Koozali.org: home of the SME Server

Enabling Letsencrypt on Beta

Offline compdoc

  • *
  • 233
  • +0/-0
Enabling Letsencrypt on Beta
« on: August 22, 2025, 07:16:41 PM »
**ooops, misspelled the name of the CertificateChainFile, and added a line for compatibility as suggested in the bug report by Jean-Philippe Pialasse**

Hope this helps others to get Letsencrypt working on Beta. I used this bug report to get the clues I needed:

https://bugs.koozali.org/show_bug.cgi?id=10920

Once Beta is installed and updated, use smanager's Letsencrypt Certificate panel to set the Config:

Service Status  Enabled
Hookscript Status  Enabled
Hostoverride Status  Disabled
Accept Terms Status  Yes
API Status  2
Keysize Status  2048
Configure mode Status  NONE
Email  postmaster@domain.com


When you modify modSSL with the cert locations as shown below, it causes the changes to be automatically written to /etc/httpd/conf/httpd.conf whenever dehydrated is run. This allows httpd to find and use the certs. Im using the suggested path to store the certs.

Im only enabling one hostname to receive a cert. Be sure to point your firewall to the host, and that the hostname exists in your external and internal DNS records...

Enter the following commands in a terminal window:

mkdir -p /var/www/html/.well-known/acme-challenge
chown www:www -R /var/www/html/.well-known

db hosts show
db hosts setprop tester.domain.com letsencryptSSLcert enabled

config show modSSL
config setprop modSSL CertificateChainFile "/etc/dehydrated/certs/tester.domain.com/chain.pem"
config setprop modSSL key "/etc/dehydrated/certs/tester.domain.com/privkey.pem"
config setprop modSSL crt "/etc/dehydrated/certs/tester.domain.com/cert.pem"
 
nano /etc/e-smith/templates/etc/dehydrated/config/45Algorithm
(uncomment the last line to enable RSA and save the file)
KEY_ALGO=rsa


For backward compatibility enter the command:

ln -s /var/www/html/.well-known /home/e-smith/files/ibays/Primary/html/.well-known

signal-event letsencrypt-config
dehydrated -c
« Last Edit: August 23, 2025, 09:48:45 AM by compdoc »

Offline ReetP

  • *
  • 3,976
  • +6/-0
Re: Enabling Letsencrypt on Beta
« Reply #1 on: August 23, 2025, 11:43:25 AM »
Don't do this.

You have now likely borked your system for updates.

The panel should automate this but we are in BETA and it may not work.

The correct procedure is file a bug and wait for a fix.

...
1. Read the Manual
2. Read the Wiki
3. Don't ask for support on Unsupported versions of software
4. I have a job, wife, and kids and do this in my spare time. If you want something fixed, please help.

Bugs are easier than you think: http://wiki.contribs.org/Bugzilla_Help

If you love SME and don't want to lose it, join in: http://wiki.contribs.org/Koozali_Foundation

Offline compdoc

  • *
  • 233
  • +0/-0
Re: Enabling Letsencrypt on Beta
« Reply #2 on: August 23, 2025, 04:21:58 PM »
You are correct, I should have warned people to use these instructions at their own risk.

Mine are ephemeral test systems, they are tossed with each new release, not upgraded. I see others here saying that they have enabled letsencrypt but are not telling how, like me they are probably tired of the browser warnings and wanting usernames and passwords saved.

Personally, I have always gone to forums first to seek answers, feeling they are easier to search than searching a bug reporting database. Rocket chat might be great for you developers, but its published knowledge and insights are hidden away from average users like me. So, I post here, where my questions and limited knowledge are shared with the world.

Offline ReetP

  • *
  • 3,976
  • +6/-0
Re: Enabling Letsencrypt on Beta
« Reply #3 on: August 23, 2025, 05:28:15 PM »
You are correct, I should have warned people to use these instructions at their own risk.

Indeed. It is a long way from what you should be doing.

Quote
Mine are ephemeral test systems, they are tossed with each new release, not upgraded.

Should be stated, as above.

Quote
I see others here saying that they have enabled letsencrypt but are not telling how, like me they are probably tired of the browser warnings and wanting usernames and passwords saved.

If you check there is a new panel. As we have always said, if it doesn't function as intended, open a bug. Same mantra for years. That's how we work and we can then advise how to fix or whatever. The panel is a new feature and IIRC still needs work. And this is Beta and should be expected.

Regrettably here the answers will get picked up by unsuspecting users (or Heaven forbid AI) and postulated as the correct answer.

Quote
Personally, I have always gone to forums first to seek answers, feeling they are easier to search than searching a bug reporting database.

