1,574
edits
Changes
From SME Server
Jump to navigationJump to search
mLine 1:
Line 1: − + + + + + + + + + + + + + + + + + + + + + + + + + Line 27:
Line 51: − − === Version === − {{#set: Version=Contrib10}} − {{#smeversion:smeserver-letsencrypt }} − <br> Line 60:
Line 79: + + + + + + + + + − + − If your smeaddons repo has been disabled add --enablerepo=smeaddons − + − Your server will report available updates from the smecontribs repository as they are available. If you have previously installed smeserver-letsencrypt from the reetp repository, you will need to make sure that you've set the ACCEPT_TERMS configuration property:+ − + − config setprop letsencrypt ACCEPT_TERMS yes − Line 79:
Line 104: + + + + + − If your smeaddons repo has been disabled add --enablerepo=smeaddons+ + − It is important to do the usual+ − + + + + + + + + + + + + + + + + + + + + + + − otherwise+ + + + + + + + + + − failure to do this might leave the contribution not working and your certificates not renewed.+ − − − There are several configuration database entries that need to be made in order to set up this contrib. Most of them tell the scripts which hostnames need to be part of your certificate. Line 101:
Line 159: − : www.domain1.com+ − : mail.domain1.com+ − : ftp.domain1.com+ + − : www.domain2.com+ − : mail.domain2.com+ − Line 133:
Line 191: − + − − ====Other configuration properties==== − No other settings are mandatory. However, it's recommended to configure an email address. If there should be a problem with renewing your certificate, and it comes close to expiring, the Let's Encrypt servers will notify you of this. Do so with this command: − config setprop letsencrypt email admin@domain1.com − − The email domain specified here doesn't need to match any of the domains you're obtaining a cert for. − − You can also set the length of your certificate's private key, if you don't want the default of 4096 bits. This should not be necessary in most cases, but if desired, use this command to do so: − config setprop letsencrypt keysize NUMBER − − ===Accept Let's Encrypt terms === − Please first read the condition terms for using Let's Encrypt [[https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf]] − config setprop letsencrypt ACCEPT_TERMS yes − − {{Note box|Creation of a new certificate requires the API being set to V2, see warning box above}} − − ===V2 API=== − With the latest version of letsencrypt/dehydrated the V2 API is needed to create new certificates, V1 is depreciated for creation of new certificates however is still valid for existing certificates created with it. − − The key is called API. It will default to '1' if left unset. Options are '1', '2', 'auto' − For updating current V1 certificates leave as default or set to 1, auto + − + − # config show letsencrypt − letsencrypt=service − ACCEPT_TERMS=yes − configure=none − email=####@#####.### − hookScript=disabled − status=enabled − − # config setprop letsencrypt API 1 − # signal-event console-save − − # config show letsencrypt − letsencrypt=service − ACCEPT_TERMS=yes − API=1 − configure=none − email=####@#####.### − hookScript=disabled − status=enabled − − For creating a new certificate or updating a V2 set to 2 − − # config setprop letsencrypt API 2 − # signal-event console-save − − # config show letsencrypt − letsencrypt=service − ACCEPT_TERMS=yes − API=2 − configure=none − email=####@#####.### − hookScript=disabled − status=enabled − − ===Enable Test Mode=== − The next step is to enable test mode. This will obtain certificates from the staging server. The rate limits discussed in the introduction won't apply, so any errors or other issues won't prevent you from obtaining your production certificate. Enable test mode using this command: Line 205:
Line 207: − + Line 220:
Line 222: − + Line 226:
Line 228: − + − for the test ('''adjust the domains and hosts'''):+ − config setprop letsencrypt ACCEPT_TERMS yes status test API 2+ − #foreach of your domains you want SSL do the following+ − db domains setprop '''domain1.com''' letsencryptSSLcert enabled+ − #foreach of your hosts (subdomains) you want SSL do the following+ − db hosts setprop '''www.domain1.com''' letsencryptSSLcert enabled+ − signal-event console-save+ − dehydrated -c+ − + − Check that the certificates are available ( your browser will still issue an error, but you can explore the content of the certificate to see that the Let's Encrypt test CA was used to sign your SSL certificate and that all your domains and hosts are in the "Certificate Subject Alt Name" property.