Topic: Fun with Letsencrypt

[ricks1950]

I installed Letsencrypt and dehydrated following the wiki page about two months ago and got valid certificates.  When my renewal script ran, no errors were generated, new certificates were issued, but they were not valid.  I ran step by step through the wiki several times, and ran dehydrated and generated several generations of invalid certificates without errors. 

Long story short -- after much head scratching, hair pulling and a few choice words, checking and rechecking installation steps, I found in the /etc/dehydrated/config file this line:
# CA="https://acme-staging.api.letsencrypt.org/directory"
had lost the # and was uncommented, which caused the script to run in test mode and generate invalid certificates.

Now, I am past 60 (nearly 70) and do not remember everything that goes on around me or what I did, but between the certificate installation and the actual running of dehydrated to renew the certificates, I do not remember touching or even thinking about letsencrypt. 

I guess the message is simply, if something does not work check and double check your configuration. 

Both the contrib and the wiki are terrific, and do what they need to do.

[guest22]

Hey Rick, good to see you found the root cause of your issue, and thanks for the heads up for the 'youngsters'!

[Jean-Philippe Pialasse]

I installed Letsencrypt and dehydrated following the wiki page about two months ago and got valid certificates.  When my renewal script ran, no errors were generated, new certificates were issued, but they were not valid.  I ran step by step through the wiki several times, and ran dehydrated and generated several generations of invalid certificates without errors. 

Long story short -- after much head scratching, hair pulling and a few choice words, checking and rechecking installation steps, I found in the /etc/dehydrated/config file this line:
# CA="https://acme-staging.api.letsencrypt.org/directory"
had lost the # and was uncommented, which caused the script to run in test mode and generate invalid certificates.

if you do have installed smeserver-letsencrypt then the way to do was not to comment this line but to change the status property from test to enable, then signal-event console-save.

Now, I am past 60 (nearly 70) and do not remember everything that goes on around me or what I did, but between the certificate installation and the actual running of dehydrated to renew the certificates, I do not remember touching or even thinking about letsencrypt. 

if you had the contrib installed, then my guess is an upgrade occured or an event was triggered leading to the expand of the config file. Hence the removal of you commented line.
If you only configured this manually without installing the smeserver-letsencrypt then I have no clue neither!

I guess the message is simply, if something does not work check and double check your configuration. 

Both the contrib and the wiki are terrific, and do what they need to do.

thank you for your comment and for the terrific work of John on this one!

[ricks1950]

It did occur to me that letsencrypt was in test mode and I entered

config setprop letsencrypt status enable
signal-event console-save

and ran dehydrated again with the same result. 

Maybe if I had set test mode and then enabled, it would have worked.

There may have been an update to the contrib, maybe that caused the problem.

[Jean-Philippe Pialasse]

Any templates-custom?

[ricks1950]

No custom templates or contribs other than letsencrypt on this server.  It is relatively new 64 bit hardware with a clean install of 9.1, yum updated to 9.2.  Data was restored from a 32 bit 9.1 machine.  This is my personal machine and serves as my main email server with a few email accounts.  I do occasionally use webmail, but there is not a lot of customisation.

[Jean-Philippe Pialasse]

well, using the contrib you should not have any line such as

Code: [Select]

# CA="https://acme-staging.api.letsencrypt.org/directory"
you should find in/etc/dehydrated/config  either (if status=test)

Code: [Select]

CA="https://acme-staging.api.letsencrypt.org/directory"
or if status=enabled

Code: [Select]

CA="https://acme-v01.api.letsencrypt.org/directory"

Out of curiosity would be able to retrieve:

Code: [Select]

config show letsencrypt
rpm -qa smeserver-letsencrypt
rpm -qa dehydrated