, it's only changing contents of that include file without touching your nginx vhost. There's nothing to adjust - but test with ssllabs to ensure it's working.
     
  5. May 20, 2019 #5
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    8:47 AM
    Nginx-1.29.x
    MariaDB 10.6.x
    No errors but it didn't work :(

    I did first a test for the forums here and i was able to see the two certificates at Qualys and then i add here:

    And then i run without any errors:

    After that i did a check at Qualys and i got only one certificate :(

    Certificate #1: RSA 2048 bits (SHA256withRSA)

    Any ideas?

    Thank you
     
  6. May 20, 2019 #6
    pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    8:47 AM
    Nginx-1.29.x
    MariaDB 10.6.x
    I just did an nprestart and now it works :)

    The automated Nginx reload not enough for this?
     
    Last edited: May 20, 2019
  7. May 20, 2019 #7
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    3:47 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    depends if your domain had any php caching in play, then the php-fpm restart might be needed
     
Previous Thread Next Thread
Loading...

.