+ − + − for the production ('''adjust your email'''):+ − config setprop letsencrypt status enabled email '''admin@domain1.com'''+ − signal-event console-save+ − dehydrated -c -x+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − ===Certificate Errors===+ − Errors in the certificate files may prevent Apache and some other services from starting. If you previously had custom settings for modSSL, revert those with: − config setprop modSSL crt (old value) − config setprop modSSL key (old value) − config setprop modSSL CertificateChainFile (old value--if this property was empty, delete it using the command line below) − − If you did not have custom settings for modSSL, remove your changes with: − config delprop modSSL crt − config delprop modSSL key − config delprop modSSL CertificateChainFile − − Once you've made these changes, do: − signal-event post-upgrade − signal-event reboot − − Also see − − https://wiki.contribs.org/Useful_Commands#How_to_simply_recreate_the_certificate_for_SME_Server − − rm /home/e-smith/ssl.{crt,key,pem}/* − config delprop modSSL CommonName − config delprop modSSL crt − config delprop modSSL key − signal-event post-upgrade − signal-event reboot − − ===Authorization Errors=== − The first thing is to check all your domains can resolve − − http://my.domain/.well-known/acme-challenge − − Check that the following files are correctly generated − − /etc/dehydrated/config − /etc/dehydrated/domains.txt − − Set letsencrypt back to test and remove any generated keys − − db configuration setprop letsencrypt status test − − rm /etc/dehydrated/certs/* -rf − rm /etc/dehydrated/accounts/* -rf − − Then run letsencrypt again − − dehydrated -c − − To restore the original certificates: − − config delprop modSSL CertificateChainFile − config delprop modSSL crt − config delprop modSSL key − − signal-event console-save − − ===Errors=== − − − ====No registration exists matching provided key==== − − − If you see the following: − − {"type":"urn:acme:error:unauthorized","detail":"No registration exists matching provided key","status":403} − − https://github.com/lukas2511/letsencrypt.sh/issues/2 − − See above for removing private keys and regenerating − − ====rateLimited, Too many currently pending Authorizations==== − − If you see something like this you may have hit the rate limit: − − {"type":"urn:acme:error:rateLimited","detail":"Error creating new authz :: Too many currently pending authorizations.","status":429} − − https://github.com/lukas2511/letsencrypt.sh/blob/master/docs/staging.md − − https://letsencrypt.org/docs/rate-limits/ − − ====Some challenges complete successfully but some hostnames fail==== − − If you see some of your challenges returned without error but some fail, you possibly do not have Public DNS A or MX records for all the host names that you are adding to your certificate. − − Using the command: − config setprop letsencrypt configure all − − Is likely to cause this error. When a domain is added to an SME server, several host names are created automatically. these include ftp.your-domain.com, wpad.your-domain.com, proxy.your-domain.com, mail.your-domain.com, www.your-domain.com. Most of us do not create public DNS records for all these host names. When letsencrypt issues a challenge for a list of host names and '''ONE''' does not resolve, the challenge will fail and the certificate will not generate at all. − − To resolve this, issue the following command: − config setprop letsencrypt configure none − − Then follow up with the commands to enable letsencrypt for each PUBLIC resolvable domain and hostname: − db domains setprop domain1.com letsencryptSSLcert enabled − and for each hostname: − db hosts setprop www.domain1.com letsencryptSSLcert enabled − − db hosts setprop mail.domain1.com letsencryptSSLcert enabled − until all the public facing hostnames are enabled − followed by: − signal-event console-save − − Thanks to MSmith for the following forum thread. − − https://forums.contribs.org/index.php/topic,53052.0.html − − ====Challenge fails with unauthorized 403 error==== − − If your challenge returns something like the following: − ERROR: Challenge is invalid! (returned: invalid) (result: { − "type": "http-01", − "status": "invalid", − "error": { − "type": "urn:acme:error:unauthorized", − "detail": "Invalid response from http://www.your-domain.com/.well-known/acme-challenge/<redacted text> − "status": 403 − and your ''httpd error_log'' on your server shows something like this: − (13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied − (13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied − (13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied − − You need to check the ownership and rights on ''/home/e-smith/files/ibays/Primary'' and on ''/home/e-smith/files/ibays/Primary/html''. The contrib creates a hidden working directory at ''/home/e-smith/files/ibays/Primary/html/.well-known'' and inside that directory a second directory with the following path ''/home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge''. The script creates the two new directories with the correct ownerships and rights, however, if the ownership and rights on the ibay and the html directory do not allow the script to access the new location, the challenge will fail with ''access