But we have always said - if it doesn't work as expected, open a bug. This is particularly true currently as it allows us to track and fix issues. It is how we work.

Search for the letsencrypt ones - if yours is not listed, open a new one please. It does not need your fix. Just what has, or has not happened.

On top of which a lot of the templating you have done should already be there, but as we don't know what version you are running we can't tell. smeserver-certificates-11.0-7.el8.sme.noarch should have most of it.

https://src.koozali.org/smeserver/smeserver-certificates

Quote
Rocket chat might be great for you developers, but its published knowledge and insights are hidden away from average users like me. So, I post here, where my questions and limited knowledge are shared with the world.

There is no 'them and us'. We are all Koozali SME users first and foremost. I am no dev. I hack a bit. /ends.

So Rocket.Chat is a messaging system that anyone can join and use. It is just a very easy way for people to communicate and fix issues, often in real time.

There is no magic sauce or secret squirrel stuff there. There are ordinary users and devs (the couple that there actually are).

As it was my own test system originally I kept it locked to prevent spammers. That has continued due to limited licence counts etc. If people want an account they can just ask me. There is no fee or qualification required. But you need will need an account to view information.

It is MUCH easier to discuss this sort of thing there and users can be guided rather than making elementary mistakes.

Again, I have said this on countless posts.

We are grateful for testing, but rather than posting workarounds for problems that may not actually even exist, please follow established procedures or you, us, and many others will be in a right mess.

And then people will be asking us to fix the hack of yours we know nothing about that they read about 'somewhere' and then haven't undone........

Thanks.

...
1. Read the Manual
2. Read the Wiki
3. Don't ask for support on Unsupported versions of software
4. I have a job, wife, and kids and do this in my spare time. If you want something fixed, please help.

Bugs are easier than you think: http://wiki.contribs.org/Bugzilla_Help

If you love SME and don't want to lose it, join in: http://wiki.contribs.org/Koozali_Foundation

Offline ReetP

  • *
  • 3,976
  • +6/-0
Re: Enabling Letsencrypt on Beta
« Reply #4 on: August 23, 2025, 07:40:53 PM »
Note please don't take my comments personally.

The help is gratefully appreciated, but we are few and we don't have time to chase ghosts.

The bug opening methodology lets us track, manage, and fix issues more easily.

It is pretty simple :-)

Note too that is you are testing anything eg the letsencrypt panel then check

tail -f /var/log/smanager/smanager.log
tail -f /var/log/messages

And as ever, ask me for a Rocket account if you want a bit of friendly banter, help and learning.
...
1. Read the Manual
2. Read the Wiki
3. Don't ask for support on Unsupported versions of software
4. I have a job, wife, and kids and do this in my spare time. If you want something fixed, please help.

Bugs are easier than you think: http://wiki.contribs.org/Bugzilla_Help

If you love SME and don't want to lose it, join in: http://wiki.contribs.org/Koozali_Foundation

Offline ReetP

  • *
  • 3,976
  • +6/-0
Re: Enabling Letsencrypt on Beta
« Reply #5 on: August 25, 2025, 12:13:41 AM »
FWIW for now we need to fix the cert type to default to rsa.

Bug is here.

https://bugs.koozali.org/show_bug.cgi?id=13109

All you actually need to do temporarily is set

45Algorithms

Code: [Select]
KEY_ALGO=rsa
Then:
Code: [Select]
signal-event smeserver-certificates-update

I'll push a more permanent fix in the next day or so.
...
1. Read the Manual
2. Read the Wiki
3. Don't ask for support on Unsupported versions of software
4. I have a job, wife, and kids and do this in my spare time. If you want something fixed, please help.

Bugs are easier than you think: http://wiki.contribs.org/Bugzilla_Help

If you love SME and don't want to lose it, join in: http://wiki.contribs.org/Koozali_Foundation

Offline ReetP

  • *
  • 3,976
  • +6/-0
Re: Enabling Letsencrypt on Beta
« Reply #6 on: August 25, 2025, 03:50:07 PM »
Hopefully fixed here but you will need to either undo all your work, or blow it away and start again.

https://bugs.koozali.org/show_bug.cgi?id=13109#c3
...
1. Read the Manual
2. Read the Wiki
3. Don't ask for support on Unsupported versions of software
4. I have a job, wife, and kids and do this in my spare time. If you want something fixed, please help.

Bugs are easier than you think: http://wiki.contribs.org/Bugzilla_Help

If you love SME and don't want to lose it, join in: http://wiki.contribs.org/Koozali_Foundation