September 13, 20196 yr Hm, I cant seem to find the proper configuration. Accessing attachments should be allowed for the members group. But the file is basically the same as the diff I've sent you, here the contents: From 6ebb8dabc448a692c591c4286a5a39eae13c275b Mon Sep 17 00:00:00 2001 From: Michael Kaufmann <d00p@froxlor.org> Date: Thu, 12 Sep 2019 12:30:47 +0200 Subject: [PATCH] re-create certificate if SAN list or domain changes Signed-off-by: Michael Kaufmann <d00p@froxlor.org> --- lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php b/lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php index e0967ca0..32d7fae1 100644 --- a/lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php +++ b/lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php @@ -62,7 +62,7 @@ class AcmeSh extends \Froxlor\Cron\FroxlorCron SELECT domssl.`id`, domssl.`domainid`, - domssl.expirationdate, + domssl.`expirationdate`, domssl.`ssl_cert_file`, domssl.`ssl_key_file`, domssl.`ssl_ca_file`, @@ -221,9 +221,14 @@ class AcmeSh extends \Froxlor\Cron\FroxlorCron // Only renew let's encrypt certificate if no broken ssl_redirect is enabled if ($certrow['ssl_redirect'] != 2) { - if (! empty($certrow['ssl_cert_file'])) { + $do_force = false; + if (! empty($certrow['ssl_cert_file']) && !empty($certrow['expirationdate'])) { $cert_mode = 'renew'; $cronlog->logAction(FroxlorLogger::CRON_ACTION, LOG_INFO, "Updating certificate for " . $certrow['domain']); + } else if (! empty($certrow['ssl_cert_file']) && empty($certrow['expirationdate'])) { + // domain changed (SAN or similar) + $do_force = true; + $cronlog->logAction(FroxlorLogger::CRON_ACTION, LOG_INFO, "Re-creating certificate for " . $certrow['domain']); } else { $cronlog->logAction(FroxlorLogger::CRON_ACTION, LOG_INFO, "Creating certificate for " . $certrow['domain']); } @@ -252,7 +257,7 @@ class AcmeSh extends \Froxlor\Cron\FroxlorCron } } - self::runAcmeSh($certrow, $domains, $cert_mode, $cronlog, $changedetected); + self::runAcmeSh($certrow, $domains, $cert_mode, $cronlog, $changedetected, $do_force); } else { $cronlog->logAction(FroxlorLogger::CRON_ACTION, LOG_WARNING, "Skipping Let's Encrypt generation for " . $certrow['domain'] . " due to an enabled ssl_redirect"); } @@ -270,7 +275,7 @@ class AcmeSh extends \Froxlor\Cron\FroxlorCron } } - private static function runAcmeSh($certrow = array(), $domains = array(), $cert_mode = 'issue', &$cronlog = null, &$changedetected = 0) + private static function runAcmeSh($certrow = array(), $domains = array(), $cert_mode = 'issue', &$cronlog = null, &$changedetected = 0, $force = false) { if (! empty($domains)) { @@ -295,6 +300,9 @@ class AcmeSh extends \Froxlor\Cron\FroxlorCron if (Settings::Get('system.letsencryptca') == 'testing') { $acmesh_cmd .= " --staging"; } + if ($force) { + $acmesh_cmd .= " --force"; + } $acme_result = \Froxlor\FileDir::safe_exec($acmesh_cmd); -- 2.20.1
September 15, 20196 yr Author It seems to work. When I add a domain as an alias, a new certificate is created. But the certificate is not good: # openssl x509 -in /etc/ssl/froxlor-custom/xxxxxxx.net.crt -text -noout unable to load certificate 140135579193600:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1130: 140135579193600:error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:290:Type=X509 140135579193600:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:../crypto/pem/pem_oth.c:33: The content of the certificate is: -----BEGIN CERTIFICATE----- ewogICJ0eXBlIjogInVybjphY21lOmVycm9yOnJhdGVMaW1pdGVkIiwKICAiZGV0 YWlsIjogIkVycm9yIGNyZWF0aW5nIG5ldyBjZXJ0IDo6IHRvbyBtYW55IGNlcnRp ZmljYXRlcyBhbHJlYWR5IGlzc3VlZCBmb3IgZXhhY3Qgc2V0IG9mIGRvbWFpbnM6 IGNhbXBpYW5vLmRlLGNhbXBpYW5vLmVzLGNhbXBpYW5vLmZyLGNhbXBpYW5vLml0 LGNhbXBpYW5vLm5ldCxjYW1waWFuby5ubCxjcm9uLmNhbXBpYW5vLm5ldCx3ZWJo b29rLmNhbXBpYW5vLm5ldCx3d3cuY2FtcGlhbm8uZGUsd3d3LmNhbXBpYW5vLmVz LHd3dy5jYW1waWFuby5mcix3d3cuY2FtcGlhbm8uaXQsd3d3LmNhbXBpYW5vLm5l dCx3d3cuY2FtcGlhbm8ubmw6IHNlZSBodHRwczovL2xldHNlbmNyeXB0Lm9yZy9k b2NzL3JhdGUtbGltaXRzLyIsCiAgInN0YXR1cyI6IDQyOQp9 -----END CERTIFICATE----- which seems quite short.
September 15, 20196 yr Author I found the following line in the output: [Sun Sep 15 15:13:43 CEST 2019] Sign failed: "detail":"Error creating new cert :: too many certificates already issued for exact set of domains: xxxxxxx.ca,xxxxxxx.de,xxxxxxx.es,xxxxxxx.fr,xxxxxxx.it,xxxxxxx.net,xxxxxxx.nl,xxxxxxx.us,cron.xxxxxxx.net,webhook.xxxxxxx.net,www.xxxxxxx.ca,www.xxxxxxx.de,www.xxxxxxx.es,www.xxxxxxx.fr,www.xxxxxxx.it,www.xxxxxxx.net,www.xxxxxxx.nl,www.xxxxxxx.us: see https://letsencrypt.org/docs/rate-limits/" As a result, I seem to get a faulty cert from LE, instead of no cert at all. Then, when restarting Apache, it fails with "Configuration failed".
Archived
This topic is now archived and is closed to further replies.