denied'' − − use the following to check the rights: − cd /home/e-smith/files/ibays − then − ls -l − on my test server with only the Primary ibay I get the following (you will probably show a bunch more ibays on your server but we are only concerned with Primary): − total 4 − drwxr-xr-x 5 root root 4096 Jul 25 2016 Primary − − If this is not what you see, you need to correct it. − − '''THIS MAY BREAK NON STANDARD CUSTOMIZATION OF YOUR SERVER, YOU NEED TO UNDERSTAND WHY THIS HAS BEEN CHANGED BEFORE YOU REVERSE IT''' − − From within ''/home/e-smith/files/ibays/'' issue the following: − chown root:root Primary − If the rights are not correct, issue: − chmod 0755 Primary − − Next check the html directory. − cd /home/e-smith/files/ibays/Primary − then − ls -l − on my test server I have the following − [root@backupserver Primary]# ls -l − total 12 − drwxr-s--- 2 admin shared 4096 Jul 25 2016 cgi-bin − drwxr-s--- 2 admin shared 4096 Jul 25 2016 files − '''drwxr-s--- 3 admin shared 4096 Jun 11 08:06 html''' − − If this is not what you see, − − '''FIRST READ ABOVE WARNING''' − − then adjust as follows − chown admin:shared html − If the rights are not correct, issue: − chmod 2750 html − − rerun − dehydrated -c − − and your challenges should complete. − − https://forums.contribs.org/index.php/topic,53147.0.html − + + + + Line 419:
Line 293: − +
Add correct wiki page for Note re fail on All
{{Languages|Letsencrypt}}
{{Languages|Letsencrypt}}
{{Level|Medium}}
{{Level|Medium}}
==Introduction==
<!-- here we define the contrib name variable -->
<!-- we get the page title, remove suffix for translated version; if needed you can define there with the value you want-->
{{#vardefine:contribname| {{lc: {{#titleparts: {{BASEPAGENAME}} |1}} }} }}
{{#vardefine:smecontribname| smeserver-{{lc: {{#titleparts: {{BASEPAGENAME}} |1}} }} }}
<!-- we define the language -->
{{#vardefine:lang| {{lc: {{#titleparts: {{PAGENAME}} | | -1}} }} |en }}
{{Infobox contribs
|name={{#var:contribname}}
|image={{#var:contribname}}.jpg
|description_image= {{#var:contribname}} logo
|maintainer= John Crisp
|licence= MIT license
|url= https://github.com/dehydrated-io/dehydrated
|category= certificates
|tags=dehydrated,letsencrypt,dns,http,ssl
}}
==Maintainer==
John Crisp
== Version ==
{{#set: Version=Contrib10}}
{{#smeversion:smeserver-letsencrypt }}
<br>
==Description==
{{warning box| The original protocol used by Let’s Encrypt for certificate issuance and management is called ACMEv1. In March of 2018 Letsencrypt introduced support for ACMEv2, a newer version of the protocol that matches what was finalized today as RFC 8555 328. They have been encouraging subscribers to move to the ACMEv2 protocol.
{{warning box| The original protocol used by Let’s Encrypt for certificate issuance and management is called ACMEv1. In March of 2018 Letsencrypt introduced support for ACMEv2, a newer version of the protocol that matches what was finalized today as RFC 8555 328. They have been encouraging subscribers to move to the ACMEv2 protocol.
Multiple clients are available for the Letsencrypt services. The official "certbot" client from letsencrypt.org is quite full-featured, but has a number of dependencies that it needs to install. It also requires a newer version of Python than is included with a standard SME Server installation. Due to this complexity, and the lack of compatibility with SME 8.x, this document describes installation and use of ''[https://github.com/lukas2511/dehydrated dehydrated]'', an alternative client implemented as a BASH shell script.
Multiple clients are available for the Letsencrypt services. The official "certbot" client from letsencrypt.org is quite full-featured, but has a number of dependencies that it needs to install. It also requires a newer version of Python than is included with a standard SME Server installation. Due to this complexity, and the lack of compatibility with SME 8.x, this document describes installation and use of ''[https://github.com/lukas2511/dehydrated dehydrated]'', an alternative client implemented as a BASH shell script.
==Prerequisites==
==Prerequisites==
==Installation of Dehydrated letsencrypt contrib==
==Installation of Dehydrated letsencrypt contrib==
John Crisp has prepared a contrib that installs the dehydrated script, creates the appropriate configuration files, and integrates with the SME templates system. This is the simplest way to install dehydrated on your SME Server.
John Crisp has prepared a contrib that installs the dehydrated script, creates the appropriate configuration files, and integrates with the SME templates system. This is the simplest way to install dehydrated on your SME Server.
<tabs container style="display: inline-block;"><tab name="For SME 10">
yum install smeserver-letsencrypt
You will then need to configure the domains and hosts for which you want to ask a certificate. See the following Configuration section.
