Topic: Letsencrypt panel is looking great!

[Knuddi]

You are right, have just been out of the SME world for a while - thank you for the hard work!!

Bug created: https://bugs.koozali.org/show_bug.cgi?id=13109

Will utilize the beta for mail only and test very carefully, likely to also bring some functionality from many year within a mail filtering company into play.

[ReetP]

 

Thanks.

[compdoc]

**ooops, misspelled the name of the CertificateChainFile, and added a line for compatibility as suggested in the bug report by Jean-Philippe Pialasse**

Hope this helps others to get Letsencrypt working on Beta. I used this bug report to get the clues I needed:

https://bugs.koozali.org/show_bug.cgi?id=10920

Once Beta is installed and updated, use smanager's Letsencrypt Certificate panel to set the Config:

Service Status  Enabled
Hookscript Status  Enabled
Hostoverride Status  Disabled
Accept Terms Status  Yes
API Status  2
Keysize Status  2048
Configure mode Status  NONE
Email  postmaster@domain.com


When you modify modSSL with the cert locations as shown below, it causes the changes to be automatically written to /etc/httpd/conf/httpd.conf whenever dehydrated is run. This allows httpd to find and use the cert.
Im only enabling one hostname to receive a cert. Be sure to point your firewall to the host...


Enter the folowing commands in a terminal window:

mkdir -p /var/www/html/.well-known/acme-challenge
chown www:www -R /var/www/html/.well-known

db hosts show
db hosts setprop tester.domain.com letsencryptSSLcert enabled

config show modSSL
config setprop modSSL CertificateChainFile "/etc/dehydrated/certs/tester.domain.com/chain.pem"
config setprop modSSL key "/etc/dehydrated/certs/tester.domain.com/privkey.pem"
config setprop modSSL crt "/etc/dehydrated/certs/tester.domain.com/cert.pem"
 
nano /etc/e-smith/templates/etc/dehydrated/config/45Algorithm
(uncomment the last line to enable RSA and save the file)
KEY_ALGO=rsa


For backward compatibility enter the command:

ln -s /var/www/html/.well-known /home/e-smith/files/ibays/Primary/html/.well-known

signal-event letsencrypt-config
dehydrated -c

[TerryF]

Hope this helps others to get Letsencrypt working on Beta. I used this bug report to get the clues I needed:

You just showed why we want people pushing the beta as far as they can, many hands make .....

[ReetP]

Bug it, don't bodge it.....


https://forums.koozali.org/index.php/topic,55300.0.html

[Jean-Philippe Pialasse]

/etc/e-smith/templates/etc/dehydrated/config/45Algorithm

this one indeed has to be reverted to force rsa. 

while we have  packages allowing now to handle elliptic curve, there are 2 remaining blockers:
- some template code still need to be updated to use it in sme
- there are still smtp server around that are not able to handle elliptic curve. As we use the same cert for the emails we should focus on backward compatibility to avoid mail sent to be deferred and bounce.