3,250
edits
Changes
From SME Server
Jump to navigationJump to searchLetsencrypt/Troubleshooting (view source)
Revision as of 05:19, 18 August 2022
, 05:19, 18 August 2022Created page with "This page initially is forked from Letsencrypt page to ease reading. === Certificate Errors === Errors in the certificate files may prevent Apache and some other services..."
This page initially is forked from [[Letsencrypt]] page to ease reading.
=== Certificate Errors ===
Errors in the certificate files may prevent Apache and some other services from starting. If you previously had custom settings for modSSL, revert those with:
config setprop modSSL crt (old value)
config setprop modSSL key (old value)
config setprop modSSL CertificateChainFile (old value--if this property was empty, delete it using the command line below)
If you did not have custom settings for modSSL, remove your changes with:
config delprop modSSL crt
config delprop modSSL key
config delprop modSSL CertificateChainFile
Once you've made these changes, do:
signal-event post-upgrade
signal-event reboot
Also see
<nowiki>https://wiki.contribs.org/Useful_Commands#How_to_simply_recreate_the_certificate_for_SME_Server</nowiki>
rm /home/e-smith/ssl.{crt,key,pem}/*
config delprop modSSL CommonName
config delprop modSSL crt
config delprop modSSL key
signal-event post-upgrade
signal-event reboot
=== Authorization Errors ===
The first thing is to check all your domains can resolve
<nowiki>http://my.domain/.well-known/acme-challenge</nowiki>
Check that the following files are correctly generated
/etc/dehydrated/config
/etc/dehydrated/domains.txt
Set letsencrypt back to test and remove any generated keys
db configuration setprop letsencrypt status test
rm /etc/dehydrated/certs/* -rf
rm /etc/dehydrated/accounts/* -rf
Then run letsencrypt again
dehydrated -c
To restore the original certificates:
config delprop modSSL CertificateChainFile
config delprop modSSL crt
config delprop modSSL key
signal-event console-save
=== Errors ===
==== No registration exists matching provided key ====
If you see the following:
{"type":"<nowiki>urn:acme:error:unauthorized</nowiki>","detail":"No registration exists matching provided key","status":403}
<nowiki>https://github.com/lukas2511/letsencrypt.sh/issues/2</nowiki>
See above for removing private keys and regenerating
==== rateLimited, Too many currently pending Authorizations ====
If you see something like this you may have hit the rate limit:
{"type":"<nowiki>urn:acme:error:rateLimited</nowiki>","detail":"Error creating new authz :: Too many currently pending authorizations.","status":429}
<nowiki>https://github.com/lukas2511/letsencrypt.sh/blob/master/docs/staging.md</nowiki>
<nowiki>https://letsencrypt.org/docs/rate-limits/</nowiki>
==== Some challenges complete successfully but some hostnames fail ====
If you see some of your challenges returned without error but some fail, you possibly do not have Public DNS A or MX records for all the host names that you are adding to your certificate.
Using the command:
config setprop letsencrypt configure all
Is likely to cause this error. When a domain is added to an SME server, several host names are created automatically. these include ftp.your-domain.com, wpad.your-domain.com, proxy.your-domain.com, mail.your-domain.com, www.your-domain.com. Most of us do not create public DNS records for all these host names. When letsencrypt issues a challenge for a list of host names and '''ONE''' does not resolve, the challenge will fail and the certificate will not generate at all.
To resolve this, issue the following command:
config setprop letsencrypt configure none
Then follow up with the commands to enable letsencrypt for each PUBLIC resolvable domain and hostname:
db domains setprop domain1.com letsencryptSSLcert enabled
and for each hostname:
db hosts setprop www.domain1.com letsencryptSSLcert enabled
db hosts setprop mail.domain1.com letsencryptSSLcert enabled
until all the public facing hostnames are enabled followed by:
signal-event console-save
Thanks to MSmith for the following forum thread.