If your smeaddons repo has been disabled add --enablerepo=smeaddons and reenable it, as it should be by default.
db yum_repositories setprop smeaddons status enabled
signal-event yum-modify
</tab><tab name="For SME 9">
===Installation===
===Installation===
yum install smeserver-letsencrypt
yum install smeserver-letsencrypt
signal-event console-save
You will then need to configure the domains and hosts for which you want to ask a certificate. See the following Configuration section.
You will then need to configure the domains and hosts for which you want to ask a certificate. See the following Configuration section.
===Updates===
If your smeaddons repo has been disabled add --enablerepo=smeaddons and reenable it, as it should be by default.
db yum_repositories setprop smeaddons status enabled
signal-event yum-modify
signal-event console-save
===Updating===
===Updating===
A full update can be done as follow :
A full update can be done as follow :
yum update smeserver-letsencrypt dehydrated
yum update smeserver-letsencrypt dehydrated
config setprop letsencrypt ACCEPT_TERMS yes
signal-event console-save
failure to do this might leave the contribution not working and your certificates not renewed.
</tab>
</tabs>
==Configuration==
There are several configuration database entries that need to be made in order to set up this contrib. Most of them tell the scripts which hostnames need to be part of your certificate.
=== Rush jobs ===
signal-event post-upgrade; signal-event reboot
For the test ('''adjust the domains and hosts'''):
<tabs container style="display: inline-block;"><tab name="For SME 10">
config setprop letsencrypt ACCEPT_TERMS yes status test
# really fast job to enable the primary domain
db domains setprop $(config get DomainName) letsencryptSSLcert enabled
#foreach of your domains you want SSL do the following
db domains setprop '''domain1.com''' letsencryptSSLcert enabled
#foreach of your hosts (subdomains) you want SSL do the following
db hosts setprop '''www.domain1.com''' letsencryptSSLcert enabled
signal-event smeserver-letsencrypt-update
dehydrated -c
</tab><tab name="For SME 9">
config setprop letsencrypt ACCEPT_TERMS yes status test API 2
#foreach of your domains you want SSL do the following
db domains setprop '''domain1.com''' letsencryptSSLcert enabled
#foreach of your hosts (subdomains) you want SSL do the following
db hosts setprop '''www.domain1.com''' letsencryptSSLcert enabled
signal-event console-save
dehydrated -c
</tab>
</tabs>
Check that the certificates are available ( your browser will still issue an error, but you can explore the content of the certificate to see that the Let's Encrypt test CA was used to sign your SSL certificate and that all your domains and hosts are in the "Certificate Subject Alt Name" property.
For the production ('''adjust your email'''):
<tabs container style="display: inline-block;"><tab name="For SME 10">
config setprop letsencrypt status enabled email admin@$(config get DomainName)
signal-event smeserver-letsencrypt-update
dehydrated -c -x
</tab><tab name="For SME 9">
config setprop letsencrypt status enabled email '''admin@domain1.com'''
signal-event console-save
signal-event console-save
dehydrated -c -x
</tab>
</tabs>
===Step by step configuration===
==Configuration==
====Hosts and domains for the certificate====
====Hosts and domains for the certificate====
* domain1.com
* domain1.com
** www.domain1.com
** mail.domain1.com
** ftp.domain1.com
* domain2.com
* domain2.com
** www.domain2.com
** mail.domain2.com
For each DOMAIN that you want to be included in the certificate, run this command:
For each DOMAIN that you want to be included in the certificate, run this command:
db domains setprop $DOMAIN letsencryptSSLcert enabled
db domains setprop $DOMAIN letsencryptSSLcert enabled
With the system configuration described above, setting this to "domains" will obtain a certificate covering domain1.com and domain2.com, but not www.domain1.com, etc. Setting it to "hosts" will obtain a certificate covering www.domain1.com, mail.domain1.com, ftp.domain1.com, etc., but not domain1.com or domain2.com. Setting this property to "all" will include all domain names and hostnames in the certificate. '''see [[Letsencrypt#Some_challenges_complete_successfully_but_some_hostnames_fail|NOTE]] before setting this to "all"'''
With the system configuration described above, setting this to "domains" will obtain a certificate covering domain1.com and domain2.com, but not www.domain1.com, etc. Setting it to "hosts" will obtain a certificate covering www.domain1.com, mail.domain1.com, ftp.domain1.com, etc., but not domain1.com or domain2.com. Setting this property to "all" will include all domain names and hostnames in the certificate. '''See [[Letsencrypt/Troubleshooting#Some_challenges_complete_successfully_but_some_hostnames_fail|NOTE]] before setting this to "all".'''
