LetsEncrypt - SSL certificate is not valid

now it's broken ... (debian & ubuntu)

new certificates can no longer be created and the check shows for a certificate that was generated an hour before:

any idea how to proceed?

Quote from vege.net

we had the same problems, here is a hot fix which worked for us:

cd /usr/share/ca-certificates/mozilla/

wget https://letsencrypt.org/certs/lets-encrypt-r3.pem

mv lets-encrypt-r3.pem lets-encrypt-r3.crt

dpkg-reconfigure ca-certificates

-->> choose new letsencrypt Cert

vi /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm +134

comment out line 134

my $cmd = [

'openssl', 'verify',

# ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),

'-purpose', 'sslserver', $self->{'certificate_container_path'}

];

Regards, Joern

ps: Debian 9 / i-MSCP 1.5.3 Build: 2018120800

Build: 2018120800

Display More

Thank You!

should only the mozilla/letsencryypt-r3.crt selected in the dialog?

I mean should any other be de-selected?

Quote from vege.net

no, just added the cert.. dont know if the others are necessary.. (?)

your welcome

OK, it seems it shows existing & available, only one cert (letsencrypt) was added

in /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm

Only 'openssl', 'verify' should remain active?

Quote from vege.net

just comment out line 134

# ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),

yeah, it seems to work ...

great job, respect!

Thanks a lot

@Joern

I noticed earlier today that the imscp (panel) certificates are not affected by the internal verification process ...

you hit exactly the point to solve the problem w/ the customer stuff and the letsencrypt-r3.crt seems to work

openssl verify still shows an error but the certificate seems to be valid

I also tried to remove the CA X3 incl. reboot afterwards but that didn't change anything ...