<nowiki>https://forums.contribs.org/index.php/topic,53052.0.html</nowiki>
==== Challenge fails with unauthorized 403 error ====
If your challenge returns something like the following:
ERROR: Challenge is invalid! (returned: invalid) (result: {
"type": "http-01",
"status": "invalid",
"error": {
"type": "<nowiki>urn:acme:error:unauthorized</nowiki>",
"detail": "Invalid response from <nowiki>http://www.your-domain.com/.well-known/acme-challenge/</nowiki><redacted text>
"status": 403
and your ''httpd error_log'' on your server shows something like this:
(13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
(13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
(13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
You need to check the ownership and rights on ''/home/e-smith/files/ibays/Primary'' and on ''/home/e-smith/files/ibays/Primary/html''. The contrib creates a hidden working directory at ''/home/e-smith/files/ibays/Primary/html/.well-known'' and inside that directory a second directory with the following path ''/home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge''. The script creates the two new directories with the correct ownerships and rights, however, if the ownership and rights on the ibay and the html directory do not allow the script to access the new location, the challenge will fail with ''access denied''
use the following to check the rights:
cd /home/e-smith/files/ibays
then
ls -l
on my test server with only the Primary ibay I get the following (you will probably show a bunch more ibays on your server but we are only concerned with Primary):
total 4
drwxr-xr-x 5 root root 4096 Jul 25 2016 Primary
If this is not what you see, you need to correct it.
'''THIS MAY BREAK NON STANDARD CUSTOMIZATION OF YOUR SERVER, YOU NEED TO UNDERSTAND WHY THIS HAS BEEN CHANGED BEFORE YOU REVERSE IT'''
From within ''/home/e-smith/files/ibays/'' issue the following:
chown root:root Primary
If the rights are not correct, issue:
chmod 0755 Primary
Next check the html directory.
cd /home/e-smith/files/ibays/Primary
then
ls -l
on my test server I have the following
[root@backupserver Primary]# ls -l
total 12
drwxr-s--- 2 admin shared 4096 Jul 25 2016 cgi-bin
drwxr-s--- 2 admin shared 4096 Jul 25 2016 files
'''drwxr-s--- 3 admin shared 4096 Jun 11 08:06 html'''
If this is not what you see,
'''FIRST READ ABOVE WARNING'''
then adjust as follows
chown admin:shared html
If the rights are not correct, issue:
chmod 2750 html
rerun
dehydrated -c
and your challenges should complete.
<nowiki>https://forums.contribs.org/index.php/topic,53147.0.html</nowiki>
=== Certificate Errors ===
Errors in the certificate files may prevent Apache and some other services from starting. If you previously had custom settings for modSSL, revert those with:
config setprop modSSL crt (old value)
config setprop modSSL key (old value)
config setprop modSSL CertificateChainFile (old value--if this property was empty, delete it using the command line below)
If you did not have custom settings for modSSL, remove your changes with:
config delprop modSSL crt
config delprop modSSL key
config delprop modSSL CertificateChainFile
Once you've made these changes, do:
signal-event post-upgrade
signal-event reboot
Also see
<nowiki>https://wiki.contribs.org/Useful_Commands#How_to_simply_recreate_the_certificate_for_SME_Server</nowiki>
rm /home/e-smith/ssl.{crt,key,pem}/*
config delprop modSSL CommonName
config delprop modSSL crt
config delprop modSSL key
signal-event post-upgrade
signal-event reboot
=== Authorization Errors ===
The first thing is to check all your domains can resolve
<nowiki>http://my.domain/.well-known/acme-challenge</nowiki>
Check that the following files are correctly generated
/etc/dehydrated/config
/etc/dehydrated/domains.txt
Set letsencrypt back to test and remove any generated keys
db configuration setprop letsencrypt status test
rm /etc/dehydrated/certs/* -rf
rm /etc/dehydrated/accounts/* -rf
Then run letsencrypt again
dehydrated -c
To restore the original certificates:
config delprop modSSL CertificateChainFile
config delprop modSSL crt
config delprop modSSL key
signal-event console-save
=== Errors ===
==== No registration exists matching provided key ====
If you see the following:
{"type":"<nowiki>urn:acme:error:unauthorized</nowiki>","detail":"No registration exists matching provided key","status":403}
<nowiki>https://github.com/lukas2511/letsencrypt.sh/issues/2</nowiki>
See above for removing private keys and regenerating
==== rateLimited, Too many currently pending Authorizations ====
If you see something like this you may have hit the rate limit:
{"type":"<nowiki>urn:acme:error:rateLimited</nowiki>","detail":"Error creating new authz :: Too many currently pending authorizations.","status":429}
<nowiki>https://github.com/lukas2511/letsencrypt.sh/blob/master/docs/staging.md</nowiki>
<nowiki>https://letsencrypt.org/docs/rate-limits/</nowiki>
==== Some challenges complete successfully but some hostnames fail ====
If you see some of your challenges returned without error but some fail, you possibly do not have Public DNS A or MX records for all the host names that you are adding to your certificate.