==== Enable test mode ====
After installing and configuring all the domains and hosts, the next step is to use test mode, which is enabled by default. This will obtain certificates from the staging server. The rate limits discussed in the introduction won't apply, so any errors or other issues won't prevent you from obtaining your production certificate. Enable test mode using this command:
config setprop letsencrypt status test
config setprop letsencrypt status test
signal-event console-save
signal-event console-save
If this runs without errors, try to connect to your server-manager page. You should see an error that the security certificate wasn't issued by a trusted certification authority; this is perfectly normal. However, there should be a certificate, it should include all the hostnames you wanted included, and it should be valid for the next ninety days. If this was successful, proceed to production.
If this runs without errors, try to connect to your server-manager page. You should see an error that the security certificate wasn't issued by a trusted certification authority; this is perfectly normal. However, there should be a certificate, it should include all the hostnames you wanted included, and it should be valid for the next ninety days. If this was successful, proceed to production.
===Enable Production Mode===
====Enable Production Mode====
Once you've successfully tested your installation, set it to production mode using these commands:
Once you've successfully tested your installation, set it to production mode using these commands:
Once you've obtained your certificate and configured your server, test your server with a tool like [https://www.ssllabs.com/ssltest/ SSLLabs.com] to make sure it's working properly.
Once you've obtained your certificate and configured your server, test your server with a tool like [https://www.ssllabs.com/ssltest/ SSLLabs.com] to make sure it's working properly.
===Archive old certificates===
====Archive old certificates====
A new function lets you cleanup old and archive old certificates.
A new function lets you cleanup old and archive old certificates.
dehydrated --cleanup (-gc)
dehydrated --cleanup (-gc)
===Rush jobs===
===Configuration properties===
{| class="wikitable"
!Key
!property
!default
!values
!
|-
| rowspan="10" |letsencrypt
|ACCEPT_TERMS
|
|empty, yes
|set to yes to accept terms of service, if left empty the contrib will not work.
|-
|API
|2
|1,2
|deprecated, will always be v2, as v1 is deprecated as per june 2021
|-
|configure
|none
|none,all,domains,hosts
|this will change the default behaviour on non explicitly domains or hosts with "letsencryptSSLcert enabled". By default will not be used, if hosts is set will ask a cert for all hosts, if domains is set will ask a cert for all domains, if all is set, will ask for both domains and hosts. In all situation it will ask a cert for domains/hosts where "letsencryptSSLcert enabled" is set and it is not set to "letsencryptSSLcert disabled"
|-
|email
|
|email
|enter the email to create account and receive updates from Let's Encrypt
|-
|hookScript
|disabled
|enabled,disabled
|will trigger advanced hook script if enabled, even if disabled the part to signal-event ssl-update to propagate the cert will run.
|-
|hostOverride
|disabled
|yes,disabled
|default disabled, if disabled will only ask cert for hosts (if selected according to configure and "letsencryptSSLcert enabled") for hosts with type=Self. If set to yes will include any listed hosts whether remote or local.
|-
|keysize
|4096
|base 2 number
|length of your certificate's private key, if you don't want the '''default of 4096''' bits. This should not be necessary in most cases, but if desired, use this command to do so:
|-
|status
|test
|enabled,disabled,test
|default status is disabled, '''First set it to test''' to connect to the test server of let's Encrypt to check if your server is well configured. After checking everything is ok, you can set it to enabled.
|}
== Troubleshooting ==
== Troubleshooting ==
see [[Letsencrypt/Troubleshooting]]
== Advanced Topics ==
== Advanced Topics ==
see [[Letsencrypt/Advanced]]
see [[Letsencrypt/Advanced]]
= Bugs =
== Uninstall ==
yum remove {{#var:smecontribname}} {{#var:contribname}}
== Bugs ==
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
and select the smeserver-letsencrypt component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-letsencrypt|title=this link}}
and select the smeserver-letsencrypt component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-letsencrypt|title=this link}}
{{#bugzilla:columns=id,product,version,status,summary |sort=id |order=desc |component=smeserver-letsencrypt |disablecache=1|noresultsmessage="No open bugs found."}}
{{#bugzilla:columns=id,product,version,status,summary |sort=id |order=desc |component=smeserver-letsencrypt |disablecache=1|noresultsmessage="No open bugs found."}}
= Changelog =
== Changelog ==
Only released version in smecontrib are listed here.
Only released version in smecontrib are listed here.