Using the command:
config setprop letsencrypt configure all
Is likely to cause this error. When a domain is added to an SME server, several host names are created automatically. these include ftp.your-domain.com, wpad.your-domain.com, proxy.your-domain.com, mail.your-domain.com, www.your-domain.com. Most of us do not create public DNS records for all these host names. When letsencrypt issues a challenge for a list of host names and '''ONE''' does not resolve, the challenge will fail and the certificate will not generate at all.
To resolve this, issue the following command:
config setprop letsencrypt configure none
Then follow up with the commands to enable letsencrypt for each PUBLIC resolvable domain and hostname:
db domains setprop domain1.com letsencryptSSLcert enabled
and for each hostname:
db hosts setprop www.domain1.com letsencryptSSLcert enabled
db hosts setprop mail.domain1.com letsencryptSSLcert enabled
until all the public facing hostnames are enabled followed by:
signal-event console-save
Thanks to MSmith for the following forum thread.
<nowiki>https://forums.contribs.org/index.php/topic,53052.0.html</nowiki>
==== Challenge fails with unauthorized 403 error ====
If your challenge returns something like the following:
ERROR: Challenge is invalid! (returned: invalid) (result: {
"type": "http-01",
"status": "invalid",
"error": {
"type": "<nowiki>urn:acme:error:unauthorized</nowiki>",
"detail": "Invalid response from <nowiki>http://www.your-domain.com/.well-known/acme-challenge/</nowiki><redacted text>
"status": 403
and your ''httpd error_log'' on your server shows something like this:
(13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
(13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
(13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
You need to check the ownership and rights on ''/home/e-smith/files/ibays/Primary'' and on ''/home/e-smith/files/ibays/Primary/html''. The contrib creates a hidden working directory at ''/home/e-smith/files/ibays/Primary/html/.well-known'' and inside that directory a second directory with the following path ''/home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge''. The script creates the two new directories with the correct ownerships and rights, however, if the ownership and rights on the ibay and the html directory do not allow the script to access the new location, the challenge will fail with ''access denied''
use the following to check the rights:
cd /home/e-smith/files/ibays
then
ls -l
on my test server with only the Primary ibay I get the following (you will probably show a bunch more ibays on your server but we are only concerned with Primary):
total 4
drwxr-xr-x 5 root root 4096 Jul 25 2016 Primary
If this is not what you see, you need to correct it.
'''THIS MAY BREAK NON STANDARD CUSTOMIZATION OF YOUR SERVER, YOU NEED TO UNDERSTAND WHY THIS HAS BEEN CHANGED BEFORE YOU REVERSE IT'''
From within ''/home/e-smith/files/ibays/'' issue the following:
chown root:root Primary
If the rights are not correct, issue:
chmod 0755 Primary
Next check the html directory.
cd /home/e-smith/files/ibays/Primary
then
ls -l
on my test server I have the following
[root@backupserver Primary]# ls -l
total 12
drwxr-s--- 2 admin shared 4096 Jul 25 2016 cgi-bin
drwxr-s--- 2 admin shared 4096 Jul 25 2016 files
'''drwxr-s--- 3 admin shared 4096 Jun 11 08:06 html'''
If this is not what you see,
'''FIRST READ ABOVE WARNING'''
then adjust as follows
chown admin:shared html
If the rights are not correct, issue:
chmod 2750 html
rerun
dehydrated -c
and your challenges should complete.
<nowiki>https://forums.contribs.org/index.php/topic,53147.0.html</nowiki>
